@byline/host-tanstack-start 4.19.0 → 5.1.0

package/src/integrations/sign-in-body.test.node.ts

@@ -0,0 +1,59 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { checkSignInBody, SIGN_IN_MAX_BODY_BYTES, wasSignInBodyChecked } from './sign-in-body.js'
+
+function request(body: BodyInit, headers: Record<string, string> = {}) {
+  return new Request('https://app.test/_serverFn/login', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', ...headers },
+    body,
+    duplex: 'half',
+  } as RequestInit)
+}
+describe('sign-in body boundary', () => {
+  it('preserves the original body for RPC parsing', async () => {
+    const req = request('{"data":{}}')
+    expect(await checkSignInBody(req)).toBeUndefined()
+    expect(wasSignInBodyChecked(req)).toBe(true)
+    expect(await req.json()).toEqual({ data: {} })
+    expect(wasSignInBodyChecked(request('{}'))).toBe(false)
+  })
+  it('rejects oversized declared or actual bodies', async () => {
+    expect(
+      (
+        await checkSignInBody(
+          request('{}', { 'content-length': String(SIGN_IN_MAX_BODY_BYTES + 1) })
+        )
+      )?.status
+    ).toBe(413)
+    const req = request('x'.repeat(SIGN_IN_MAX_BODY_BYTES + 1), { 'content-length': '1' })
+    expect((await checkSignInBody(req))?.status).toBe(413)
+    expect(wasSignInBodyChecked(req)).toBe(false)
+  })
+  it('counts chunked bodies without relying on Content-Length', async () => {
+    const req = request(
+      new ReadableStream({
+        start(controller) {
+          controller.enqueue(new Uint8Array(SIGN_IN_MAX_BODY_BYTES))
+          controller.enqueue(new Uint8Array(1))
+          controller.close()
+        },
+      })
+    )
+    expect((await checkSignInBody(req))?.status).toBe(413)
+  })
+  it('rejects multipart and wrong methods', async () => {
+    expect(
+      (await checkSignInBody(request('{}', { 'content-type': 'multipart/form-data' })))?.status
+    ).toBe(415)
+    expect((await checkSignInBody(new Request('https://app.test')))?.status).toBe(405)
+  })
+})

package/src/integrations/sign-in-body.ts

@@ -0,0 +1,50 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/** Limit the serialized RPC envelope, not just its eventual credential fields. */
+export const SIGN_IN_MAX_BODY_BYTES = 16 * 1024
+const checked = new WeakSet<Request>()
+
+export function wasSignInBodyChecked(request: Request): boolean {
+  return checked.has(request)
+}
+
+/** Read a bounded clone before Start parses the original. Never await tee cancellation. */
+export async function checkSignInBody(request: Request): Promise<Response | undefined> {
+  if (request.method !== 'POST')
+    return new Response('Method not allowed', { status: 405, headers: { Allow: 'POST' } })
+  if (!request.headers.get('content-type')?.toLowerCase().startsWith('application/json')) {
+    return new Response('Expected JSON', { status: 415 })
+  }
+  const declared = request.headers.get('content-length')
+  if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > SIGN_IN_MAX_BODY_BYTES)) {
+    return new Response('Payload too large', { status: 413 })
+  }
+  const reader = request.clone().body?.getReader()
+  if (!reader) return new Response('Missing body', { status: 400 })
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const deadline = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => reject(new Error('Body timeout')), 5000)
+  })
+  try {
+    let size = 0
+    while (true) {
+      const { value, done } = await Promise.race([reader.read(), deadline])
+      if (done) break
+      size += value.byteLength
+      if (size > SIGN_IN_MAX_BODY_BYTES) return new Response('Payload too large', { status: 413 })
+    }
+    checked.add(request)
+    return undefined
+  } catch {
+    return new Response('Incomplete request body', { status: 408 })
+  } finally {
+    clearTimeout(timer)
+    void reader.cancel().catch(() => {})
+  }
+}

package/src/integrations/sign-in-middleware.ts

@@ -0,0 +1,24 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createMiddleware } from '@tanstack/react-start'
+
+import { adminSignIn } from '../server-fns/auth/sign-in.js'
+import { checkSignInBody } from './sign-in-body.js'
+
+/** Register after CSRF in Start's global requestMiddleware, before RPC deserialization. */
+export const passwordSignInMiddleware = createMiddleware().server(async (ctx) => {
+  const endpoint = new URL(adminSignIn.url, ctx.request.url).pathname.replace(/\/$/, '')
+  if (
+    ctx.handlerType !== 'serverFn' ||
+    (ctx.pathname !== endpoint && !ctx.pathname.startsWith(`${endpoint}/`))
+  )
+    return ctx.next()
+  const rejected = await checkSignInBody(ctx.request)
+  return rejected ?? ctx.next()
+})

package/src/routes/create-admin-layout-route.tsx

@@ -10,8 +10,8 @@
  * Admin shell layout — authenticated-only.
  *
  * `beforeLoad` resolves the current admin user (which internally verifies
- * the session cookies, refreshes transparently when needed, and throws
- * `ERR_UNAUTHENTICATED` when there is no session). On unauthenticated
+ * the access credential without rotating cookies). Expired access is
+ * renewed by the sign-in bootstrap. On unauthenticated
  * requests we redirect to `/sign-in` with a `callbackUrl` so the user
  * lands back on the page they originally requested.
  *
@@ -37,10 +37,12 @@ import { AdminMenuProvider } from '../admin-shell/chrome/admin-menu-provider.jsx
 import { Content } from '../admin-shell/chrome/content.js'
 import { RouteError, RouteNotFound } from '../admin-shell/chrome/route-error.js'
 import { RouteProgressBar } from '../admin-shell/chrome/route-progress-bar.js'
+import { SessionChangeBoundary } from '../admin-shell/chrome/session-change-boundary.js'
 import { buildLocaleDefinitions } from '../i18n/locale-definitions.js'
 import { bylineAdminServices } from '../integrations/byline-admin-services.js'
 import { BylineAiAdminProvider } from '../integrations/byline-ai.js'
 import { bylineFieldServices } from '../integrations/byline-field-services.js'
+import { observeSession, sessionIsChanged } from '../integrations/session-coordination.js'
 import { getAnalyticsRuntime } from '../server-fns/analytics/index.js'
 import { getCurrentAdminUser } from '../server-fns/auth/index.js'
 import { getScheduledPublicationRuntime } from '../server-fns/collections/index.js'
@@ -53,6 +55,7 @@ export function createAdminLayoutRoute(path: string) {
       const signInPath = getSignInRoutePath()
       try {
         const user = await getCurrentAdminUser()
+        if (typeof window !== 'undefined') observeSession(user.sessionId)
         // Resolve the active interface locale once on the server so SSR
         // and the hydrated client render the same translations and
         // there's no locale flicker. Going through the server fn (rather
@@ -65,7 +68,20 @@ export function createAdminLayoutRoute(path: string) {
           getAnalyticsRuntime(),
         ])
         return { user, activeLocale, scheduledPublicationRuntime, analyticsRuntime }
-      } catch {
+      } catch (error) {
+        const code = (error as { code?: string })?.code
+        if (
+          !(typeof window !== 'undefined' && sessionIsChanged()) &&
+          ![
+            'ERR_UNAUTHENTICATED',
+            'ERR_ACCESS_EXPIRED',
+            'ERR_INVALID_TOKEN',
+            'ERR_REVOKED_TOKEN',
+            'ERR_ACCOUNT_DISABLED',
+            'ERR_SESSION_CHANGED',
+          ].includes(code ?? '')
+        )
+          throw error
         // `getCurrentAdminUser` (via `getAdminRequestContext`) throws
         // `ERR_UNAUTHENTICATED` or a related auth error when no valid
         // session is present. Redirect to sign-in with the original path
@@ -104,33 +120,35 @@ export function createAdminLayoutRoute(path: string) {
         window.location.reload()
       }
       return (
-        <I18nProvider
-          bundle={i18n.translations ?? {}}
-          activeLocale={activeLocale}
-          defaultLocale={i18n.admin.defaultLocale}
-          localeDefinitions={localeDefinitions}
-          setLocale={handleSetLocale}
-        >
-          <BylineAdminServicesProvider services={bylineAdminServices}>
-            <BylineFieldServicesProvider services={bylineFieldServices}>
-              <BylineAiAdminProvider>
-                <AdminMenuProvider>
-                  <RouteProgressBar />
-                  <AdminAppBar user={user} />
-                  <main className={cx('byline-admin-layout-main', layoutStyles.main)}>
-                    <AdminMenuDrawer
-                      analyticsEnabled={analyticsRuntime.enabled}
-                      scheduledPublicationEnabled={scheduledPublicationRuntime.enabled}
-                    />
-                    <Content>
-                      <Outlet />
-                    </Content>
-                  </main>
-                </AdminMenuProvider>
-              </BylineAiAdminProvider>
-            </BylineFieldServicesProvider>
-          </BylineAdminServicesProvider>
-        </I18nProvider>
+        <SessionChangeBoundary user={user}>
+          <I18nProvider
+            bundle={i18n.translations ?? {}}
+            activeLocale={activeLocale}
+            defaultLocale={i18n.admin.defaultLocale}
+            localeDefinitions={localeDefinitions}
+            setLocale={handleSetLocale}
+          >
+            <BylineAdminServicesProvider services={bylineAdminServices}>
+              <BylineFieldServicesProvider services={bylineFieldServices}>
+                <BylineAiAdminProvider>
+                  <AdminMenuProvider>
+                    <RouteProgressBar />
+                    <AdminAppBar user={user} />
+                    <main className={cx('byline-admin-layout-main', layoutStyles.main)}>
+                      <AdminMenuDrawer
+                        analyticsEnabled={analyticsRuntime.enabled}
+                        scheduledPublicationEnabled={scheduledPublicationRuntime.enabled}
+                      />
+                      <Content>
+                        <Outlet />
+                      </Content>
+                    </main>
+                  </AdminMenuProvider>
+                </BylineAiAdminProvider>
+              </BylineFieldServicesProvider>
+            </BylineAdminServicesProvider>
+          </I18nProvider>
+        </SessionChangeBoundary>
       )
     },
     errorComponent: RouteError,

package/src/routes/create-collection-edit-route.tsx

@@ -152,6 +152,7 @@ export function createCollectionEditRoute(path: string) {
             ]}
           />
           <EditView
+            key={`${collection}/${id}/${locale}`}
             collectionDefinition={collectionDef}
             adminConfig={adminConfig ?? undefined}
             initialData={data}

package/src/routes/create-collection-list-route.tsx

@@ -1,3 +1,4 @@
+import { parseDocumentRevision } from '@byline/core'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -177,8 +178,13 @@ export function createCollectionListRoute(path: string) {
                 beforeDocumentId,
                 afterDocumentId,
               }) => {
-                await placeTreeNode({
+                return await placeTreeNode({
                   data: {
+                    expectedRevision: parseDocumentRevision(
+                      (data as { rows: CollectionTreeRow[] }).rows.find(
+                        (row) => row.id === documentId
+                      )?.revision
+                    ),
                     collection,
                     documentId,
                     parentDocumentId,
@@ -199,8 +205,13 @@ export function createCollectionListRoute(path: string) {
               orderable={collectionDef.orderable === true}
               listActions={adminConfig?.listActions}
               onReorder={async ({ documentId, beforeDocumentId, afterDocumentId }) => {
-                await reorderCollectionDocument({
+                return await reorderCollectionDocument({
                   data: {
+                    expectedRevision: parseDocumentRevision(
+                      data.docs.find(
+                        (row: { id: string; revision?: number }) => row.id === documentId
+                      )?.revision
+                    ),
                     collection,
                     documentId,
                     beforeDocumentId,

package/src/routes/create-sign-in-route.tsx

@@ -25,6 +25,7 @@ import { resolveAdminCallbackPath, resolveAdminSignInRedirect } from './admin-pa
 import { resolveSignInHomeUrl } from './sign-in-home-url.js'
 
 interface SignInSearch {
+  reauthenticate?: boolean
   callbackUrl?: string
 }
 
@@ -42,7 +43,13 @@ export function createSignInRoute(path: string, { homeUrl }: CreateSignInRouteOp
   const Route: any = createFileRoute(path as never)({
     validateSearch: (search: Record<string, unknown>): SignInSearch => {
       const callbackUrl = resolveAdminCallbackPath(search.callbackUrl)
-      return { callbackUrl }
+      return {
+        callbackUrl,
+        reauthenticate:
+          search.reauthenticate === '1' ||
+          search.reauthenticate === 1 ||
+          search.reauthenticate === true,
+      }
     },
     beforeLoad: async () => {
       // Resolve the active locale on the server before render so the
@@ -54,11 +61,12 @@ export function createSignInRoute(path: string, { homeUrl }: CreateSignInRouteOp
       return { activeLocale }
     },
     component: function SignInRouteComponent() {
-      const { callbackUrl } = Route.useSearch() as SignInSearch
+      const { callbackUrl, reauthenticate } = Route.useSearch() as SignInSearch
       const { activeLocale } = Route.useRouteContext() as { activeLocale: LocaleCode }
       return (
         <SignInPage
           redirectTo={resolveAdminSignInRedirect(callbackUrl)}
+          reauthenticate={reauthenticate}
           activeLocale={activeLocale}
           homeUrl={resolvedHomeUrl}
         />

package/src/routes/create-singleton-route.test.node.ts

@@ -1,3 +1,4 @@
+import { testAdapter } from '../../../core/src/storage/db-adapter.test-helper.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -61,7 +62,7 @@ vi.mock('@byline/core', () => ({
   getServerConfig: () => ({
     i18n: { content: { defaultLocale: 'en' } },
     scheduledPublication: { enabled: mocks.scheduledPublicationEnabled },
-    db: { queries: { documents: { getPublishedVersion: mocks.getPublishedVersion } } },
+    db: testAdapter({ queries: { documents: { getPublishedVersion: mocks.getPublishedVersion } } }),
   }),
   getSingletonAdminConfig: () => null,
 }))
@@ -112,6 +113,7 @@ describe('singleton editor route loader', () => {
 
     await expect(load('fr')).resolves.toEqual({
       document: null,
+      expectedEmpty: true,
       initialData: { title: 'Default title' },
     })
     expect(mocks.read).toHaveBeenCalledWith({
@@ -130,6 +132,12 @@ describe('singleton editor route loader', () => {
       versionId: 'version-current',
       status: 'draft',
       fields: { title: 'Loaded' },
+      revision: 7,
+      scheduledPublication: {
+        state: 'armed',
+        publishAt: '2026-09-01T00:00:00.000Z',
+        targetVersionId: 'version-current',
+      },
     })
     mocks.getPublishedVersion.mockResolvedValue({
       document_id: 'document-settings',
@@ -167,6 +175,6 @@ describe('singleton editor route loader', () => {
       collection_id: 'collection-settings',
       document_id: 'document-settings',
     })
-    expect(mocks.getScheduledPublish).toHaveBeenCalledTimes(1)
+    expect(mocks.getScheduledPublish).not.toHaveBeenCalled()
   })
 })

package/src/routes/create-singleton-route.tsx

@@ -10,7 +10,7 @@ import { createFileRoute, notFound } from '@tanstack/react-router'
 import { createServerFn } from '@tanstack/react-start'
 
 import type { DocumentPublishScheduleInfo } from '@byline/client'
-import { getAdminBylineClient, getAdminRequestContext } from '@byline/client/server'
+import { getAdminRequestContext } from '@byline/client/server'
 import {
   buildInitialDataFromFields,
   documentAbilityKey,
@@ -51,6 +51,7 @@ export const getSingletonRouteDocument = createServerFn({ method: 'GET' })
     if (document == null) {
       return {
         document: null,
+        expectedEmpty: true,
         initialData: serialise(
           await buildInitialDataFromFields(definition.fields, {
             locale: data.locale ?? getServerConfig().i18n.content.defaultLocale,
@@ -93,9 +94,9 @@ export const getSingletonRouteDocument = createServerFn({ method: 'GET' })
         actor?.hasAbility(documentAbilityKey(definition, 'changeStatus')) === true &&
         actor.hasAbility(documentAbilityKey(definition, 'publish'))
       if (canSchedulePublication) {
-        scheduledPublish = await getAdminBylineClient()
-          .singleton(data.singleton)
-          .getScheduledPublish()
+        scheduledPublish = (
+          document as unknown as { scheduledPublication: DocumentPublishScheduleInfo | null }
+        ).scheduledPublication
       }
     }
     const serializedSchedule = scheduledPublish == null ? null : serialise(scheduledPublish)
@@ -159,6 +160,7 @@ export function createSingletonRoute(path: string) {
             ]}
           />
           <SingletonView
+            key={`${singleton}/${locale}`}
             singletonDefinition={definition}
             adminConfig={getSingletonAdminConfig(singleton) ?? undefined}
             document={routeState.document}

package/src/server-fns/admin-account/change-password.test.node.ts

@@ -0,0 +1,69 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+// Handler-level tests isolate transport; session-middleware tests exercise the real pre-handler boundary.
+vi.mock('../../integrations/session-middleware.js', () => ({ adminSessionMiddleware: {} }))
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  context: vi.fn(),
+  command: vi.fn(),
+  clear: vi.fn(),
+  preview: vi.fn(),
+}))
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      middleware: () => chain,
+      validator: () => ({ handler: (handler: unknown) => handler }),
+    }
+    return chain
+  },
+}))
+vi.mock('@byline/admin/admin-account', () => ({ changeAccountPasswordCommand: mocks.command }))
+vi.mock('@byline/client/server', () => ({
+  getAdminRequestContext: mocks.context,
+  clearSessionCookies: mocks.clear,
+  clearPreviewCookie: mocks.preview,
+}))
+vi.mock('../../integrations/byline-core.js', () => ({ bylineCore: () => ({ adminStore: {} }) }))
+
+import { changeAccountPassword } from './change-password.js'
+
+const call = changeAccountPassword as unknown as (args: { data: unknown }) => Promise<unknown>
+beforeEach(() => {
+  vi.resetAllMocks()
+  mocks.context.mockResolvedValue({ actor: { id: 'current' } })
+})
+describe('password change cookie policy', () => {
+  it('clears the changing session and preview only after the mutation succeeds', async () => {
+    mocks.command.mockImplementation(async () => {
+      expect(mocks.clear).not.toHaveBeenCalled()
+      return { id: 'current', vid: 2 }
+    })
+    await expect(call({ data: {} })).resolves.toEqual({ id: 'current', vid: 2 })
+    expect(mocks.clear).toHaveBeenCalledOnce()
+    expect(mocks.preview).toHaveBeenCalledOnce()
+  })
+  it.each(['current password', 'stale revision', 'database rollback'])(
+    'does not clear cookies after %s failure',
+    async (reason) => {
+      mocks.command.mockRejectedValue(new Error(reason))
+      await expect(call({ data: {} })).rejects.toThrow(reason)
+      expect(mocks.clear).not.toHaveBeenCalled()
+      expect(mocks.preview).not.toHaveBeenCalled()
+    }
+  )
+  it('does not mutate or clear cookies when authentication fails', async () => {
+    mocks.context.mockRejectedValue(new Error('unauthenticated'))
+    await expect(call({ data: {} })).rejects.toThrow('unauthenticated')
+    expect(mocks.command).not.toHaveBeenCalled()
+    expect(mocks.clear).not.toHaveBeenCalled()
+  })
+})

package/src/server-fns/admin-account/change-password.ts

@@ -9,9 +9,14 @@
 import { createServerFn } from '@tanstack/react-start'
 
 import { type AccountResponse, changeAccountPasswordCommand } from '@byline/admin/admin-account'
-import { getAdminRequestContext } from '@byline/client/server'
+import {
+  clearPreviewCookie,
+  clearSessionCookies,
+  getAdminRequestContext,
+} from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface ChangeAccountPasswordInput {
   vid: number
@@ -20,8 +25,14 @@ export interface ChangeAccountPasswordInput {
 }
 
 export const changeAccountPassword = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: ChangeAccountPasswordInput) => input)
   .handler(async ({ data }): Promise<AccountResponse> => {
     const context = await getAdminRequestContext()
-    return changeAccountPasswordCommand(context, data, { store: bylineCore().adminStore! })
+    const account = await changeAccountPasswordCommand(context, data, {
+      store: bylineCore().adminStore!,
+    })
+    clearSessionCookies()
+    clearPreviewCookie()
+    return account
   })

package/src/server-fns/admin-account/get.ts

@@ -12,6 +12,7 @@ import { type AccountResponse, getAccountCommand } from '@byline/admin/admin-acc
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 /**
  * Read the currently signed-in admin's full account row. Used by the
@@ -20,6 +21,7 @@ import { bylineCore } from '../../integrations/byline-core.js'
  * doesn't carry.
  */
 export const getAccount = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input?: Record<string, never>) => input ?? {})
   .handler(async ({ data }): Promise<AccountResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-account/update.ts

@@ -12,6 +12,7 @@ import { type AccountResponse, updateAccountCommand } from '@byline/admin/admin-
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface UpdateAccountInput {
   vid: number
@@ -24,6 +25,7 @@ export interface UpdateAccountInput {
 }
 
 export const updateAccount = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: UpdateAccountInput) => input)
   .handler(async ({ data }): Promise<AccountResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-activity/get.ts

@@ -13,6 +13,7 @@ import { ADMIN_ACTIVITY_ABILITIES } from '@byline/admin/admin-activity'
 import { getAdminRequestContext } from '@byline/client/server'
 import { ERR_AUDIT_UNSUPPORTED, getLogger, getServerConfig } from '@byline/core'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { type ActorLabelMap, resolveActorLabels } from '../collections/actors.js'
 import type { AuditLogEntryDto } from '../collections/audit.js'
 
@@ -59,6 +60,7 @@ export interface SystemActivityResponse {
  * than by any document's own read gate.
  */
 export const getSystemActivityLog = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: SystemActivitySearchParams) => input ?? {})
   .handler(async ({ data }): Promise<SystemActivityResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-permissions/get-role-abilities.ts

@@ -15,8 +15,10 @@ import {
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const getRoleAbilities = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string }) => input)
   .handler(async ({ data }): Promise<GetRoleAbilitiesResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-permissions/list-registered.ts

@@ -15,14 +15,16 @@ import {
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 /**
  * List every registered ability — fed from `bylineCore().abilities`,
  * populated at init time by collection auto-registration plus
  * `registerAdminAbilities`. No DB read.
  */
-export const listRegisteredAbilities = createServerFn({ method: 'GET' }).handler(
-  async (): Promise<ListRegisteredAbilitiesResponse> => {
+export const listRegisteredAbilities = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
+  .handler(async (): Promise<ListRegisteredAbilitiesResponse> => {
     const context = await getAdminRequestContext()
     return listRegisteredAbilitiesCommand(
       context,
@@ -32,5 +34,4 @@ export const listRegisteredAbilities = createServerFn({ method: 'GET' }).handler
         abilities: bylineCore().abilities,
       }
     )
-  }
-)
+  })

package/src/server-fns/admin-permissions/set-role-abilities.ts

@@ -15,6 +15,7 @@ import {
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface SetRoleAbilitiesInput {
   id: string
@@ -22,6 +23,7 @@ export interface SetRoleAbilitiesInput {
 }
 
 export const setRoleAbilities = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: SetRoleAbilitiesInput) => input)
   .handler(async ({ data }): Promise<SetRoleAbilitiesResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-permissions/who-has.ts

@@ -12,8 +12,10 @@ import { type WhoHasAbilityResponse, whoHasAbilityCommand } from '@byline/admin/
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const whoHasAbility = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { ability: string }) => input)
   .handler(async ({ data }): Promise<WhoHasAbilityResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-roles/create.ts

@@ -12,6 +12,7 @@ import { type AdminRoleResponse, createAdminRoleCommand } from '@byline/admin/ad
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface CreateAdminRoleInput {
   name: string
@@ -21,6 +22,7 @@ export interface CreateAdminRoleInput {
 }
 
 export const createAdminRole = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: CreateAdminRoleInput) => input)
   .handler(async ({ data }): Promise<AdminRoleResponse> => {
     const context = await getAdminRequestContext()