@bongos/core 1.19.416 → 1.19.418

package/src/bongos/route-rank-check.js

@@ -197,6 +197,16 @@ const EXPECTED_RANKS = {
   // session revocation (kill another builder's / all sessions)
   'POST /auth/revoke': 'perm:auth.session.revoke',
   'POST /auth/revoke-all': 'perm:auth.session.revoke',
+  // deliberately any-builder (task 1003341) — the OWN-scoped half of the same
+  // capability. These reach only the caller's own sessions (every statement is
+  // keyed on req.builder.id), so a rank floor here would just put an Archon back
+  // between a person and their own leaked token, which is the gap they close.
+  // Pinned in BOTH directions: an accidental rank/permission gate would silently
+  // re-break the self-serve remedy, and a widening to `public` would hand an
+  // anonymous caller a sign-out button.
+  'GET /me/sessions': 'any-builder',
+  'POST /me/sessions/revoke': 'any-builder',
+  'POST /me/sessions/revoke-all': 'any-builder',
   // forensic surfaces
   'GET /audit-log': 'perm:audit_log.read',
   'GET /builders/roster': 'perm:builder.roster.read',

package/src/bongos/routes/my-sessions.js

@@ -0,0 +1,128 @@
+// src/bongos/routes/my-sessions.js — a builder's own auth sessions: see them, kill them.
+//
+// WHY. A CLI bearer refreshes to now()+24h on every authenticated call (the
+// refresh-on-use UPDATE in db-kernel.js lookupSession), so a token that keeps
+// being used never expires on its own. Until these routes existed the only
+// remedy for a LEAKED one was POST /auth/revoke-all, gated on the admin
+// `auth.session.revoke` atom — so the victim had to find an Archon to sign them
+// out, and a single-owner self-hosted instance may not have a second Archon at
+// all. That is the gap this file closes: the account holder gets the remedy
+// directly, without anybody's permission but their own.
+//
+// THE INVARIANT, and the only thing that really matters when editing this file:
+// the account is ALWAYS req.builder.id, resolved by requireBuilder from the
+// session the caller actually presented. It is never read from the query
+// string, the request body, or the path. Every statement underneath carries
+// `builder_id = <caller>` in its WHERE clause, so an id belonging to somebody
+// else matches no row: a caller who guesses a stranger's session id gets
+// `revoked: 0` and learns nothing about whether it existed.
+//
+// WHY ITS OWN FILE rather than three more routes in routes/auth.js. The
+// cross-builder admin pair next door legitimately takes its target from the
+// request body — that is what makes it an admin route. Keeping the own-scoped
+// half in a separate file lets tests/own_session_revoke.mjs assert the
+// no-caller-named-id rule over this source WHOLE, with no carve-out for a
+// neighbouring route to hide behind. routes/auth.js is also the largest file in
+// the directory; this work does not belong in it.
+//
+// The token value is never selected, never logged, and never returned — a list
+// that handed back tokens would turn one stolen session into all of them.
+//
+// The 24h sliding refresh itself is deliberately left alone here; ADR 0206
+// records why an absolute ceiling is a separate decision from this remedy.
+
+const express = require('express');
+const auth = require('../auth');
+const db = require('../db');
+const { validateOrRespond } = require('./_helpers');
+const log = require('../logger').logger.child({ src: 'my-sessions' });
+
+// A bigserial id as the client may spell it. Matched (and then PASSED) as a
+// string rather than coerced through Number: a bigint above 2^53 would lose
+// precision on the way through, and a parameterized comparison against a bigint
+// column takes the text form without complaint.
+const SESSION_ID_RE = /^[0-9]{1,19}$/;
+
+// The list shape a person needs to RECOGNISE one of their own sessions: where it
+// came from, when it was minted, when it was last used, what client held it —
+// plus which row is the very request being served, so the UI can warn before
+// somebody signs out the browser they are reading the page in.
+function presentSession(row, currentSessionId) {
+  return {
+    id: String(row.id),
+    source: row.source,
+    user_agent: row.user_agent ?? null,
+    created_at: row.created_at,
+    last_used_at: row.last_used_at,
+    expires_at: row.expires_at,
+    current: currentSessionId !== null && String(row.id) === currentSessionId,
+  };
+}
+
+// The id of the session THIS request authenticated with, as a string, or null
+// when the auth layer did not leave one (no live row can then be marked current,
+// which is the safe direction — the UI simply omits the "this is you" badge).
+function currentSessionId(req) {
+  const id = req.gdsSession && req.gdsSession.session_id;
+  return id === undefined || id === null ? null : String(id);
+}
+
+module.exports = function buildMySessionsRouter() {
+  const router = express.Router();
+
+  // GET /api/bongos/me/sessions — every live session on the CALLER's account.
+  // rank: any-builder (own identity only) — a builder owns their own sessions;
+  // the account is req.builder.id, never a caller-named one, so there is nothing
+  // here for a rank gate to protect.
+  router.get('/me/sessions', auth.requireBuilder, async (req, res) => {
+    try {
+      const rows = await db.listActiveSessionsForBuilder(req.builder.id);
+      const current = currentSessionId(req);
+      res.json({ sessions: rows.map((row) => presentSession(row, current)) });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'GET /me/sessions failed');
+      res.fail('list_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // POST /api/bongos/me/sessions/revoke — kill ONE of the caller's own sessions.
+  // Body: { session_id }. Response: { ok, revoked: 0|1 }. Revoking the session
+  // that made the request is allowed and immediate: the response is written from
+  // a request that already authenticated, and the next call with that token
+  // fails. `revoked: 0` covers "already gone", "never existed" and "not yours"
+  // alike — the caller must not be able to probe for other people's session ids.
+  // rank: any-builder (own identity only) — the WHERE clause is the boundary.
+  router.post('/me/sessions/revoke', auth.requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, { session_id: {} })) return;
+    const raw = req.body && req.body.session_id;
+    if (raw === undefined || raw === null || !SESSION_ID_RE.test(String(raw))) {
+      return res.fail('bad_session_id', { status: 400, message: 'session_id must be a positive integer id from GET /me/sessions' });
+    }
+    try {
+      const revoked = await db.revokeSessionForBuilder(String(raw), req.builder.id);
+      res.json({ ok: true, revoked });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'POST /me/sessions/revoke failed');
+      res.fail('revoke_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // POST /api/bongos/me/sessions/revoke-all — sign out everywhere. Kills EVERY
+  // live session on the caller's account, the one making the request included.
+  // That total sweep is the point: this is the button somebody presses when they
+  // believe a token has leaked, and a remedy that spared one session would leave
+  // them guessing which. They sign in again afterwards. Response: { ok, revoked }.
+  // rank: any-builder (own identity only) — the sweep is keyed on req.builder.id.
+  router.post('/me/sessions/revoke-all', auth.requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, {})) return;
+    try {
+      const revoked = await db.revokeAllSessionsForBuilder(req.builder.id);
+      res.json({ ok: true, revoked });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'POST /me/sessions/revoke-all failed');
+      res.fail('revoke_all_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/src/bongos/routes.js

@@ -22,6 +22,10 @@ const buildInstanceRouter = require('./routes/instance');
 const buildAuthRouter = require('./routes/auth');
 const buildGithubRouter = require('./routes/github');
 const buildMeRouter = require('./routes/me');
+// The own-scoped session self-service (list / revoke one / sign out everywhere,
+// task 1003341). Its own router rather than three more routes on the /me
+// aggregator or the admin pair in routes/auth.js — see that file's header.
+const buildMySessionsRouter = require('./routes/my-sessions');
 const buildBuildersRouter = require('./routes/builders');
 // The LIFECYCLE routes (tasks · claims · versions · done-when · goals ·
 // dependencies · gate-approvals · analytics) carved into modules/lifecycle/
@@ -124,6 +128,7 @@ function buildGdsRouter() {
   router.use(buildAuthRouter());
   router.use(buildGithubRouter());
   router.use(buildMeRouter());
+  router.use(buildMySessionsRouter());
   router.use(buildBuildersRouter());
   // tasks · claims · versions · done-when · goals · dependencies · analytics now
   // mount via moduleLoader.mountModuleRoutes below (lifecycle module, BV1.R86) —

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.416'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.418'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hub_recent_ships.mjs

@@ -163,7 +163,10 @@ await t('the route passes recent_ships through and takes the origin from the CLI
       return { rows: [{ client_id: 'c1', secret_hash: pi.sha256hex(SECRET), status: 'active', origin: ORIGIN }] };
     }
     if (/FROM platform_identity_project_memberships/.test(sql)) {
-      return { rows: [{ id: 1, client_id: 'c1', github_id: 42, membership_kind: 'member' }] };
+      // signin_verified_at is what ADR 0205 made the rollup gate read: a
+      // membership row alone was never proof, because the check-in that wrote it
+      // is the caller's own unverified claim. A real sign-in stamps it.
+      return { rows: [{ id: 1, client_id: 'c1', github_id: 42, membership_kind: 'member', signin_verified_at: '2026-08-29T00:00:00.000Z' }] };
     }
     return { rows: [{ id: 1 }] };
   });

package/tests/own_scope_guard.mjs

@@ -79,6 +79,11 @@ const OWN_SCOPED_SURFACES = [
     why: 'the /me aggregator: identity, rank, credits, streak, claims and prefs for the CALLER. Every slice keys on req.builder.id.',
     crossOwner: [],
   },
+  {
+    file: 'src/bongos/routes/my-sessions.js',
+    why: "the caller's OWN auth sessions — list, revoke one, sign out everywhere (task 1003341, ADR 0206). Every statement carries builder_id = req.builder.id, so a session id belonging to somebody else matches no row. Kept OUT of routes/auth.js precisely so this whole file can be held to the own-scope rule: the admin cross-builder pair next door takes its target from the body, which is what makes it admin.",
+    crossOwner: [],
+  },
   {
     file: 'modules/builder-settings/routes/settings.js',
     why: 'the per-builder preference domain (wandering, skill, sound, render, model-allocation, display name) carved out of /me — read and write, all keyed on req.builder.id.',

package/tests/own_session_revoke.mjs

@@ -0,0 +1,410 @@
+// tests/own_session_revoke.mjs — the own-scoped session self-service
+// (task 1003341, goal 1000045; src/bongos/routes/my-sessions.js).
+//
+// The gap these routes close: a CLI bearer refreshes to now()+24h on every call,
+// so a leaked one never expires, and the only revoke endpoints were gated on the
+// admin `auth.session.revoke` atom — the victim needed an Archon. What this file
+// pins is therefore the ISOLATION, not the plumbing:
+//
+//   1. a non-admin builder (xenos, the bottom rung) CAN list and revoke their
+//      own sessions, and sign out everywhere, with no rank and no permission;
+//   2. that same builder CANNOT see or kill anybody else's — not by naming a
+//      builder in the query string, not by naming one in the body, and not by
+//      guessing a stranger's session id;
+//   3. a revoked bearer stops authenticating on the very next request;
+//   4. the token value never appears in a response.
+//
+// DB-FREE, and deliberately NOT a mock of the route's own answers: the fake pool
+// below is a small in-memory `builder_sessions` table plus a mini-interpreter
+// that builds each statement's filter FROM THAT STATEMENT'S OWN WHERE CLAUSE. So
+// if `builder_id = $2` were ever dropped from the own-scoped revoke, the filter
+// would genuinely widen and test 2 would genuinely fail — the isolation is
+// executed, not asserted against a string. The interpreter refuses any statement
+// whose placeholders it did not all consume, so a rewritten predicate it cannot
+// read is a loud error rather than a silently weaker filter.
+//
+// Everything above the pool is REAL: the real auth.requireBuilder, the real
+// db-kernel lookupSession (refresh-on-use and all), the real router, over real
+// HTTP. Nothing about identity is stubbed, which is what makes (3) a proof.
+//
+// Run:  node tests/own_session_revoke.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ===========================================================================
+// The in-memory builder_sessions table + its statement interpreter
+// ===========================================================================
+
+const DAY = 24 * 60 * 60 * 1000;
+const BUILDERS = {
+  1: { github_id: 1001, github_login: 'ada', display_name: 'Ada', avatar_url: null,
+       total_credits: 0, rank: 'xenos', status: 'active', system_role: null, anthropic_user_id: null },
+  2: { github_id: 1002, github_login: 'bo', display_name: 'Bo', avatar_url: null,
+       total_credits: 0, rank: 'xenos', status: 'active', system_role: null, anthropic_user_id: null },
+};
+
+let sessions = [];
+function seed() {
+  const now = Date.now();
+  sessions = [
+    // Ada's — a CLI bearer (the leaked-token case), a browser cookie, one already
+    // revoked and one already expired (neither may ever surface in a list).
+    { id: 101, builder_id: 1, token: 'adacli', source: 'cli', user_agent: 'cloud-bongos-cli',
+      created_at: new Date(now - 30 * DAY), last_used_at: new Date(now - 60_000), expires_at: new Date(now + DAY), revoked_at: null },
+    { id: 102, builder_id: 1, token: 'adaweb', source: 'web', user_agent: 'Mozilla/5.0',
+      created_at: new Date(now - 2 * DAY), last_used_at: new Date(now - 3_600_000), expires_at: new Date(now + DAY), revoked_at: null },
+    { id: 103, builder_id: 1, token: 'adaold', source: 'cli', user_agent: 'old laptop',
+      created_at: new Date(now - 90 * DAY), last_used_at: new Date(now - 80 * DAY), expires_at: new Date(now + DAY), revoked_at: new Date(now - 80 * DAY) },
+    { id: 104, builder_id: 1, token: 'adagone', source: 'cli', user_agent: 'lapsed',
+      created_at: new Date(now - 90 * DAY), last_used_at: new Date(now - 70 * DAY), expires_at: new Date(now - 60 * DAY), revoked_at: null },
+    // Bo's — the stranger's session Ada must never reach.
+    { id: 201, builder_id: 2, token: 'bocli', source: 'cli', user_agent: 'bo-cli',
+      created_at: new Date(now - DAY), last_used_at: new Date(now - 120_000), expires_at: new Date(now + DAY), revoked_at: null },
+  ];
+}
+
+// Build a row filter from the statement's OWN where clause. Every placeholder the
+// clause mentions must be consumed by a fragment below; one that is not throws,
+// so a predicate this cannot read can never degrade into "no constraint".
+function predicateFor(sql, params) {
+  const where = sql.includes(' WHERE ') ? sql.slice(sql.indexOf(' WHERE ') + 7) : '';
+  const tests = [];
+  const consumed = new Set();
+  const take = (re, make) => {
+    const m = re.exec(where);
+    if (!m) return;
+    consumed.add(m[1]);
+    tests.push(make(params[Number(m[1]) - 1]));
+  };
+  take(/\b(?:s\.)?token = \$(\d+)/, (v) => (r) => r.token === v);
+  take(/(?<!_)\b(?:s\.)?id = \$(\d+)/, (v) => (r) => String(r.id) === String(v));
+  take(/\bbuilder_id = \$(\d+)/, (v) => (r) => String(r.builder_id) === String(v));
+  if (/revoked_at IS NULL/.test(where)) tests.push((r) => r.revoked_at === null);
+  if (/expires_at IS NULL OR expires_at > now\(\)/.test(where)) {
+    tests.push((r) => r.expires_at === null || r.expires_at > new Date());
+  }
+  for (const m of where.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(m[1])) {
+      throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${where}" — the interpreter must not silently ignore a filter`);
+    }
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+// The columns a SELECT actually names, so a projection that started shipping
+// `token` would put it in the response body (and trip the leak test) rather than
+// be quietly dropped by a hand-written fake.
+function selectedColumns(sql) {
+  const m = /^SELECT (.+?) FROM /.exec(sql);
+  return m[1].split(',').map((c) => c.trim());
+}
+
+let calls = [];
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    calls.push({ sql, params });
+    const match = predicateFor(sql, params);
+    if (/^SELECT/.test(sql) && /AS session_id/.test(sql)) {
+      // db-kernel lookupSession: the token→session join. It applies the revoked
+      // and expiry checks itself in JS, so the SQL filters on token alone.
+      const s = sessions.find(match);
+      if (!s) return { rows: [], rowCount: 0 };
+      return { rows: [{ session_id: s.id, builder_id: s.builder_id, expires_at: s.expires_at,
+        revoked_at: s.revoked_at, source: s.source, ...BUILDERS[s.builder_id] }], rowCount: 1 };
+    }
+    if (/^SELECT/.test(sql)) {
+      const cols = selectedColumns(sql);
+      const rows = sessions.filter(match)
+        .sort((a, b) => b.last_used_at - a.last_used_at || b.id - a.id)
+        .map((r) => Object.fromEntries(cols.map((c) => [c, r[c]])));
+      return { rows, rowCount: rows.length };
+    }
+    if (/^UPDATE builder_sessions SET revoked_at/.test(sql)) {
+      const hit = sessions.filter(match);
+      for (const r of hit) r.revoked_at = new Date();
+      return { rows: [], rowCount: hit.length };
+    }
+    if (/^UPDATE builder_sessions SET last_used_at/.test(sql)) {
+      const hit = sessions.filter(match);
+      for (const r of hit) { r.last_used_at = new Date(); r.expires_at = new Date(Date.now() + DAY); }
+      return { rows: [], rowCount: hit.length };
+    }
+    throw new Error(`fake pool: unhandled statement — ${sql.slice(0, 90)}`);
+  },
+  on: () => {},
+};
+
+// Pin the fake pool BEFORE anything that reaches for a connection is loaded, so
+// db, db-kernel and auth all resolve to it and no real pg Pool is ever built.
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = {
+  id: poolPath, filename: poolPath, loaded: true,
+  exports: { pool, instanceDbName: () => 'test' },
+};
+
+const auth = require('../src/bongos/auth.js');
+const buildMySessionsRouter = require('../src/bongos/routes/my-sessions.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const express = require('express');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildMySessionsRouter());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const BASE = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+async function call(method, path, { token, body } = {}) {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: {
+      ...(token ? { authorization: `Bearer ${token}` } : {}),
+      ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+    },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json().catch(() => null) };
+}
+
+const aliveFor = (builderId) => sessions.filter((s) => s.builder_id === builderId && s.revoked_at === null).map((s) => s.id);
+
+// ===========================================================================
+// 1 — a xenos can see and kill their OWN sessions, with no Archon in sight
+// ===========================================================================
+
+console.log('own scope — a non-admin builder manages their own sessions:');
+
+await t('GET /me/sessions lists only the caller\'s LIVE sessions', async () => {
+  seed(); calls = [];
+  const r = await call('GET', '/me/sessions', { token: 'adacli' });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.body.sessions.map((s) => s.id), ['101', '102'],
+    'newest-used first; the revoked (103) and expired (104) rows must not appear, and Bo\'s 201 never can');
+});
+
+await t('the list carries enough to RECOGNISE a session, and marks the current one', async () => {
+  seed();
+  const r = await call('GET', '/me/sessions', { token: 'adacli' });
+  const cli = r.body.sessions.find((s) => s.id === '101');
+  assert.equal(cli.source, 'cli');
+  assert.equal(cli.user_agent, 'cloud-bongos-cli');
+  assert.ok(cli.created_at && cli.last_used_at && cli.expires_at, 'created / last used / expires must all be present');
+  assert.equal(cli.current, true, 'the session that made the request is the current one');
+  assert.equal(r.body.sessions.find((s) => s.id === '102').current, false);
+});
+
+await t('the token value is never selected and never returned', async () => {
+  seed();
+  const r = await call('GET', '/me/sessions', { token: 'adacli' });
+  const raw = JSON.stringify(r.body);
+  assert.ok(!/token/i.test(raw), 'no token field may appear in the list body');
+  for (const s of sessions) assert.ok(!raw.includes(s.token), `the raw token ${s.token} leaked into the response`);
+});
+
+await t('POST /me/sessions/revoke kills one of the caller\'s own sessions', async () => {
+  seed();
+  const r = await call('POST', '/me/sessions/revoke', { token: 'adacli', body: { session_id: 102 } });
+  assert.equal(r.status, 200);
+  assert.equal(r.body.revoked, 1);
+  // 104 is the already-expired row: unrevoked, so still here, but it never lists
+  // and its bearer can no longer authenticate. Revoking one session touches one.
+  assert.deepEqual(aliveFor(1), [101, 104], 'the web session is gone, the CLI one survives');
+});
+
+await t('POST /me/sessions/revoke-all signs the caller out everywhere, current session included', async () => {
+  seed();
+  const r = await call('POST', '/me/sessions/revoke-all', { token: 'adacli', body: {} });
+  assert.equal(r.status, 200);
+  assert.equal(r.body.revoked, 3, 'the two live rows plus the not-yet-expired-but-unrevoked one');
+  assert.deepEqual(aliveFor(1), [], 'nothing of Ada\'s is left alive');
+});
+
+await t('no rank or permission is involved — the caller is a xenos throughout', async () => {
+  seed();
+  assert.equal(BUILDERS[1].rank, 'xenos', 'the fixture must stay on the bottom rung or this proves nothing');
+  const list = await call('GET', '/me/sessions', { token: 'adacli' });
+  const kill = await call('POST', '/me/sessions/revoke-all', { token: 'adacli', body: {} });
+  assert.equal(list.status, 200);
+  assert.equal(kill.status, 200);
+});
+
+// ===========================================================================
+// 2 — the same builder cannot reach anybody else's
+// ===========================================================================
+
+console.log('\ncross-builder isolation — a stranger\'s sessions stay out of reach:');
+
+await t('a builder_id in the QUERY STRING changes nothing about whose list comes back', async () => {
+  seed();
+  const r = await call('GET', '/me/sessions?builder_id=2&builder=2', { token: 'adacli' });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.body.sessions.map((s) => s.id), ['101', '102'], 'still Ada\'s own list');
+  const listQuery = calls.filter((c) => /FROM builder_sessions WHERE builder_id/.test(c.sql)).pop();
+  assert.deepEqual(listQuery.params, [1], 'the account queried is the SESSION\'s builder, never the one named in the URL');
+});
+
+await t('guessing a stranger\'s session id revokes nothing and leaks nothing', async () => {
+  seed();
+  const r = await call('POST', '/me/sessions/revoke', { token: 'adacli', body: { session_id: 201 } });
+  assert.equal(r.status, 200, 'a miss is not a 404 — that would confirm which ids exist');
+  assert.equal(r.body.revoked, 0);
+  assert.deepEqual(aliveFor(2), [201], 'Bo\'s session is untouched');
+  assert.ok(!JSON.stringify(r.body).includes('bo'), 'nothing about the other account may come back');
+});
+
+await t('an unknown id and a stranger\'s id are indistinguishable', async () => {
+  seed();
+  const stranger = await call('POST', '/me/sessions/revoke', { token: 'adacli', body: { session_id: 201 } });
+  const nobody = await call('POST', '/me/sessions/revoke', { token: 'adacli', body: { session_id: 999999 } });
+  assert.deepEqual(stranger.body, nobody.body, 'the two answers must be byte-identical');
+});
+
+await t('naming a builder in the BODY is rejected outright, and kills nothing', async () => {
+  seed();
+  const all = await call('POST', '/me/sessions/revoke-all', { token: 'adacli', body: { builder_id: 2 } });
+  assert.equal(all.status, 400, 'an unknown field must fail validation rather than be quietly ignored');
+  const one = await call('POST', '/me/sessions/revoke', { token: 'adacli', body: { session_id: 201, builder_id: 2 } });
+  assert.equal(one.status, 400);
+  assert.deepEqual(aliveFor(2), [201], 'Bo keeps his session either way');
+});
+
+await t('Ada signing out everywhere leaves Bo signed in', async () => {
+  seed();
+  await call('POST', '/me/sessions/revoke-all', { token: 'adacli', body: {} });
+  assert.deepEqual(aliveFor(1), []);
+  assert.deepEqual(aliveFor(2), [201]);
+  const bo = await call('GET', '/me/sessions', { token: 'bocli' });
+  assert.equal(bo.status, 200);
+  assert.deepEqual(bo.body.sessions.map((s) => s.id), ['201']);
+});
+
+await t('every statement the routes issue is scoped to the caller\'s own account', async () => {
+  seed(); calls = [];
+  await call('GET', '/me/sessions', { token: 'adacli' });
+  await call('POST', '/me/sessions/revoke', { token: 'adacli', body: { session_id: 102 } });
+  await call('POST', '/me/sessions/revoke-all', { token: 'adacli', body: {} });
+  const owned = calls.filter((c) => !/AS session_id/.test(c.sql) && !/SET last_used_at/.test(c.sql));
+  assert.equal(owned.length, 3, 'one list, one single revoke, one sweep');
+  for (const c of owned) {
+    assert.ok(/builder_id = \$\d/.test(c.sql), `statement without an owner predicate: ${c.sql}`);
+    assert.ok(c.params.includes(1), `statement not bound to the caller: ${c.sql} ${JSON.stringify(c.params)}`);
+    assert.ok(!c.params.includes(2), 'no statement may ever carry another account\'s id');
+  }
+});
+
+// ===========================================================================
+// 3 — a revoked bearer stops authenticating (the whole point of the feature)
+// ===========================================================================
+
+console.log('\nthe remedy actually works — a revoked bearer is dead on the next request:');
+
+await t('an unauthenticated caller gets 401 from all three routes', async () => {
+  seed();
+  for (const [m, p] of [['GET', '/me/sessions'], ['POST', '/me/sessions/revoke'], ['POST', '/me/sessions/revoke-all']]) {
+    const r = await call(m, p, { body: m === 'GET' ? undefined : {} });
+    assert.equal(r.status, 401, `${m} ${p} must refuse an anonymous caller`);
+  }
+});
+
+await t('the leaked CLI bearer stops working the moment its owner revokes it', async () => {
+  seed();
+  const before = await call('GET', '/me/sessions', { token: 'adacli' });
+  assert.equal(before.status, 200, 'the bearer works to begin with');
+  // Ada kills the leaked token from her browser session, not from the CLI.
+  const kill = await call('POST', '/me/sessions/revoke', { token: 'adaweb', body: { session_id: 101 } });
+  assert.equal(kill.body.revoked, 1);
+  const after = await call('GET', '/me/sessions', { token: 'adacli' });
+  assert.equal(after.status, 401, 'the revoked bearer must no longer authenticate');
+  assert.equal(after.body.error && after.body.error.code, 'unauthenticated');
+});
+
+await t('sign-out-everywhere kills the session that asked for it, too', async () => {
+  seed();
+  const kill = await call('POST', '/me/sessions/revoke-all', { token: 'adacli', body: {} });
+  assert.equal(kill.status, 200, 'the request that was already authenticated still gets its answer');
+  const after = await call('GET', '/me/sessions', { token: 'adacli' });
+  assert.equal(after.status, 401);
+  const web = await call('GET', '/me/sessions', { token: 'adaweb' });
+  assert.equal(web.status, 401, 'the browser cookie is gone as well — that is what "everywhere" means');
+});
+
+await t('refresh-on-use cannot resurrect a revoked session', async () => {
+  seed();
+  await call('POST', '/me/sessions/revoke', { token: 'adaweb', body: { session_id: 101 } });
+  await call('GET', '/me/sessions', { token: 'adacli' });          // the leaked token keeps trying
+  const row = sessions.find((s) => s.id === 101);
+  assert.ok(row.revoked_at instanceof Date, 'still revoked');
+  const r = await call('GET', '/me/sessions', { token: 'adacli' });
+  assert.equal(r.status, 401, 'no amount of use walks the expiry forward once revoked_at is set');
+});
+
+// ===========================================================================
+// 4 — the source itself never takes an owner from the request
+// ===========================================================================
+
+console.log('\nroute source structure — the owner can only come from the session:');
+
+const ROUTE_SRC = readFileSync(join(ROOT, 'src/bongos/routes/my-sessions.js'), 'utf8');
+
+await t('no owner is ever read from the query string, the body, or the path', () => {
+  // Asserted over the RAW source, comments included: this file is own-scoped
+  // end to end, so unlike the mixed route files there is no legitimate reason
+  // for any of these spellings to appear in it at all.
+  for (const bad of [/req\.query\.builder/i, /req\.body\.builder/i, /req\.body\.owner/i, /req\.params\.builderId/i]) {
+    assert.ok(!bad.test(ROUTE_SRC), `my-sessions.js must not contain ${bad}`);
+  }
+});
+
+await t('every db call in the file passes req.builder.id', () => {
+  const dbCalls = ROUTE_SRC.split('\n')
+    .map((line) => /db\.[A-Za-z]+\((.*)\)/.exec(line))
+    .filter(Boolean)
+    .map((m) => m[1]);
+  assert.equal(dbCalls.length, 3, 'three db calls: list, revoke one, revoke all');
+  for (const args of dbCalls) {
+    assert.ok(/req\.builder\.id/.test(args), `db call not bound to the session builder: (${args})`);
+  }
+});
+
+await t('the admin cross-builder pair is untouched and still permission-gated', () => {
+  const authSrc = readFileSync(join(ROOT, 'src/bongos/routes/auth.js'), 'utf8');
+  for (const route of ["'/auth/revoke'", "'/auth/revoke-all'"]) {
+    const i = authSrc.indexOf(route);
+    assert.ok(i > 0, `${route} must still be declared`);
+    assert.ok(/requirePermission\('auth\.session\.revoke'\)/.test(authSrc.slice(i, i + 220)),
+      `${route} must keep its admin gate — the own-scoped routes are an addition, not a replacement`);
+  }
+});
+
+await t('the three own-scoped routes are pinned to any-builder in the rank auditor', () => {
+  const { checkRouteRanks } = require('../src/bongos/route-rank-check.js');
+  const r = checkRouteRanks();
+  assert.equal(r.hardFail, false, 'no route may be left unclassified or downgraded');
+  const pinSrc = readFileSync(join(ROOT, 'src/bongos/route-rank-check.js'), 'utf8');
+  for (const route of ['GET /me/sessions', 'POST /me/sessions/revoke', 'POST /me/sessions/revoke-all']) {
+    assert.ok(pinSrc.includes(`'${route}': 'any-builder'`), `${route} must be pinned so a later gate change fails loud`);
+  }
+});
+
+// ===========================================================================
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);