@byline/host-tanstack-start 4.19.0 → 5.1.0

package/src/server-fns/admin-roles/delete.ts

@@ -12,12 +12,14 @@ import { deleteAdminRoleCommand } from '@byline/admin/admin-roles'
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 // Return shape mirrors `OkResponse` from `@byline/admin/admin-users`.
 // Lifting the type to a shared spot is a small follow-up — the two
 // modules each declare their own identical `OkResponse` today, and the
 // root `@byline/admin` barrel can only re-export one of them.
 export const deleteAdminRole = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string; vid: number }) => input)
   .handler(async ({ data }): Promise<{ ok: true }> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-roles/get.ts

@@ -12,8 +12,10 @@ import { type AdminRoleResponse, getAdminRoleCommand } from '@byline/admin/admin
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const getAdminRole = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string }) => input)
   .handler(async ({ data }): Promise<AdminRoleResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-roles/list.ts

@@ -12,6 +12,7 @@ import { type AdminRoleListResponse, listAdminRolesCommand } from '@byline/admin
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 /**
  * List admin roles. Thin server-fn wrapper over `listAdminRolesCommand`
@@ -19,9 +20,9 @@ import { bylineCore } from '../../integrations/byline-core.js'
  * No paging or sorting at this layer; the role set is small by design
  * and ordered by the `order` column.
  */
-export const listAdminRoles = createServerFn({ method: 'GET' }).handler(
-  async (): Promise<AdminRoleListResponse> => {
+export const listAdminRoles = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
+  .handler(async (): Promise<AdminRoleListResponse> => {
     const context = await getAdminRequestContext()
     return listAdminRolesCommand(context, {}, { store: bylineCore().adminStore! })
-  }
-)
+  })

package/src/server-fns/admin-roles/reorder.ts

@@ -12,8 +12,10 @@ import { reorderAdminRolesCommand } from '@byline/admin/admin-roles'
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const reorderAdminRoles = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { ids: string[] }) => input)
   .handler(async ({ data }): Promise<{ ok: true }> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-roles/update.ts

@@ -12,6 +12,7 @@ import { type AdminRoleResponse, updateAdminRoleCommand } from '@byline/admin/ad
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface UpdateAdminRoleInput {
   id: string
@@ -24,6 +25,7 @@ export interface UpdateAdminRoleInput {
 }
 
 export const updateAdminRole = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: UpdateAdminRoleInput) => input)
   .handler(async ({ data }): Promise<AdminRoleResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/create.ts

@@ -12,6 +12,7 @@ import { type AdminUserResponse, createAdminUserCommand } from '@byline/admin/ad
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface CreateAdminUserInput {
   email: string
@@ -25,6 +26,7 @@ export interface CreateAdminUserInput {
 }
 
 export const createAdminUser = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: CreateAdminUserInput) => input)
   .handler(async ({ data }): Promise<AdminUserResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/delete.ts

@@ -12,8 +12,10 @@ import { deleteAdminUserCommand, type OkResponse } from '@byline/admin/admin-use
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const deleteAdminUser = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string; vid: number }) => input)
   .handler(async ({ data }): Promise<OkResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/disable.ts

@@ -12,11 +12,13 @@ import { disableAdminUserCommand, type OkResponse } from '@byline/admin/admin-us
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 // No UI affordance yet — paired with `enable.ts`, both ship ahead of the
 // detail-view enable/disable control they will be wired into. Keep until
 // that control lands; not dead code.
 export const disableAdminUser = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string }) => input)
   .handler(async ({ data }): Promise<OkResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/enable.ts

@@ -12,11 +12,13 @@ import { enableAdminUserCommand, type OkResponse } from '@byline/admin/admin-use
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 // No UI affordance yet — paired with `disable.ts`, both ship ahead of the
 // detail-view enable/disable control they will be wired into. Keep until
 // that control lands; not dead code.
 export const enableAdminUser = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string }) => input)
   .handler(async ({ data }): Promise<OkResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/get-user-roles.ts

@@ -12,8 +12,10 @@ import { getRolesForUserCommand, type UserRolesResponse } from '@byline/admin/ad
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const getUserRoles = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { userId: string }) => input)
   .handler(async ({ data }): Promise<UserRolesResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/get.ts

@@ -12,8 +12,10 @@ import { type AdminUserResponse, getAdminUserCommand } from '@byline/admin/admin
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const getAdminUser = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string }) => input)
   .handler(async ({ data }): Promise<AdminUserResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/list.ts

@@ -16,6 +16,7 @@ import {
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface ListAdminUsersInput {
   page?: number
@@ -33,6 +34,7 @@ export interface ListAdminUsersInput {
  * TanStack Start transport layer for the client to branch on.
  */
 export const listAdminUsers = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: ListAdminUsersInput) => input ?? {})
   .handler(async ({ data }): Promise<AdminUserListResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/set-password.ts

@@ -12,6 +12,7 @@ import { type AdminUserResponse, setAdminUserPasswordCommand } from '@byline/adm
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface SetAdminUserPasswordInput {
   id: string
@@ -20,6 +21,7 @@ export interface SetAdminUserPasswordInput {
 }
 
 export const setAdminUserPassword = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: SetAdminUserPasswordInput) => input)
   .handler(async ({ data }): Promise<AdminUserResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/set-user-roles.ts

@@ -12,6 +12,7 @@ import { setRolesForUserCommand, type UserRolesResponse } from '@byline/admin/ad
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface SetUserRolesInput {
   userId: string
@@ -19,6 +20,7 @@ export interface SetUserRolesInput {
 }
 
 export const setUserRoles = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: SetUserRolesInput) => input)
   .handler(async ({ data }): Promise<UserRolesResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/update.ts

@@ -12,6 +12,7 @@ import { type AdminUserResponse, updateAdminUserCommand } from '@byline/admin/ad
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface UpdateAdminUserInput {
   id: string
@@ -27,6 +28,7 @@ export interface UpdateAdminUserInput {
 }
 
 export const updateAdminUser = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: UpdateAdminUserInput) => input)
   .handler(async ({ data }): Promise<AdminUserResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/ai/execute.ts

@@ -26,6 +26,8 @@ import type { ExecuteInstructionOptions, ExecuteInstructionParams } from '@bylin
 import { executeInstruction, executeInstructionStreaming } from '@byline/ai/server'
 import { getAdminRequestContext } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+
 /**
  * Wire shape — the same as `ExecuteInstruction` minus the in-process-only
  * `signal` (an AbortSignal can't be serialized across the RPC boundary;
@@ -37,6 +39,7 @@ type ExecuteAiInstructionInput = {
 }
 
 export const executeAiInstruction = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: ExecuteAiInstructionInput) => input)
   .handler(async ({ data }): Promise<Response> => {
     // Throws ERR_UNAUTHENTICATED if there is no admin session.

package/src/server-fns/analytics/maintenance.ts

@@ -12,6 +12,8 @@ import { assertAdminActor } from '@byline/admin'
 import { ANALYTICS_ABILITIES } from '@byline/admin/analytics'
 import { getAdminRequestContext } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+
 export interface DeleteAnalyticsEventsInput {
   from: string
   to: string
@@ -19,6 +21,7 @@ export interface DeleteAnalyticsEventsInput {
 }
 
 export const deleteAnalyticsEvents = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: DeleteAnalyticsEventsInput) => input)
   .handler(async ({ data }): Promise<{ deleted: number }> => {
     await assertAnalyticsMaintenance()
@@ -34,6 +37,7 @@ export const deleteAnalyticsEvents = createServerFn({ method: 'POST' })
   })
 
 export const rebuildAnalyticsDay = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { day: string }) => input)
   .handler(async ({ data }): Promise<{ rebuilt: string }> => {
     await assertAnalyticsMaintenance()

package/src/server-fns/analytics/queries.ts

@@ -22,6 +22,8 @@ import type {
 } from '@byline/analytics'
 import { getAdminRequestContext } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+
 export interface AnalyticsTopInput extends AnalyticsDateRange {
   kind: AnalyticsEventKind
   limit?: number
@@ -31,16 +33,17 @@ export interface AnalyticsRuntimeState {
   enabled: boolean
 }
 
-export const getAnalyticsRuntime = createServerFn({ method: 'GET' }).handler(
-  async (): Promise<AnalyticsRuntimeState> => {
+export const getAnalyticsRuntime = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
+  .handler(async (): Promise<AnalyticsRuntimeState> => {
     const context = await getAdminRequestContext()
     requireAdminActor(context, 'reading analytics runtime state')
     const { isAnalyticsRegistered } = await import('@byline/analytics')
     return { enabled: isAnalyticsRegistered() }
-  }
-)
+  })
 
 export const getAnalyticsSummary = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: AnalyticsDateRange) => input)
   .handler(async ({ data }): Promise<AnalyticsSummary> => {
     await assertAnalyticsRead()
@@ -48,15 +51,16 @@ export const getAnalyticsSummary = createServerFn({ method: 'GET' })
     return getAnalytics().getSummary(data)
   })
 
-export const getAnalyticsReportCoverage = createServerFn({ method: 'GET' }).handler(
-  async (): Promise<AnalyticsReportCoverage> => {
+export const getAnalyticsReportCoverage = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
+  .handler(async (): Promise<AnalyticsReportCoverage> => {
     await assertAnalyticsRead()
     const { getAnalytics } = await import('@byline/analytics')
     return getAnalytics().getReportCoverage()
-  }
-)
+  })
 
 export const getAnalyticsTop = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: AnalyticsTopInput) => input)
   .handler(async ({ data }): Promise<AnalyticsRankedTotals<AnalyticsPathTotal>> => {
     await assertAnalyticsRead()
@@ -65,6 +69,7 @@ export const getAnalyticsTop = createServerFn({ method: 'GET' })
   })
 
 export const getAnalyticsReferrers = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: AnalyticsDateRange & { limit?: number }) => input)
   .handler(async ({ data }): Promise<AnalyticsRankedTotals<AnalyticsReferrerTotal>> => {
     await assertAnalyticsRead()
@@ -73,6 +78,7 @@ export const getAnalyticsReferrers = createServerFn({ method: 'GET' })
   })
 
 export const getAnalyticsCountries = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: AnalyticsDateRange) => input)
   .handler(async ({ data }): Promise<AnalyticsCountryTotal[]> => {
     await assertAnalyticsRead()

package/src/server-fns/auth/current-user.ts

@@ -10,7 +10,7 @@
  * Admin profile lookup for the authenticated request.
  *
  * Thin wrapper that resolves the `AdminAuth` via `getAdminRequestContext()`
- * (which handles verify + lazy refresh + cookie rewrites), then fetches the
+ * (which verifies credentials without rotating or rewriting cookies), then fetches the
  * admin user's profile row so the UI can render "signed in as X" without
  * embedding identity metadata in the JWT itself.
  *
@@ -26,6 +26,7 @@ import { getAdminRequestContext } from '@byline/client/server'
 import { bylineCore } from '../../integrations/byline-core.js'
 
 export interface CurrentAdminUser {
+  sessionId: string
   id: string
   email: string
   given_name: string | null
@@ -48,7 +49,7 @@ export interface CurrentAdminUser {
 
 export const getCurrentAdminUser = createServerFn({ method: 'GET' }).handler(
   async (): Promise<CurrentAdminUser> => {
-    const { actor } = await getAdminRequestContext()
+    const { actor, sessionId } = await getAdminRequestContext()
     if (!actor) {
       // getAdminRequestContext always returns an AdminAuth on success; the
       // null branch is compile-time impossible here but satisfies the type.
@@ -63,6 +64,7 @@ export const getCurrentAdminUser = createServerFn({ method: 'GET' }).handler(
     }
 
     return {
+      sessionId: sessionId!,
       id: row.id,
       email: row.email,
       given_name: row.given_name,
@@ -85,8 +87,9 @@ export const getCurrentAdminUserSoft = createServerFn({ method: 'GET' }).handler
   async (): Promise<CurrentAdminUser | null> => {
     try {
       let actor: Actor
+      let sessionId: string | undefined
       try {
-        ;({ actor } = await getAdminRequestContext())
+        ;({ actor, sessionId } = await getAdminRequestContext())
       } catch (err) {
         if (err instanceof AuthError) return null
         throw err
@@ -97,6 +100,7 @@ export const getCurrentAdminUserSoft = createServerFn({ method: 'GET' }).handler
       if (!row) return null
 
       return {
+        sessionId: sessionId!,
         id: row.id,
         email: row.email,
         given_name: row.given_name,

package/src/server-fns/auth/renew.test.node.ts

@@ -0,0 +1,85 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { ERR_ACCESS_EXPIRED, ERR_INVALID_TOKEN, ERR_REVOKED_TOKEN } from '@byline/auth'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  access: 'access' as string | undefined,
+  refresh: 'refresh' as string | undefined,
+  verify: vi.fn(),
+  rotate: vi.fn(),
+  cookies: vi.fn(),
+}))
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => ({
+    validator: (validate: any) => ({ handler: (handler: any) => ({ validate, handler }) }),
+  }),
+}))
+vi.mock('@tanstack/react-start/server', () => ({ setResponseHeader: vi.fn() }))
+vi.mock('@byline/core', () => ({
+  getServerConfig: () => ({
+    sessionProvider: { verifyAccessToken: mocks.verify, refreshSession: mocks.rotate },
+  }),
+}))
+vi.mock('@byline/client/server', () => ({
+  readAccessTokenCookie: () => mocks.access,
+  readRefreshTokenCookie: () => mocks.refresh,
+  setSessionCookies: mocks.cookies,
+}))
+
+import { renewAdminSession } from './renew.js'
+
+const endpoint = renewAdminSession as unknown as { handler: (args: any) => Promise<any> }
+const call = () => endpoint.handler({ data: { expectedSessionId: 'A' } })
+beforeEach(() => {
+  vi.resetAllMocks()
+  mocks.access = 'access'
+  mocks.refresh = 'refresh'
+})
+describe('explicit renewal', () => {
+  it('does not rotate or write cookies when access is already valid', async () => {
+    mocks.verify.mockResolvedValue({ sessionId: 'A' })
+    await expect(call()).resolves.toEqual({ sessionId: 'A' })
+    expect(mocks.rotate).not.toHaveBeenCalled()
+    expect(mocks.cookies).not.toHaveBeenCalled()
+  })
+  it('passes the original login identity into renewal and writes only confirmed credentials', async () => {
+    mocks.verify.mockRejectedValue(ERR_ACCESS_EXPIRED({ message: 'expired' }))
+    const tokens = { sessionId: 'A', accessToken: 'new', refreshToken: 'new-refresh' }
+    mocks.rotate.mockImplementation(async () => {
+      expect(mocks.cookies).not.toHaveBeenCalled()
+      return tokens
+    })
+    await expect(call()).resolves.toEqual({ sessionId: 'A' })
+    expect(mocks.rotate).toHaveBeenCalledWith({ refreshToken: 'refresh', expectedSessionId: 'A' })
+    expect(mocks.cookies).toHaveBeenCalledWith(tokens)
+  })
+  it.each([
+    ERR_INVALID_TOKEN({ message: 'bad signature' }),
+    ERR_REVOKED_TOKEN({ message: 'revoked' }),
+    new Error('database'),
+  ])('does not turn %s into renewal', async (error) => {
+    mocks.verify.mockRejectedValue(error)
+    await expect(call()).rejects.toBe(error)
+    expect(mocks.rotate).not.toHaveBeenCalled()
+    expect(mocks.cookies).not.toHaveBeenCalled()
+  })
+  it('rejects a different live login instead of accepting the no-op', async () => {
+    mocks.verify.mockResolvedValue({ sessionId: 'B' })
+    await expect(call()).rejects.toMatchObject({ code: 'ERR_SESSION_CHANGED' })
+    expect(mocks.rotate).not.toHaveBeenCalled()
+    expect(mocks.cookies).not.toHaveBeenCalled()
+  })
+  it('preserves the cookie jar on renewal failure', async () => {
+    mocks.access = undefined
+    mocks.rotate.mockRejectedValue(ERR_REVOKED_TOKEN({ message: 'replayed' }))
+    await expect(call()).rejects.toThrow()
+    expect(mocks.cookies).not.toHaveBeenCalled()
+  })
+})

package/src/server-fns/auth/renew.ts

@@ -0,0 +1,54 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createServerFn } from '@tanstack/react-start'
+import { setResponseHeader } from '@tanstack/react-start/server'
+
+import { AuthError, ERR_SESSION_CHANGED, ERR_UNAUTHENTICATED } from '@byline/auth'
+import {
+  readAccessTokenCookie,
+  readRefreshTokenCookie,
+  setSessionCookies,
+} from '@byline/client/server'
+import { getServerConfig } from '@byline/core'
+
+/** Explicit renewal only. Global CSRF protection applies before this POST handler. */
+export const renewAdminSession = createServerFn({ method: 'POST' })
+  .validator((value: unknown): { expectedSessionId?: string } => {
+    if (value == null) return {}
+    if (typeof value !== 'object') throw new Error('Invalid renewal input')
+    const sid = (value as { expectedSessionId?: unknown }).expectedSessionId
+    if (sid !== undefined && (typeof sid !== 'string' || !sid || sid.length > 256))
+      throw new Error('Invalid login identity')
+    return { expectedSessionId: sid as string | undefined }
+  })
+  .handler(async ({ data }) => {
+    setResponseHeader('Cache-Control', 'no-store')
+    const provider = getServerConfig().sessionProvider
+    if (!provider) throw new Error('no sessionProvider configured')
+    const access = readAccessTokenCookie()
+    if (access) {
+      try {
+        const verified = await provider.verifyAccessToken(access)
+        if (data.expectedSessionId && data.expectedSessionId !== verified.sessionId)
+          throw ERR_SESSION_CHANGED({ message: 'session changed' })
+        return { sessionId: verified.sessionId }
+      } catch (error) {
+        // Invalid signature, revocation and infrastructure errors never cause renewal.
+        if (!(error instanceof AuthError) || error.code !== 'ERR_ACCESS_EXPIRED') throw error
+      }
+    }
+    const refreshToken = readRefreshTokenCookie()
+    if (!refreshToken) throw ERR_UNAUTHENTICATED({ message: 'no session to renew' })
+    const tokens = await provider.refreshSession({
+      refreshToken,
+      expectedSessionId: data.expectedSessionId,
+    })
+    setSessionCookies(tokens)
+    return { sessionId: tokens.sessionId }
+  })

package/src/server-fns/auth/sign-in.test.node.ts

@@ -0,0 +1,114 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  config: {} as any,
+  request: null as unknown as Request,
+  signIn: vi.fn(),
+  limiter: vi.fn(),
+  acquire: vi.fn(),
+  release: vi.fn(),
+  outcome: vi.fn(),
+  setCookies: vi.fn(),
+}))
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => ({
+    validator: (validate: (input: unknown) => unknown) => ({
+      handler: (handler: any) => ({ validate, handler }),
+    }),
+  }),
+}))
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => mocks.request,
+  getRequestHeader: () => undefined,
+}))
+vi.mock('@byline/core', () => ({ getServerConfig: () => mocks.config }))
+vi.mock('@byline/client/server', () => ({
+  setSessionCookies: mocks.setCookies,
+  readAccessTokenCookie: () => undefined,
+  readRefreshTokenCookie: () => undefined,
+}))
+vi.mock('../../i18n/locale-cookie.js', () => ({ readAdminLocaleCookie: () => null }))
+vi.mock('../../integrations/byline-core.js', () => ({
+  bylineCore: () => {
+    throw new Error('unused')
+  },
+}))
+
+import { checkSignInBody } from '../../integrations/sign-in-body.js'
+import { adminSignIn } from './sign-in.js'
+
+const fn = adminSignIn as unknown as {
+  validate: (input: unknown) => unknown
+  handler: (args: any) => Promise<unknown>
+}
+const input = { email: 'admin@example.test', password: 'legacy' }
+beforeEach(async () => {
+  vi.clearAllMocks()
+  mocks.request = new Request('http://localhost/sign-in', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: '{}',
+  })
+  await checkSignInBody(mocks.request)
+  mocks.acquire.mockResolvedValue(mocks.release)
+  mocks.limiter.mockResolvedValue({ allowed: true, retryAfterSeconds: 0 })
+  mocks.signIn.mockResolvedValue({ actor: { id: 'test' } })
+  mocks.config = {
+    sessionProvider: { signInWithPassword: mocks.signIn },
+    passwordSignIn: {
+      resolveClientIp: () => '192.0.2.1',
+      limiter: { consume: mocks.limiter, acquire: mocks.acquire, recordResult: mocks.outcome },
+    },
+  }
+})
+describe('password sign-in protection', () => {
+  it('admits validated legacy credentials and sets cookies after authentication', async () => {
+    expect(await fn.handler({ data: fn.validate(input) })).toEqual({ userId: 'test' })
+    expect(mocks.limiter).toHaveBeenCalledWith({ email: input.email, ip: '192.0.2.1' })
+    expect(mocks.signIn).toHaveBeenCalledWith({ ...input, ip: '192.0.2.1', userAgent: undefined })
+    expect(mocks.setCookies).toHaveBeenCalledTimes(1)
+  })
+  it('rejects oversized credentials during validation', () => {
+    expect(() => fn.validate({ ...input, password: 'a'.repeat(129) })).toThrow()
+    expect(mocks.signIn).not.toHaveBeenCalled()
+  })
+  it('returns 429 with Retry-After before the provider is called', async () => {
+    mocks.limiter.mockResolvedValue({ allowed: false, retryAfterSeconds: 42 })
+    const error = await fn.handler({ data: input }).catch((e) => e)
+    expect(error.status).toBe(429)
+    expect(error.headers.get('Retry-After')).toBe('42')
+    expect(mocks.signIn).not.toHaveBeenCalled()
+    expect(mocks.setCookies).not.toHaveBeenCalled()
+  })
+  it('sheds capacity before accessing the store or provider', async () => {
+    mocks.acquire.mockResolvedValue(null)
+    expect((await fn.handler({ data: input }).catch((e) => e)).status).toBe(429)
+    expect(mocks.limiter).not.toHaveBeenCalled()
+    expect(mocks.signIn).not.toHaveBeenCalled()
+  })
+  it('releases capacity and records failed verification', async () => {
+    mocks.signIn.mockRejectedValueOnce(new Error('invalid credentials'))
+    await expect(fn.handler({ data: input })).rejects.toThrow('invalid credentials')
+    expect(mocks.release).toHaveBeenCalledTimes(1)
+    expect(mocks.outcome).toHaveBeenCalledWith({ email: input.email, ip: '192.0.2.1' }, 'failure')
+  })
+  it.each(['store', 'ip', 'middleware', 'config'])(
+    'fails closed when %s protection is unavailable',
+    async (kind) => {
+      if (kind === 'store') mocks.limiter.mockRejectedValue(new Error('DB unavailable'))
+      if (kind === 'ip') mocks.config.passwordSignIn.resolveClientIp = () => null
+      if (kind === 'middleware') mocks.request = new Request('http://localhost/sign-in')
+      if (kind === 'config') delete mocks.config.passwordSignIn
+      expect((await fn.handler({ data: input }).catch((e) => e)).status).toBe(503)
+      expect(mocks.signIn).not.toHaveBeenCalled()
+    }
+  )
+})