@byline/host-tanstack-start 5.0.0 → 5.1.1

package/src/server-fns/admin-users/enable.ts

@@ -12,11 +12,13 @@ import { enableAdminUserCommand, type OkResponse } from '@byline/admin/admin-use
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 // No UI affordance yet — paired with `disable.ts`, both ship ahead of the
 // detail-view enable/disable control they will be wired into. Keep until
 // that control lands; not dead code.
 export const enableAdminUser = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string }) => input)
   .handler(async ({ data }): Promise<OkResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/get-user-roles.ts

@@ -12,8 +12,10 @@ import { getRolesForUserCommand, type UserRolesResponse } from '@byline/admin/ad
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const getUserRoles = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { userId: string }) => input)
   .handler(async ({ data }): Promise<UserRolesResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/get.ts

@@ -12,8 +12,10 @@ import { type AdminUserResponse, getAdminUserCommand } from '@byline/admin/admin
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const getAdminUser = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string }) => input)
   .handler(async ({ data }): Promise<AdminUserResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/list.ts

@@ -16,6 +16,7 @@ import {
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface ListAdminUsersInput {
   page?: number
@@ -33,6 +34,7 @@ export interface ListAdminUsersInput {
  * TanStack Start transport layer for the client to branch on.
  */
 export const listAdminUsers = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: ListAdminUsersInput) => input ?? {})
   .handler(async ({ data }): Promise<AdminUserListResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/set-password.ts

@@ -12,6 +12,7 @@ import { type AdminUserResponse, setAdminUserPasswordCommand } from '@byline/adm
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface SetAdminUserPasswordInput {
   id: string
@@ -20,6 +21,7 @@ export interface SetAdminUserPasswordInput {
 }
 
 export const setAdminUserPassword = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: SetAdminUserPasswordInput) => input)
   .handler(async ({ data }): Promise<AdminUserResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/set-user-roles.ts

@@ -12,6 +12,7 @@ import { setRolesForUserCommand, type UserRolesResponse } from '@byline/admin/ad
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface SetUserRolesInput {
   userId: string
@@ -19,6 +20,7 @@ export interface SetUserRolesInput {
 }
 
 export const setUserRoles = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: SetUserRolesInput) => input)
   .handler(async ({ data }): Promise<UserRolesResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/update.ts

@@ -12,6 +12,7 @@ import { type AdminUserResponse, updateAdminUserCommand } from '@byline/admin/ad
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface UpdateAdminUserInput {
   id: string
@@ -27,6 +28,7 @@ export interface UpdateAdminUserInput {
 }
 
 export const updateAdminUser = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: UpdateAdminUserInput) => input)
   .handler(async ({ data }): Promise<AdminUserResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/ai/execute.ts

@@ -26,6 +26,8 @@ import type { ExecuteInstructionOptions, ExecuteInstructionParams } from '@bylin
 import { executeInstruction, executeInstructionStreaming } from '@byline/ai/server'
 import { getAdminRequestContext } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+
 /**
  * Wire shape — the same as `ExecuteInstruction` minus the in-process-only
  * `signal` (an AbortSignal can't be serialized across the RPC boundary;
@@ -37,6 +39,7 @@ type ExecuteAiInstructionInput = {
 }
 
 export const executeAiInstruction = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: ExecuteAiInstructionInput) => input)
   .handler(async ({ data }): Promise<Response> => {
     // Throws ERR_UNAUTHENTICATED if there is no admin session.

package/src/server-fns/analytics/maintenance.ts

@@ -12,6 +12,8 @@ import { assertAdminActor } from '@byline/admin'
 import { ANALYTICS_ABILITIES } from '@byline/admin/analytics'
 import { getAdminRequestContext } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+
 export interface DeleteAnalyticsEventsInput {
   from: string
   to: string
@@ -19,6 +21,7 @@ export interface DeleteAnalyticsEventsInput {
 }
 
 export const deleteAnalyticsEvents = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: DeleteAnalyticsEventsInput) => input)
   .handler(async ({ data }): Promise<{ deleted: number }> => {
     await assertAnalyticsMaintenance()
@@ -34,6 +37,7 @@ export const deleteAnalyticsEvents = createServerFn({ method: 'POST' })
   })
 
 export const rebuildAnalyticsDay = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { day: string }) => input)
   .handler(async ({ data }): Promise<{ rebuilt: string }> => {
     await assertAnalyticsMaintenance()

package/src/server-fns/analytics/queries.ts

@@ -22,6 +22,8 @@ import type {
 } from '@byline/analytics'
 import { getAdminRequestContext } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+
 export interface AnalyticsTopInput extends AnalyticsDateRange {
   kind: AnalyticsEventKind
   limit?: number
@@ -31,16 +33,17 @@ export interface AnalyticsRuntimeState {
   enabled: boolean
 }
 
-export const getAnalyticsRuntime = createServerFn({ method: 'GET' }).handler(
-  async (): Promise<AnalyticsRuntimeState> => {
+export const getAnalyticsRuntime = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
+  .handler(async (): Promise<AnalyticsRuntimeState> => {
     const context = await getAdminRequestContext()
     requireAdminActor(context, 'reading analytics runtime state')
     const { isAnalyticsRegistered } = await import('@byline/analytics')
     return { enabled: isAnalyticsRegistered() }
-  }
-)
+  })
 
 export const getAnalyticsSummary = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: AnalyticsDateRange) => input)
   .handler(async ({ data }): Promise<AnalyticsSummary> => {
     await assertAnalyticsRead()
@@ -48,15 +51,16 @@ export const getAnalyticsSummary = createServerFn({ method: 'GET' })
     return getAnalytics().getSummary(data)
   })
 
-export const getAnalyticsReportCoverage = createServerFn({ method: 'GET' }).handler(
-  async (): Promise<AnalyticsReportCoverage> => {
+export const getAnalyticsReportCoverage = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
+  .handler(async (): Promise<AnalyticsReportCoverage> => {
     await assertAnalyticsRead()
     const { getAnalytics } = await import('@byline/analytics')
     return getAnalytics().getReportCoverage()
-  }
-)
+  })
 
 export const getAnalyticsTop = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: AnalyticsTopInput) => input)
   .handler(async ({ data }): Promise<AnalyticsRankedTotals<AnalyticsPathTotal>> => {
     await assertAnalyticsRead()
@@ -65,6 +69,7 @@ export const getAnalyticsTop = createServerFn({ method: 'GET' })
   })
 
 export const getAnalyticsReferrers = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: AnalyticsDateRange & { limit?: number }) => input)
   .handler(async ({ data }): Promise<AnalyticsRankedTotals<AnalyticsReferrerTotal>> => {
     await assertAnalyticsRead()
@@ -73,6 +78,7 @@ export const getAnalyticsReferrers = createServerFn({ method: 'GET' })
   })
 
 export const getAnalyticsCountries = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: AnalyticsDateRange) => input)
   .handler(async ({ data }): Promise<AnalyticsCountryTotal[]> => {
     await assertAnalyticsRead()

package/src/server-fns/auth/current-user.ts

@@ -10,7 +10,7 @@
  * Admin profile lookup for the authenticated request.
  *
  * Thin wrapper that resolves the `AdminAuth` via `getAdminRequestContext()`
- * (which handles verify + lazy refresh + cookie rewrites), then fetches the
+ * (which verifies credentials without rotating or rewriting cookies), then fetches the
  * admin user's profile row so the UI can render "signed in as X" without
  * embedding identity metadata in the JWT itself.
  *
@@ -26,6 +26,7 @@ import { getAdminRequestContext } from '@byline/client/server'
 import { bylineCore } from '../../integrations/byline-core.js'
 
 export interface CurrentAdminUser {
+  sessionId: string
   id: string
   email: string
   given_name: string | null
@@ -48,7 +49,7 @@ export interface CurrentAdminUser {
 
 export const getCurrentAdminUser = createServerFn({ method: 'GET' }).handler(
   async (): Promise<CurrentAdminUser> => {
-    const { actor } = await getAdminRequestContext()
+    const { actor, sessionId } = await getAdminRequestContext()
     if (!actor) {
       // getAdminRequestContext always returns an AdminAuth on success; the
       // null branch is compile-time impossible here but satisfies the type.
@@ -63,6 +64,7 @@ export const getCurrentAdminUser = createServerFn({ method: 'GET' }).handler(
     }
 
     return {
+      sessionId: sessionId!,
       id: row.id,
       email: row.email,
       given_name: row.given_name,
@@ -85,8 +87,9 @@ export const getCurrentAdminUserSoft = createServerFn({ method: 'GET' }).handler
   async (): Promise<CurrentAdminUser | null> => {
     try {
       let actor: Actor
+      let sessionId: string | undefined
       try {
-        ;({ actor } = await getAdminRequestContext())
+        ;({ actor, sessionId } = await getAdminRequestContext())
       } catch (err) {
         if (err instanceof AuthError) return null
         throw err
@@ -97,6 +100,7 @@ export const getCurrentAdminUserSoft = createServerFn({ method: 'GET' }).handler
       if (!row) return null
 
       return {
+        sessionId: sessionId!,
         id: row.id,
         email: row.email,
         given_name: row.given_name,

package/src/server-fns/auth/renew.test.node.ts

@@ -0,0 +1,85 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { ERR_ACCESS_EXPIRED, ERR_INVALID_TOKEN, ERR_REVOKED_TOKEN } from '@byline/auth'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  access: 'access' as string | undefined,
+  refresh: 'refresh' as string | undefined,
+  verify: vi.fn(),
+  rotate: vi.fn(),
+  cookies: vi.fn(),
+}))
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => ({
+    validator: (validate: any) => ({ handler: (handler: any) => ({ validate, handler }) }),
+  }),
+}))
+vi.mock('@tanstack/react-start/server', () => ({ setResponseHeader: vi.fn() }))
+vi.mock('@byline/core', () => ({
+  getServerConfig: () => ({
+    sessionProvider: { verifyAccessToken: mocks.verify, refreshSession: mocks.rotate },
+  }),
+}))
+vi.mock('@byline/client/server', () => ({
+  readAccessTokenCookie: () => mocks.access,
+  readRefreshTokenCookie: () => mocks.refresh,
+  setSessionCookies: mocks.cookies,
+}))
+
+import { renewAdminSession } from './renew.js'
+
+const endpoint = renewAdminSession as unknown as { handler: (args: any) => Promise<any> }
+const call = () => endpoint.handler({ data: { expectedSessionId: 'A' } })
+beforeEach(() => {
+  vi.resetAllMocks()
+  mocks.access = 'access'
+  mocks.refresh = 'refresh'
+})
+describe('explicit renewal', () => {
+  it('does not rotate or write cookies when access is already valid', async () => {
+    mocks.verify.mockResolvedValue({ sessionId: 'A' })
+    await expect(call()).resolves.toEqual({ sessionId: 'A' })
+    expect(mocks.rotate).not.toHaveBeenCalled()
+    expect(mocks.cookies).not.toHaveBeenCalled()
+  })
+  it('passes the original login identity into renewal and writes only confirmed credentials', async () => {
+    mocks.verify.mockRejectedValue(ERR_ACCESS_EXPIRED({ message: 'expired' }))
+    const tokens = { sessionId: 'A', accessToken: 'new', refreshToken: 'new-refresh' }
+    mocks.rotate.mockImplementation(async () => {
+      expect(mocks.cookies).not.toHaveBeenCalled()
+      return tokens
+    })
+    await expect(call()).resolves.toEqual({ sessionId: 'A' })
+    expect(mocks.rotate).toHaveBeenCalledWith({ refreshToken: 'refresh', expectedSessionId: 'A' })
+    expect(mocks.cookies).toHaveBeenCalledWith(tokens)
+  })
+  it.each([
+    ERR_INVALID_TOKEN({ message: 'bad signature' }),
+    ERR_REVOKED_TOKEN({ message: 'revoked' }),
+    new Error('database'),
+  ])('does not turn %s into renewal', async (error) => {
+    mocks.verify.mockRejectedValue(error)
+    await expect(call()).rejects.toBe(error)
+    expect(mocks.rotate).not.toHaveBeenCalled()
+    expect(mocks.cookies).not.toHaveBeenCalled()
+  })
+  it('rejects a different live login instead of accepting the no-op', async () => {
+    mocks.verify.mockResolvedValue({ sessionId: 'B' })
+    await expect(call()).rejects.toMatchObject({ code: 'ERR_SESSION_CHANGED' })
+    expect(mocks.rotate).not.toHaveBeenCalled()
+    expect(mocks.cookies).not.toHaveBeenCalled()
+  })
+  it('preserves the cookie jar on renewal failure', async () => {
+    mocks.access = undefined
+    mocks.rotate.mockRejectedValue(ERR_REVOKED_TOKEN({ message: 'replayed' }))
+    await expect(call()).rejects.toThrow()
+    expect(mocks.cookies).not.toHaveBeenCalled()
+  })
+})

package/src/server-fns/auth/renew.ts

@@ -0,0 +1,54 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createServerFn } from '@tanstack/react-start'
+import { setResponseHeader } from '@tanstack/react-start/server'
+
+import { AuthError, ERR_SESSION_CHANGED, ERR_UNAUTHENTICATED } from '@byline/auth'
+import {
+  readAccessTokenCookie,
+  readRefreshTokenCookie,
+  setSessionCookies,
+} from '@byline/client/server'
+import { getServerConfig } from '@byline/core'
+
+/** Explicit renewal only. Global CSRF protection applies before this POST handler. */
+export const renewAdminSession = createServerFn({ method: 'POST' })
+  .validator((value: unknown): { expectedSessionId?: string } => {
+    if (value == null) return {}
+    if (typeof value !== 'object') throw new Error('Invalid renewal input')
+    const sid = (value as { expectedSessionId?: unknown }).expectedSessionId
+    if (sid !== undefined && (typeof sid !== 'string' || !sid || sid.length > 256))
+      throw new Error('Invalid login identity')
+    return { expectedSessionId: sid as string | undefined }
+  })
+  .handler(async ({ data }) => {
+    setResponseHeader('Cache-Control', 'no-store')
+    const provider = getServerConfig().sessionProvider
+    if (!provider) throw new Error('no sessionProvider configured')
+    const access = readAccessTokenCookie()
+    if (access) {
+      try {
+        const verified = await provider.verifyAccessToken(access)
+        if (data.expectedSessionId && data.expectedSessionId !== verified.sessionId)
+          throw ERR_SESSION_CHANGED({ message: 'session changed' })
+        return { sessionId: verified.sessionId }
+      } catch (error) {
+        // Invalid signature, revocation and infrastructure errors never cause renewal.
+        if (!(error instanceof AuthError) || error.code !== 'ERR_ACCESS_EXPIRED') throw error
+      }
+    }
+    const refreshToken = readRefreshTokenCookie()
+    if (!refreshToken) throw ERR_UNAUTHENTICATED({ message: 'no session to renew' })
+    const tokens = await provider.refreshSession({
+      refreshToken,
+      expectedSessionId: data.expectedSessionId,
+    })
+    setSessionCookies(tokens)
+    return { sessionId: tokens.sessionId }
+  })

package/src/server-fns/auth/sign-in.test.node.ts

@@ -0,0 +1,114 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  config: {} as any,
+  request: null as unknown as Request,
+  signIn: vi.fn(),
+  limiter: vi.fn(),
+  acquire: vi.fn(),
+  release: vi.fn(),
+  outcome: vi.fn(),
+  setCookies: vi.fn(),
+}))
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => ({
+    validator: (validate: (input: unknown) => unknown) => ({
+      handler: (handler: any) => ({ validate, handler }),
+    }),
+  }),
+}))
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => mocks.request,
+  getRequestHeader: () => undefined,
+}))
+vi.mock('@byline/core', () => ({ getServerConfig: () => mocks.config }))
+vi.mock('@byline/client/server', () => ({
+  setSessionCookies: mocks.setCookies,
+  readAccessTokenCookie: () => undefined,
+  readRefreshTokenCookie: () => undefined,
+}))
+vi.mock('../../i18n/locale-cookie.js', () => ({ readAdminLocaleCookie: () => null }))
+vi.mock('../../integrations/byline-core.js', () => ({
+  bylineCore: () => {
+    throw new Error('unused')
+  },
+}))
+
+import { checkSignInBody } from '../../integrations/sign-in-body.js'
+import { adminSignIn } from './sign-in.js'
+
+const fn = adminSignIn as unknown as {
+  validate: (input: unknown) => unknown
+  handler: (args: any) => Promise<unknown>
+}
+const input = { email: 'admin@example.test', password: 'legacy' }
+beforeEach(async () => {
+  vi.clearAllMocks()
+  mocks.request = new Request('http://localhost/sign-in', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: '{}',
+  })
+  await checkSignInBody(mocks.request)
+  mocks.acquire.mockResolvedValue(mocks.release)
+  mocks.limiter.mockResolvedValue({ allowed: true, retryAfterSeconds: 0 })
+  mocks.signIn.mockResolvedValue({ actor: { id: 'test' } })
+  mocks.config = {
+    sessionProvider: { signInWithPassword: mocks.signIn },
+    passwordSignIn: {
+      resolveClientIp: () => '192.0.2.1',
+      limiter: { consume: mocks.limiter, acquire: mocks.acquire, recordResult: mocks.outcome },
+    },
+  }
+})
+describe('password sign-in protection', () => {
+  it('admits validated legacy credentials and sets cookies after authentication', async () => {
+    expect(await fn.handler({ data: fn.validate(input) })).toEqual({ userId: 'test' })
+    expect(mocks.limiter).toHaveBeenCalledWith({ email: input.email, ip: '192.0.2.1' })
+    expect(mocks.signIn).toHaveBeenCalledWith({ ...input, ip: '192.0.2.1', userAgent: undefined })
+    expect(mocks.setCookies).toHaveBeenCalledTimes(1)
+  })
+  it('rejects oversized credentials during validation', () => {
+    expect(() => fn.validate({ ...input, password: 'a'.repeat(129) })).toThrow()
+    expect(mocks.signIn).not.toHaveBeenCalled()
+  })
+  it('returns 429 with Retry-After before the provider is called', async () => {
+    mocks.limiter.mockResolvedValue({ allowed: false, retryAfterSeconds: 42 })
+    const error = await fn.handler({ data: input }).catch((e) => e)
+    expect(error.status).toBe(429)
+    expect(error.headers.get('Retry-After')).toBe('42')
+    expect(mocks.signIn).not.toHaveBeenCalled()
+    expect(mocks.setCookies).not.toHaveBeenCalled()
+  })
+  it('sheds capacity before accessing the store or provider', async () => {
+    mocks.acquire.mockResolvedValue(null)
+    expect((await fn.handler({ data: input }).catch((e) => e)).status).toBe(429)
+    expect(mocks.limiter).not.toHaveBeenCalled()
+    expect(mocks.signIn).not.toHaveBeenCalled()
+  })
+  it('releases capacity and records failed verification', async () => {
+    mocks.signIn.mockRejectedValueOnce(new Error('invalid credentials'))
+    await expect(fn.handler({ data: input })).rejects.toThrow('invalid credentials')
+    expect(mocks.release).toHaveBeenCalledTimes(1)
+    expect(mocks.outcome).toHaveBeenCalledWith({ email: input.email, ip: '192.0.2.1' }, 'failure')
+  })
+  it.each(['store', 'ip', 'middleware', 'config'])(
+    'fails closed when %s protection is unavailable',
+    async (kind) => {
+      if (kind === 'store') mocks.limiter.mockRejectedValue(new Error('DB unavailable'))
+      if (kind === 'ip') mocks.config.passwordSignIn.resolveClientIp = () => null
+      if (kind === 'middleware') mocks.request = new Request('http://localhost/sign-in')
+      if (kind === 'config') delete mocks.config.passwordSignIn
+      expect((await fn.handler({ data: input }).catch((e) => e)).status).toBe(503)
+      expect(mocks.signIn).not.toHaveBeenCalled()
+    }
+  )
+})

package/src/server-fns/auth/sign-in.ts

@@ -18,13 +18,21 @@
  */
 
 import { createServerFn } from '@tanstack/react-start'
-import { getRequestHeader } from '@tanstack/react-start/server'
-
-import { setSessionCookies } from '@byline/client/server'
+import { getRequest, getRequestHeader } from '@tanstack/react-start/server'
+
+import type { SignInAdmission } from '@byline/auth'
+import {
+  readAccessTokenCookie,
+  readRefreshTokenCookie,
+  setSessionCookies,
+} from '@byline/client/server'
 import { getServerConfig } from '@byline/core'
+import { passwordSignInSchema } from '@byline/core/validation'
 
 import { readAdminLocaleCookie } from '../../i18n/locale-cookie.js'
 import { bylineCore } from '../../integrations/byline-core.js'
+import { normalizeClientIp } from '../../integrations/client-ip.js'
+import { wasSignInBodyChecked } from '../../integrations/sign-in-body.js'
 
 export interface SignInInput {
   email: string
@@ -33,17 +41,14 @@ export interface SignInInput {
 
 export interface SignInResult {
   userId: string
+  sessionId: string
 }
 
 export const adminSignIn = createServerFn({ method: 'POST' })
-  .validator((input: SignInInput) => {
-    if (typeof input?.email !== 'string' || input.email.length === 0) {
-      throw new Error('email is required')
-    }
-    if (typeof input?.password !== 'string' || input.password.length === 0) {
-      throw new Error('password is required')
-    }
-    return { email: input.email, password: input.password }
+  .validator((input: unknown) => {
+    const parsed = passwordSignInSchema.safeParse(input)
+    if (!parsed.success) throw new Response('Invalid sign-in input', { status: 400 })
+    return parsed.data
   })
   .handler(async ({ data }): Promise<SignInResult> => {
     const provider = getServerConfig().sessionProvider
@@ -51,21 +56,69 @@ export const adminSignIn = createServerFn({ method: 'POST' })
       throw new Error('no sessionProvider configured')
     }
 
-    // TanStack Start doesn't currently expose the raw request IP in a
-    // cross-runtime way; pass what we can observe and leave the ip field
-    // unset. Operators who need accurate client IPs for refresh-token
-    // provenance will typically run behind a reverse proxy that stamps
-    // `x-forwarded-for` — revisit when Phase 5 sees real deployments.
-    const userAgent = getRequestHeader('user-agent') ?? undefined
-    const forwardedFor = getRequestHeader('x-forwarded-for') ?? undefined
-    const ip = forwardedFor?.split(',')[0]?.trim() || undefined
-
-    const result = await provider.signInWithPassword({
-      email: data.email,
-      password: data.password,
-      userAgent,
-      ip,
-    })
+    const request = getRequest()
+    const protection = getServerConfig().passwordSignIn
+    if (!wasSignInBodyChecked(request)) {
+      throw new Response('Password sign-in request middleware is not configured', { status: 503 })
+    }
+    if (!protection) {
+      throw new Response('Password sign-in protection is not configured', { status: 503 })
+    }
+    const userAgent = getRequestHeader('user-agent')?.slice(0, 512)
+    let ip: string | null
+    try {
+      ip = normalizeClientIp(await protection.resolveClientIp(request))
+    } catch {
+      throw new Response('Client address unavailable', { status: 503 })
+    }
+    if (!ip) throw new Response('Client address unavailable', { status: 503 })
+    const tooMany = (seconds: number) =>
+      new Response('Too many sign-in attempts', {
+        status: 429,
+        headers: { 'Retry-After': String(seconds), 'Cache-Control': 'no-store' },
+      })
+    let release: (() => void) | null
+    try {
+      release = await protection.limiter.acquire()
+    } catch {
+      throw new Response('Sign-in temporarily unavailable', { status: 503 })
+    }
+    if (!release) throw tooMany(1)
+    const recordResult = (outcome: 'success' | 'failure') => {
+      try {
+        protection.limiter.recordResult?.({ email: data.email, ip }, outcome)
+      } catch {
+        /* Telemetry cannot change authentication outcomes. */
+      }
+    }
+    const result = await (async () => {
+      try {
+        let admission: SignInAdmission
+        try {
+          admission = await protection.limiter.consume({ email: data.email, ip })
+        } catch {
+          throw new Response('Sign-in temporarily unavailable', { status: 503 })
+        }
+        if (!admission.allowed) throw tooMany(admission.retryAfterSeconds)
+        try {
+          const result = await provider.signInWithPassword({
+            previousAccessToken: readAccessTokenCookie(),
+            previousRefreshToken: readRefreshTokenCookie(),
+            email: data.email,
+            password: data.password,
+            userAgent,
+            ip,
+          })
+          recordResult('success')
+          return result
+        } catch (error) {
+          recordResult('failure')
+          throw error
+        }
+      } finally {
+        release()
+      }
+    })()
 
     setSessionCookies(result)
 
@@ -82,7 +135,7 @@ export const adminSignIn = createServerFn({ method: 'POST' })
       // Swallow — locale sync is not load-bearing for the sign-in flow.
     }
 
-    return { userId: result.actor.id }
+    return { userId: result.actor.id, sessionId: result.sessionId }
   })
 
 /**