@byline/host-tanstack-start 5.0.0 → 5.1.0

package/src/integrations/session-middleware.ts

@@ -0,0 +1,107 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createMiddleware } from '@tanstack/react-start'
+import { getRequest, setResponseHeader } from '@tanstack/react-start/server'
+
+import {
+  AuthError,
+  ERR_ACCESS_EXPIRED,
+  ERR_SESSION_CHANGED,
+  ERR_UNAUTHENTICATED,
+} from '@byline/auth'
+import { getAdminRequestContext } from '@byline/client/server'
+
+import { renewAdminSession } from '../server-fns/auth/renew.js'
+import {
+  coordinateAuthAction,
+  flagSessionChanged,
+  observeSession,
+  renewSingleFlight,
+  requireUnchanged,
+  sessionSnapshot,
+} from './session-coordination.js'
+import { sessionRequestKind } from './session-request-kind.js'
+
+const outcomeHeader = 'x-byline-auth-boundary'
+/** The boundary owns the retry signal; handler errors cannot turn into retryable outcomes. */
+export const adminSessionMiddleware = createMiddleware({ type: 'function' })
+  .client(async ({ next }) => {
+    if (typeof window === 'undefined')
+      return next({ sendContext: { bylineExpectedSessionId: null as string | null } })
+    const snapshot = sessionSnapshot()
+    requireUnchanged(snapshot)
+    return next({
+      sendContext: { bylineExpectedSessionId: snapshot.sessionId },
+      fetch: async (input, init) => {
+        // Re-serialize reusable BodyInit values (including FormData/Blob) on retry.
+        // Never clone/tee a Request: an unread branch can buffer an entire upload.
+        const reusable = !(input instanceof Request) && !(init?.body instanceof ReadableStream)
+        let response = await fetch(input, init)
+        if (response.headers.get(outcomeHeader) === 'changed') {
+          flagSessionChanged()
+          throw ERR_SESSION_CHANGED({ message: 'session changed' })
+        }
+        if (response.headers.get(outcomeHeader) === 'renew') {
+          requireUnchanged(snapshot)
+          await renewSingleFlight(() =>
+            coordinateAuthAction(async () => {
+              const result = await renewAdminSession({
+                data: { expectedSessionId: snapshot.sessionId ?? undefined },
+              }).catch((error) => {
+                if (error?.code === 'ERR_SESSION_CHANGED') flagSessionChanged()
+                throw error
+              })
+              if (snapshot.sessionId && result.sessionId !== snapshot.sessionId) {
+                flagSessionChanged()
+                throw ERR_SESSION_CHANGED({ message: 'session changed during renewal' })
+              }
+              observeSession(result.sessionId)
+            })
+          )
+          requireUnchanged(snapshot)
+          if (!reusable)
+            throw ERR_ACCESS_EXPIRED({ message: 'Session renewed. Please retry the operation.' })
+          response = await fetch(input, init)
+          if (response.headers.get(outcomeHeader) === 'changed') flagSessionChanged()
+        }
+        requireUnchanged(snapshot)
+        return response
+      },
+    })
+  })
+  .server(async ({ next, context, method }) => {
+    const kind = sessionRequestKind(getRequest())
+    if (!kind) throw new Error('sessionRequestMiddleware is not configured')
+    let auth: Awaited<ReturnType<typeof getAdminRequestContext>>
+    try {
+      auth = await getAdminRequestContext()
+    } catch (error) {
+      if (error instanceof AuthError && error.code === 'ERR_ACCESS_EXPIRED')
+        setResponseHeader(outcomeHeader, 'renew')
+      throw error
+    }
+    const expected = context.bylineExpectedSessionId
+    if ((kind === 'serverFn' || method !== 'GET') && (!expected || expected !== auth.sessionId)) {
+      setResponseHeader(outcomeHeader, 'changed')
+      throw ERR_SESSION_CHANGED({ message: 'session changed before operation' })
+    }
+    if (!auth.sessionId) throw ERR_UNAUTHENTICATED({ message: 'provider omitted login identity' })
+    // Strip the reserved signal after any handler outcome, including exceptions.
+    try {
+      const result = await next()
+      const response = (result as { result?: unknown }).result
+      if (response instanceof Response) response.headers.delete(outcomeHeader)
+      return result
+    } catch (error) {
+      if (error instanceof Response) error.headers.delete(outcomeHeader)
+      throw error
+    } finally {
+      setResponseHeader(outcomeHeader, 'handled')
+    }
+  })

package/src/integrations/session-request-kind.ts

@@ -0,0 +1,18 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/** Server-owned classification. A browser header cannot opt a request into SSR privileges. */
+const key = Symbol.for('byline.sessionRequestKinds')
+const kinds: WeakMap<object, string> = (globalThis as any)[key] ?? new WeakMap()
+;(globalThis as any)[key] = kinds
+export function recordSessionRequestKind(request: object, kind: string) {
+  kinds.set(request, kind)
+}
+export function sessionRequestKind(request: object) {
+  return kinds.get(request)
+}

package/src/integrations/session-request-middleware.ts

@@ -0,0 +1,17 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createMiddleware } from '@tanstack/react-start'
+
+import { recordSessionRequestKind } from './session-request-kind.js'
+
+/** Register after CSRF. Classifies SSR separately from remotely invoked business functions. */
+export const sessionRequestMiddleware = createMiddleware().server(async (ctx) => {
+  recordSessionRequestKind(ctx.request, ctx.handlerType)
+  return ctx.next()
+})

package/src/integrations/sign-in-body.test.node.ts

@@ -0,0 +1,59 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { checkSignInBody, SIGN_IN_MAX_BODY_BYTES, wasSignInBodyChecked } from './sign-in-body.js'
+
+function request(body: BodyInit, headers: Record<string, string> = {}) {
+  return new Request('https://app.test/_serverFn/login', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', ...headers },
+    body,
+    duplex: 'half',
+  } as RequestInit)
+}
+describe('sign-in body boundary', () => {
+  it('preserves the original body for RPC parsing', async () => {
+    const req = request('{"data":{}}')
+    expect(await checkSignInBody(req)).toBeUndefined()
+    expect(wasSignInBodyChecked(req)).toBe(true)
+    expect(await req.json()).toEqual({ data: {} })
+    expect(wasSignInBodyChecked(request('{}'))).toBe(false)
+  })
+  it('rejects oversized declared or actual bodies', async () => {
+    expect(
+      (
+        await checkSignInBody(
+          request('{}', { 'content-length': String(SIGN_IN_MAX_BODY_BYTES + 1) })
+        )
+      )?.status
+    ).toBe(413)
+    const req = request('x'.repeat(SIGN_IN_MAX_BODY_BYTES + 1), { 'content-length': '1' })
+    expect((await checkSignInBody(req))?.status).toBe(413)
+    expect(wasSignInBodyChecked(req)).toBe(false)
+  })
+  it('counts chunked bodies without relying on Content-Length', async () => {
+    const req = request(
+      new ReadableStream({
+        start(controller) {
+          controller.enqueue(new Uint8Array(SIGN_IN_MAX_BODY_BYTES))
+          controller.enqueue(new Uint8Array(1))
+          controller.close()
+        },
+      })
+    )
+    expect((await checkSignInBody(req))?.status).toBe(413)
+  })
+  it('rejects multipart and wrong methods', async () => {
+    expect(
+      (await checkSignInBody(request('{}', { 'content-type': 'multipart/form-data' })))?.status
+    ).toBe(415)
+    expect((await checkSignInBody(new Request('https://app.test')))?.status).toBe(405)
+  })
+})

package/src/integrations/sign-in-body.ts

@@ -0,0 +1,50 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/** Limit the serialized RPC envelope, not just its eventual credential fields. */
+export const SIGN_IN_MAX_BODY_BYTES = 16 * 1024
+const checked = new WeakSet<Request>()
+
+export function wasSignInBodyChecked(request: Request): boolean {
+  return checked.has(request)
+}
+
+/** Read a bounded clone before Start parses the original. Never await tee cancellation. */
+export async function checkSignInBody(request: Request): Promise<Response | undefined> {
+  if (request.method !== 'POST')
+    return new Response('Method not allowed', { status: 405, headers: { Allow: 'POST' } })
+  if (!request.headers.get('content-type')?.toLowerCase().startsWith('application/json')) {
+    return new Response('Expected JSON', { status: 415 })
+  }
+  const declared = request.headers.get('content-length')
+  if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > SIGN_IN_MAX_BODY_BYTES)) {
+    return new Response('Payload too large', { status: 413 })
+  }
+  const reader = request.clone().body?.getReader()
+  if (!reader) return new Response('Missing body', { status: 400 })
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const deadline = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => reject(new Error('Body timeout')), 5000)
+  })
+  try {
+    let size = 0
+    while (true) {
+      const { value, done } = await Promise.race([reader.read(), deadline])
+      if (done) break
+      size += value.byteLength
+      if (size > SIGN_IN_MAX_BODY_BYTES) return new Response('Payload too large', { status: 413 })
+    }
+    checked.add(request)
+    return undefined
+  } catch {
+    return new Response('Incomplete request body', { status: 408 })
+  } finally {
+    clearTimeout(timer)
+    void reader.cancel().catch(() => {})
+  }
+}

package/src/integrations/sign-in-middleware.ts

@@ -0,0 +1,24 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createMiddleware } from '@tanstack/react-start'
+
+import { adminSignIn } from '../server-fns/auth/sign-in.js'
+import { checkSignInBody } from './sign-in-body.js'
+
+/** Register after CSRF in Start's global requestMiddleware, before RPC deserialization. */
+export const passwordSignInMiddleware = createMiddleware().server(async (ctx) => {
+  const endpoint = new URL(adminSignIn.url, ctx.request.url).pathname.replace(/\/$/, '')
+  if (
+    ctx.handlerType !== 'serverFn' ||
+    (ctx.pathname !== endpoint && !ctx.pathname.startsWith(`${endpoint}/`))
+  )
+    return ctx.next()
+  const rejected = await checkSignInBody(ctx.request)
+  return rejected ?? ctx.next()
+})

package/src/routes/create-admin-layout-route.tsx

@@ -10,8 +10,8 @@
  * Admin shell layout — authenticated-only.
  *
  * `beforeLoad` resolves the current admin user (which internally verifies
- * the session cookies, refreshes transparently when needed, and throws
- * `ERR_UNAUTHENTICATED` when there is no session). On unauthenticated
+ * the access credential without rotating cookies). Expired access is
+ * renewed by the sign-in bootstrap. On unauthenticated
  * requests we redirect to `/sign-in` with a `callbackUrl` so the user
  * lands back on the page they originally requested.
  *
@@ -37,10 +37,12 @@ import { AdminMenuProvider } from '../admin-shell/chrome/admin-menu-provider.jsx
 import { Content } from '../admin-shell/chrome/content.js'
 import { RouteError, RouteNotFound } from '../admin-shell/chrome/route-error.js'
 import { RouteProgressBar } from '../admin-shell/chrome/route-progress-bar.js'
+import { SessionChangeBoundary } from '../admin-shell/chrome/session-change-boundary.js'
 import { buildLocaleDefinitions } from '../i18n/locale-definitions.js'
 import { bylineAdminServices } from '../integrations/byline-admin-services.js'
 import { BylineAiAdminProvider } from '../integrations/byline-ai.js'
 import { bylineFieldServices } from '../integrations/byline-field-services.js'
+import { observeSession, sessionIsChanged } from '../integrations/session-coordination.js'
 import { getAnalyticsRuntime } from '../server-fns/analytics/index.js'
 import { getCurrentAdminUser } from '../server-fns/auth/index.js'
 import { getScheduledPublicationRuntime } from '../server-fns/collections/index.js'
@@ -53,6 +55,7 @@ export function createAdminLayoutRoute(path: string) {
       const signInPath = getSignInRoutePath()
       try {
         const user = await getCurrentAdminUser()
+        if (typeof window !== 'undefined') observeSession(user.sessionId)
         // Resolve the active interface locale once on the server so SSR
         // and the hydrated client render the same translations and
         // there's no locale flicker. Going through the server fn (rather
@@ -65,7 +68,20 @@ export function createAdminLayoutRoute(path: string) {
           getAnalyticsRuntime(),
         ])
         return { user, activeLocale, scheduledPublicationRuntime, analyticsRuntime }
-      } catch {
+      } catch (error) {
+        const code = (error as { code?: string })?.code
+        if (
+          !(typeof window !== 'undefined' && sessionIsChanged()) &&
+          ![
+            'ERR_UNAUTHENTICATED',
+            'ERR_ACCESS_EXPIRED',
+            'ERR_INVALID_TOKEN',
+            'ERR_REVOKED_TOKEN',
+            'ERR_ACCOUNT_DISABLED',
+            'ERR_SESSION_CHANGED',
+          ].includes(code ?? '')
+        )
+          throw error
         // `getCurrentAdminUser` (via `getAdminRequestContext`) throws
         // `ERR_UNAUTHENTICATED` or a related auth error when no valid
         // session is present. Redirect to sign-in with the original path
@@ -104,33 +120,35 @@ export function createAdminLayoutRoute(path: string) {
         window.location.reload()
       }
       return (
-        <I18nProvider
-          bundle={i18n.translations ?? {}}
-          activeLocale={activeLocale}
-          defaultLocale={i18n.admin.defaultLocale}
-          localeDefinitions={localeDefinitions}
-          setLocale={handleSetLocale}
-        >
-          <BylineAdminServicesProvider services={bylineAdminServices}>
-            <BylineFieldServicesProvider services={bylineFieldServices}>
-              <BylineAiAdminProvider>
-                <AdminMenuProvider>
-                  <RouteProgressBar />
-                  <AdminAppBar user={user} />
-                  <main className={cx('byline-admin-layout-main', layoutStyles.main)}>
-                    <AdminMenuDrawer
-                      analyticsEnabled={analyticsRuntime.enabled}
-                      scheduledPublicationEnabled={scheduledPublicationRuntime.enabled}
-                    />
-                    <Content>
-                      <Outlet />
-                    </Content>
-                  </main>
-                </AdminMenuProvider>
-              </BylineAiAdminProvider>
-            </BylineFieldServicesProvider>
-          </BylineAdminServicesProvider>
-        </I18nProvider>
+        <SessionChangeBoundary user={user}>
+          <I18nProvider
+            bundle={i18n.translations ?? {}}
+            activeLocale={activeLocale}
+            defaultLocale={i18n.admin.defaultLocale}
+            localeDefinitions={localeDefinitions}
+            setLocale={handleSetLocale}
+          >
+            <BylineAdminServicesProvider services={bylineAdminServices}>
+              <BylineFieldServicesProvider services={bylineFieldServices}>
+                <BylineAiAdminProvider>
+                  <AdminMenuProvider>
+                    <RouteProgressBar />
+                    <AdminAppBar user={user} />
+                    <main className={cx('byline-admin-layout-main', layoutStyles.main)}>
+                      <AdminMenuDrawer
+                        analyticsEnabled={analyticsRuntime.enabled}
+                        scheduledPublicationEnabled={scheduledPublicationRuntime.enabled}
+                      />
+                      <Content>
+                        <Outlet />
+                      </Content>
+                    </main>
+                  </AdminMenuProvider>
+                </BylineAiAdminProvider>
+              </BylineFieldServicesProvider>
+            </BylineAdminServicesProvider>
+          </I18nProvider>
+        </SessionChangeBoundary>
       )
     },
     errorComponent: RouteError,

package/src/routes/create-sign-in-route.tsx

@@ -25,6 +25,7 @@ import { resolveAdminCallbackPath, resolveAdminSignInRedirect } from './admin-pa
 import { resolveSignInHomeUrl } from './sign-in-home-url.js'
 
 interface SignInSearch {
+  reauthenticate?: boolean
   callbackUrl?: string
 }
 
@@ -42,7 +43,13 @@ export function createSignInRoute(path: string, { homeUrl }: CreateSignInRouteOp
   const Route: any = createFileRoute(path as never)({
     validateSearch: (search: Record<string, unknown>): SignInSearch => {
       const callbackUrl = resolveAdminCallbackPath(search.callbackUrl)
-      return { callbackUrl }
+      return {
+        callbackUrl,
+        reauthenticate:
+          search.reauthenticate === '1' ||
+          search.reauthenticate === 1 ||
+          search.reauthenticate === true,
+      }
     },
     beforeLoad: async () => {
       // Resolve the active locale on the server before render so the
@@ -54,11 +61,12 @@ export function createSignInRoute(path: string, { homeUrl }: CreateSignInRouteOp
       return { activeLocale }
     },
     component: function SignInRouteComponent() {
-      const { callbackUrl } = Route.useSearch() as SignInSearch
+      const { callbackUrl, reauthenticate } = Route.useSearch() as SignInSearch
       const { activeLocale } = Route.useRouteContext() as { activeLocale: LocaleCode }
       return (
         <SignInPage
           redirectTo={resolveAdminSignInRedirect(callbackUrl)}
+          reauthenticate={reauthenticate}
           activeLocale={activeLocale}
           homeUrl={resolvedHomeUrl}
         />

package/src/server-fns/admin-account/change-password.test.node.ts

@@ -0,0 +1,69 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+// Handler-level tests isolate transport; session-middleware tests exercise the real pre-handler boundary.
+vi.mock('../../integrations/session-middleware.js', () => ({ adminSessionMiddleware: {} }))
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  context: vi.fn(),
+  command: vi.fn(),
+  clear: vi.fn(),
+  preview: vi.fn(),
+}))
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      middleware: () => chain,
+      validator: () => ({ handler: (handler: unknown) => handler }),
+    }
+    return chain
+  },
+}))
+vi.mock('@byline/admin/admin-account', () => ({ changeAccountPasswordCommand: mocks.command }))
+vi.mock('@byline/client/server', () => ({
+  getAdminRequestContext: mocks.context,
+  clearSessionCookies: mocks.clear,
+  clearPreviewCookie: mocks.preview,
+}))
+vi.mock('../../integrations/byline-core.js', () => ({ bylineCore: () => ({ adminStore: {} }) }))
+
+import { changeAccountPassword } from './change-password.js'
+
+const call = changeAccountPassword as unknown as (args: { data: unknown }) => Promise<unknown>
+beforeEach(() => {
+  vi.resetAllMocks()
+  mocks.context.mockResolvedValue({ actor: { id: 'current' } })
+})
+describe('password change cookie policy', () => {
+  it('clears the changing session and preview only after the mutation succeeds', async () => {
+    mocks.command.mockImplementation(async () => {
+      expect(mocks.clear).not.toHaveBeenCalled()
+      return { id: 'current', vid: 2 }
+    })
+    await expect(call({ data: {} })).resolves.toEqual({ id: 'current', vid: 2 })
+    expect(mocks.clear).toHaveBeenCalledOnce()
+    expect(mocks.preview).toHaveBeenCalledOnce()
+  })
+  it.each(['current password', 'stale revision', 'database rollback'])(
+    'does not clear cookies after %s failure',
+    async (reason) => {
+      mocks.command.mockRejectedValue(new Error(reason))
+      await expect(call({ data: {} })).rejects.toThrow(reason)
+      expect(mocks.clear).not.toHaveBeenCalled()
+      expect(mocks.preview).not.toHaveBeenCalled()
+    }
+  )
+  it('does not mutate or clear cookies when authentication fails', async () => {
+    mocks.context.mockRejectedValue(new Error('unauthenticated'))
+    await expect(call({ data: {} })).rejects.toThrow('unauthenticated')
+    expect(mocks.command).not.toHaveBeenCalled()
+    expect(mocks.clear).not.toHaveBeenCalled()
+  })
+})

package/src/server-fns/admin-account/change-password.ts

@@ -9,9 +9,14 @@
 import { createServerFn } from '@tanstack/react-start'
 
 import { type AccountResponse, changeAccountPasswordCommand } from '@byline/admin/admin-account'
-import { getAdminRequestContext } from '@byline/client/server'
+import {
+  clearPreviewCookie,
+  clearSessionCookies,
+  getAdminRequestContext,
+} from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface ChangeAccountPasswordInput {
   vid: number
@@ -20,8 +25,14 @@ export interface ChangeAccountPasswordInput {
 }
 
 export const changeAccountPassword = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: ChangeAccountPasswordInput) => input)
   .handler(async ({ data }): Promise<AccountResponse> => {
     const context = await getAdminRequestContext()
-    return changeAccountPasswordCommand(context, data, { store: bylineCore().adminStore! })
+    const account = await changeAccountPasswordCommand(context, data, {
+      store: bylineCore().adminStore!,
+    })
+    clearSessionCookies()
+    clearPreviewCookie()
+    return account
   })

package/src/server-fns/admin-account/get.ts

@@ -12,6 +12,7 @@ import { type AccountResponse, getAccountCommand } from '@byline/admin/admin-acc
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 /**
  * Read the currently signed-in admin's full account row. Used by the
@@ -20,6 +21,7 @@ import { bylineCore } from '../../integrations/byline-core.js'
  * doesn't carry.
  */
 export const getAccount = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input?: Record<string, never>) => input ?? {})
   .handler(async ({ data }): Promise<AccountResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-account/update.ts

@@ -12,6 +12,7 @@ import { type AccountResponse, updateAccountCommand } from '@byline/admin/admin-
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface UpdateAccountInput {
   vid: number
@@ -24,6 +25,7 @@ export interface UpdateAccountInput {
 }
 
 export const updateAccount = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: UpdateAccountInput) => input)
   .handler(async ({ data }): Promise<AccountResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-activity/get.ts

@@ -13,6 +13,7 @@ import { ADMIN_ACTIVITY_ABILITIES } from '@byline/admin/admin-activity'
 import { getAdminRequestContext } from '@byline/client/server'
 import { ERR_AUDIT_UNSUPPORTED, getLogger, getServerConfig } from '@byline/core'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { type ActorLabelMap, resolveActorLabels } from '../collections/actors.js'
 import type { AuditLogEntryDto } from '../collections/audit.js'
 
@@ -59,6 +60,7 @@ export interface SystemActivityResponse {
  * than by any document's own read gate.
  */
 export const getSystemActivityLog = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: SystemActivitySearchParams) => input ?? {})
   .handler(async ({ data }): Promise<SystemActivityResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-permissions/get-role-abilities.ts

@@ -15,8 +15,10 @@ import {
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const getRoleAbilities = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string }) => input)
   .handler(async ({ data }): Promise<GetRoleAbilitiesResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-permissions/list-registered.ts

@@ -15,14 +15,16 @@ import {
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 /**
  * List every registered ability — fed from `bylineCore().abilities`,
  * populated at init time by collection auto-registration plus
  * `registerAdminAbilities`. No DB read.
  */
-export const listRegisteredAbilities = createServerFn({ method: 'GET' }).handler(
-  async (): Promise<ListRegisteredAbilitiesResponse> => {
+export const listRegisteredAbilities = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
+  .handler(async (): Promise<ListRegisteredAbilitiesResponse> => {
     const context = await getAdminRequestContext()
     return listRegisteredAbilitiesCommand(
       context,
@@ -32,5 +34,4 @@ export const listRegisteredAbilities = createServerFn({ method: 'GET' }).handler
         abilities: bylineCore().abilities,
       }
     )
-  }
-)
+  })

package/src/server-fns/admin-permissions/set-role-abilities.ts

@@ -15,6 +15,7 @@ import {
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface SetRoleAbilitiesInput {
   id: string
@@ -22,6 +23,7 @@ export interface SetRoleAbilitiesInput {
 }
 
 export const setRoleAbilities = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: SetRoleAbilitiesInput) => input)
   .handler(async ({ data }): Promise<SetRoleAbilitiesResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-permissions/who-has.ts

@@ -12,8 +12,10 @@ import { type WhoHasAbilityResponse, whoHasAbilityCommand } from '@byline/admin/
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const whoHasAbility = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { ability: string }) => input)
   .handler(async ({ data }): Promise<WhoHasAbilityResponse> => {
     const context = await getAdminRequestContext()