@byline/admin 4.19.0 → 5.1.0

package/src/forms/tree-placement-widget.tsx

@@ -20,6 +20,10 @@ import { RelationPicker } from '../fields/relation/relation-picker.js'
 import styles from './tree-placement-widget.module.css'
 
 export interface TreePlacementWidgetProps {
+  disabled?: boolean
+  onMutationError?: (error: unknown) => 'blocked' | 'committed' | null | void
+  onCommitted?: (receipt: import('@byline/core').StructuralMutationReceipt) => void
+  expectedRevision: number
   /** The collection path (`tree: true`). */
   collectionPath: string
   /** The logical id of the document being edited. */
@@ -44,6 +48,10 @@ export interface TreePlacementWidgetProps {
  */
 export const TreePlacementWidget = ({
   collectionPath,
+  disabled = false,
+  onMutationError,
+  onCommitted,
+  expectedRevision,
   documentId,
   useAsTitle,
 }: TreePlacementWidgetProps) => {
@@ -99,7 +107,7 @@ export const TreePlacementWidget = ({
   // placement (including making the node a root) leaves it placed.
   const place = useCallback(
     async (parentDocumentId: string | null, optimistic: { id: string; title: string } | null) => {
-      if (placeTreeNode == null || busy) return
+      if (disabled || placeTreeNode == null || busy) return
       const previousParent = parent
       const previousPlaced = placed
       setError(null)
@@ -107,8 +115,15 @@ export const TreePlacementWidget = ({
       setParent(optimistic)
       setPlaced(true)
       try {
-        await placeTreeNode({ collection: collectionPath, documentId, parentDocumentId })
-      } catch {
+        const result = await placeTreeNode({
+          expectedRevision,
+          collection: collectionPath,
+          documentId,
+          parentDocumentId,
+        })
+        onCommitted?.(result)
+      } catch (error) {
+        if (onMutationError?.(error) === 'committed') return
         setParent(previousParent)
         setPlaced(previousPlaced)
         setError(t('treeWidget.error'))
@@ -116,7 +131,19 @@ export const TreePlacementWidget = ({
         setBusy(false)
       }
     },
-    [placeTreeNode, busy, parent, placed, collectionPath, documentId, t]
+    [
+      disabled,
+      onMutationError,
+      onCommitted,
+      expectedRevision,
+      placeTreeNode,
+      busy,
+      parent,
+      placed,
+      collectionPath,
+      documentId,
+      t,
+    ]
   )
 
   const handlePick = useCallback(
@@ -156,7 +183,7 @@ export const TreePlacementWidget = ({
           size="xs"
           variant="outlined"
           intent="noeffect"
-          disabled={loading || busy}
+          disabled={disabled || loading || busy}
           onClick={() => setPickerOpen(true)}
         >
           {t('treeWidget.choose')}
@@ -165,7 +192,7 @@ export const TreePlacementWidget = ({
           <button
             type="button"
             className={cx('byline-form-tree-link', styles.link)}
-            disabled={loading || busy}
+            disabled={disabled || loading || busy}
             onClick={() => place(null, null)}
           >
             {t('treeWidget.addToTree')}
@@ -175,7 +202,7 @@ export const TreePlacementWidget = ({
             <button
               type="button"
               className={cx('byline-form-tree-link', styles.link)}
-              disabled={busy}
+              disabled={disabled || busy}
               onClick={() => place(null, null)}
             >
               {t('treeWidget.makeRoot')}

package/src/modules/admin-account/components/change-password.test.tsx

@@ -0,0 +1,72 @@
+import { act } from 'react'
+
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  change: vi.fn(),
+  submit: null as
+    | null
+    | ((args: {
+        value: { currentPassword: string; newPassword: string; confirm: string }
+      }) => Promise<void>),
+}))
+vi.mock('@tanstack/react-form-start', () => ({
+  revalidateLogic: () => ({}),
+  useForm: (options: { onSubmit: typeof mocks.submit }) => {
+    mocks.submit = options.onSubmit
+    return { reset: vi.fn(), Field: () => null, Subscribe: () => null }
+  },
+}))
+vi.mock('../../../services/admin-services-context.js', () => ({
+  useBylineAdminServices: () => ({ changeAccountPassword: mocks.change }),
+}))
+vi.mock('@byline/i18n/react', () => ({
+  useTranslation: () => ({
+    t: (key: string) =>
+      ({
+        'account.changePassword.feedback.updated': 'Password updated.',
+        'auth.signIn.title': 'Sign in',
+      })[key] ?? key,
+  }),
+}))
+vi.mock('@byline/ui/react', () => ({
+  Alert: ({ children, role }: { children: React.ReactNode; role?: string }) => (
+    <div role={role}>{children}</div>
+  ),
+  Button: ({ children, onClick }: { children: React.ReactNode; onClick?: () => void }) => (
+    <button type="button" onClick={onClick}>
+      {children}
+    </button>
+  ),
+  InputPassword: () => null,
+  LoaderEllipsis: () => null,
+}))
+
+import { ChangeAccountPassword } from './change-password.js'
+import type { AccountResponse } from '../index.js'
+
+let root: Root
+let container: HTMLDivElement
+beforeEach(() => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+  vi.clearAllMocks()
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+afterEach(async () => {
+  await act(async () => root.unmount())
+  container.remove()
+})
+it('keeps success confirmation and a sign-in action visible after completion', async () => {
+  const account = { id: 'account', vid: 1 } as AccountResponse
+  mocks.change.mockResolvedValue({ ...account, vid: 2 })
+  await act(async () => root.render(<ChangeAccountPassword account={account} />))
+  await act(async () => {
+    await mocks.submit?.({ value: { currentPassword: 'old', newPassword: 'new', confirm: 'new' } })
+  })
+  expect(container.querySelector('[role="status"]')?.textContent).toBe('Password updated.')
+  expect(container.querySelector('button')?.textContent).toBe('Sign in')
+  expect(container.querySelector('form')).toBeNull()
+})

package/src/modules/admin-account/components/change-password.tsx

@@ -19,10 +19,8 @@
  *     password surfaces as `admin.account.invalidCurrentPassword`.
  *   - Confirmation field catches typos before round-trip.
  *
- * Caveat: changing the password here does not revoke other active
- * sessions today. Existing access tokens stay valid until expiry
- * (~15 min); a "sign out everywhere on password change" follow-up
- * will close that gap.
+ * Successful password changes end native sessions. Confirmation remains visible
+ * until the user reloads the protected account page to reach sign-in.
  */
 
 import { useMemo, useState } from 'react'
@@ -127,6 +125,19 @@ export function ChangeAccountPassword({ account, onClose, onSuccess }: ChangePas
     },
   })
 
+  if (successMessage) {
+    return (
+      <div className={cx('byline-account-change-password-wrap', styles.wrap)}>
+        <div role="status">
+          <Alert intent="success">{successMessage}</Alert>
+        </div>
+        <Button type="button" intent="primary" onClick={() => window.location.reload()}>
+          {t('auth.signIn.title')}
+        </Button>
+      </div>
+    )
+  }
+
   return (
     <div className={cx('byline-account-change-password-wrap', styles.wrap)}>
       <form

package/src/modules/admin-account/service.ts

@@ -7,7 +7,10 @@
  */
 
 import { toAdminUser } from '../admin-users/dto.js'
-import { ERR_ADMIN_USER_EMAIL_IN_USE } from '../admin-users/errors.js'
+import {
+  ERR_ADMIN_USER_EMAIL_IN_USE,
+  ERR_ADMIN_USER_VERSION_CONFLICT,
+} from '../admin-users/errors.js'
 import { hashPassword, verifyPassword } from '../auth/password.js'
 import {
   ERR_ADMIN_ACCOUNT_INVALID_CURRENT_PASSWORD,
@@ -38,12 +41,8 @@ import type {
  *     in the new hash. A hijacked session cannot use this flow to lock
  *     out the legitimate owner.
  *
- * Note on session revocation: changing a password here does **not**
- * currently revoke other refresh tokens — existing access tokens stay
- * valid until their 15-minute expiry, and other refresh tokens remain
- * useable. A "sign out everywhere on password change" follow-up should
- * call `RefreshTokensRepository.revokeAllExcept(adminUserId, currentJti)`
- * once that lands.
+ * Native adapter password writes atomically advance the session generation and
+ * revoke every refresh session. External providers own their own revocation.
  */
 export class AdminAccountService {
   readonly #repo: AdminUsersRepository
@@ -97,6 +96,8 @@ export class AdminAccountService {
     const ok = await verifyPassword(request.currentPassword, withHash.password_hash)
     if (!ok) throw ERR_ADMIN_ACCOUNT_INVALID_CURRENT_PASSWORD()
 
+    if (withHash.vid !== request.vid) throw ERR_ADMIN_USER_VERSION_CONFLICT()
+
     const newHash = await hashPassword(request.newPassword)
     const row = await this.#repo.setPasswordHash(actorId, request.vid, newHash)
     return toAdminUser(row)

package/src/modules/admin-users/repository.ts

@@ -68,6 +68,8 @@ export interface AdminUserRow {
  */
 export interface AdminUserWithPasswordRow extends AdminUserRow {
   password_hash: string
+  /** Native session generation, independent of edit revisions. */
+  session_version: number
 }
 
 export interface CreateAdminUserInput {
@@ -158,16 +160,23 @@ export interface AdminUsersRepository {
    * Content update with optimistic concurrency. Throws
    * `AdminUsersError(VERSION_CONFLICT)` if the stored `vid` differs from
    * `expectedVid`. Bumps `vid` on success and returns the fresh row.
+   * A false `is_enabled` patch must atomically advance the native session
+   * generation and revoke refresh sessions, under the account row lock.
    */
   update(id: string, expectedVid: number, patch: UpdateAdminUserInput): Promise<AdminUserRow>
   /**
    * Replace the stored password hash with optimistic concurrency.
    * Version-gated on `expectedVid`. Caller supplies a pre-hashed PHC string.
+   * Atomically advance the native session generation and revoke every refresh
+   * session in the same transaction. Lock the account before refresh rows.
    * Returns the updated row so callers holding the edit form can refresh
    * their cached `vid` without a second round-trip.
    */
   setPasswordHash(id: string, expectedVid: number, passwordHash: string): Promise<AdminUserRow>
-  /** Toggle enabled state. Vid-less — admin intent is independent of other edits. */
+  /**
+   * Toggle enabled state. Disable must atomically advance the native session
+   * generation and revoke refresh sessions. Enable never resets the generation.
+   */
   setEnabled(id: string, enabled: boolean): Promise<void>
   /**
    * Set the admin interface locale preference. Vid-less — user preference

package/src/modules/auth/index.ts

@@ -21,9 +21,21 @@
  * against `@byline/auth` rather than added here.
  */
 
-export { JwtSessionProvider, type JwtSessionProviderConfig } from './jwt-session-provider.js'
+export {
+  JwtSessionProvider,
+  type JwtSessionProviderConfig,
+  type NativeSessionEvent,
+} from './jwt-session-provider.js'
 export { hashPassword, verifyPassword } from './password.js'
 export { resolveActor } from './resolve-actor.js'
+export {
+  createPasswordSignInLimiter,
+  type SignInLimiterOptions,
+  type SignInRateLimitPolicy,
+  type SignInRateLimitStore,
+  type SignInSecurityEvent,
+} from './sign-in-rate-limiter.js'
+export type { LoginSessionRow, LoginSessionsRepository } from './login-sessions-repository.js'
 export type {
   IssueRefreshTokenInput,
   RefreshTokenRow,