@byline/host-tanstack-start 5.0.0 → 5.1.1

package/src/integrations/sign-in-body.test.node.ts

@@ -0,0 +1,59 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { checkSignInBody, SIGN_IN_MAX_BODY_BYTES, wasSignInBodyChecked } from './sign-in-body.js'
+
+function request(body: BodyInit, headers: Record<string, string> = {}) {
+  return new Request('https://app.test/_serverFn/login', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', ...headers },
+    body,
+    duplex: 'half',
+  } as RequestInit)
+}
+describe('sign-in body boundary', () => {
+  it('preserves the original body for RPC parsing', async () => {
+    const req = request('{"data":{}}')
+    expect(await checkSignInBody(req)).toBeUndefined()
+    expect(wasSignInBodyChecked(req)).toBe(true)
+    expect(await req.json()).toEqual({ data: {} })
+    expect(wasSignInBodyChecked(request('{}'))).toBe(false)
+  })
+  it('rejects oversized declared or actual bodies', async () => {
+    expect(
+      (
+        await checkSignInBody(
+          request('{}', { 'content-length': String(SIGN_IN_MAX_BODY_BYTES + 1) })
+        )
+      )?.status
+    ).toBe(413)
+    const req = request('x'.repeat(SIGN_IN_MAX_BODY_BYTES + 1), { 'content-length': '1' })
+    expect((await checkSignInBody(req))?.status).toBe(413)
+    expect(wasSignInBodyChecked(req)).toBe(false)
+  })
+  it('counts chunked bodies without relying on Content-Length', async () => {
+    const req = request(
+      new ReadableStream({
+        start(controller) {
+          controller.enqueue(new Uint8Array(SIGN_IN_MAX_BODY_BYTES))
+          controller.enqueue(new Uint8Array(1))
+          controller.close()
+        },
+      })
+    )
+    expect((await checkSignInBody(req))?.status).toBe(413)
+  })
+  it('rejects multipart and wrong methods', async () => {
+    expect(
+      (await checkSignInBody(request('{}', { 'content-type': 'multipart/form-data' })))?.status
+    ).toBe(415)
+    expect((await checkSignInBody(new Request('https://app.test')))?.status).toBe(405)
+  })
+})

package/src/integrations/sign-in-body.ts

@@ -0,0 +1,50 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/** Limit the serialized RPC envelope, not just its eventual credential fields. */
+export const SIGN_IN_MAX_BODY_BYTES = 16 * 1024
+const checked = new WeakSet<Request>()
+
+export function wasSignInBodyChecked(request: Request): boolean {
+  return checked.has(request)
+}
+
+/** Read a bounded clone before Start parses the original. Never await tee cancellation. */
+export async function checkSignInBody(request: Request): Promise<Response | undefined> {
+  if (request.method !== 'POST')
+    return new Response('Method not allowed', { status: 405, headers: { Allow: 'POST' } })
+  if (!request.headers.get('content-type')?.toLowerCase().startsWith('application/json')) {
+    return new Response('Expected JSON', { status: 415 })
+  }
+  const declared = request.headers.get('content-length')
+  if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > SIGN_IN_MAX_BODY_BYTES)) {
+    return new Response('Payload too large', { status: 413 })
+  }
+  const reader = request.clone().body?.getReader()
+  if (!reader) return new Response('Missing body', { status: 400 })
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const deadline = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => reject(new Error('Body timeout')), 5000)
+  })
+  try {
+    let size = 0
+    while (true) {
+      const { value, done } = await Promise.race([reader.read(), deadline])
+      if (done) break
+      size += value.byteLength
+      if (size > SIGN_IN_MAX_BODY_BYTES) return new Response('Payload too large', { status: 413 })
+    }
+    checked.add(request)
+    return undefined
+  } catch {
+    return new Response('Incomplete request body', { status: 408 })
+  } finally {
+    clearTimeout(timer)
+    void reader.cancel().catch(() => {})
+  }
+}

package/src/integrations/sign-in-middleware.ts

@@ -0,0 +1,24 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createMiddleware } from '@tanstack/react-start'
+
+import { adminSignIn } from '../server-fns/auth/sign-in.js'
+import { checkSignInBody } from './sign-in-body.js'
+
+/** Register after CSRF in Start's global requestMiddleware, before RPC deserialization. */
+export const passwordSignInMiddleware = createMiddleware().server(async (ctx) => {
+  const endpoint = new URL(adminSignIn.url, ctx.request.url).pathname.replace(/\/$/, '')
+  if (
+    ctx.handlerType !== 'serverFn' ||
+    (ctx.pathname !== endpoint && !ctx.pathname.startsWith(`${endpoint}/`))
+  )
+    return ctx.next()
+  const rejected = await checkSignInBody(ctx.request)
+  return rejected ?? ctx.next()
+})

package/src/routes/create-admin-layout-route.tsx

@@ -10,8 +10,8 @@
  * Admin shell layout — authenticated-only.
  *
  * `beforeLoad` resolves the current admin user (which internally verifies
- * the session cookies, refreshes transparently when needed, and throws
- * `ERR_UNAUTHENTICATED` when there is no session). On unauthenticated
+ * the access credential without rotating cookies). Expired access is
+ * renewed by the sign-in bootstrap. On unauthenticated
  * requests we redirect to `/sign-in` with a `callbackUrl` so the user
  * lands back on the page they originally requested.
  *
@@ -37,10 +37,12 @@ import { AdminMenuProvider } from '../admin-shell/chrome/admin-menu-provider.jsx
 import { Content } from '../admin-shell/chrome/content.js'
 import { RouteError, RouteNotFound } from '../admin-shell/chrome/route-error.js'
 import { RouteProgressBar } from '../admin-shell/chrome/route-progress-bar.js'
+import { SessionChangeBoundary } from '../admin-shell/chrome/session-change-boundary.js'
 import { buildLocaleDefinitions } from '../i18n/locale-definitions.js'
 import { bylineAdminServices } from '../integrations/byline-admin-services.js'
 import { BylineAiAdminProvider } from '../integrations/byline-ai.js'
 import { bylineFieldServices } from '../integrations/byline-field-services.js'
+import { observeSession, sessionIsChanged } from '../integrations/session-coordination.js'
 import { getAnalyticsRuntime } from '../server-fns/analytics/index.js'
 import { getCurrentAdminUser } from '../server-fns/auth/index.js'
 import { getScheduledPublicationRuntime } from '../server-fns/collections/index.js'
@@ -53,6 +55,7 @@ export function createAdminLayoutRoute(path: string) {
       const signInPath = getSignInRoutePath()
       try {
         const user = await getCurrentAdminUser()
+        if (typeof window !== 'undefined') observeSession(user.sessionId)
         // Resolve the active interface locale once on the server so SSR
         // and the hydrated client render the same translations and
         // there's no locale flicker. Going through the server fn (rather
@@ -65,7 +68,20 @@ export function createAdminLayoutRoute(path: string) {
           getAnalyticsRuntime(),
         ])
         return { user, activeLocale, scheduledPublicationRuntime, analyticsRuntime }
-      } catch {
+      } catch (error) {
+        const code = (error as { code?: string })?.code
+        if (
+          !(typeof window !== 'undefined' && sessionIsChanged()) &&
+          ![
+            'ERR_UNAUTHENTICATED',
+            'ERR_ACCESS_EXPIRED',
+            'ERR_INVALID_TOKEN',
+            'ERR_REVOKED_TOKEN',
+            'ERR_ACCOUNT_DISABLED',
+            'ERR_SESSION_CHANGED',
+          ].includes(code ?? '')
+        )
+          throw error
         // `getCurrentAdminUser` (via `getAdminRequestContext`) throws
         // `ERR_UNAUTHENTICATED` or a related auth error when no valid
         // session is present. Redirect to sign-in with the original path
@@ -104,33 +120,35 @@ export function createAdminLayoutRoute(path: string) {
         window.location.reload()
       }
       return (
-        <I18nProvider
-          bundle={i18n.translations ?? {}}
-          activeLocale={activeLocale}
-          defaultLocale={i18n.admin.defaultLocale}
-          localeDefinitions={localeDefinitions}
-          setLocale={handleSetLocale}
-        >
-          <BylineAdminServicesProvider services={bylineAdminServices}>
-            <BylineFieldServicesProvider services={bylineFieldServices}>
-              <BylineAiAdminProvider>
-                <AdminMenuProvider>
-                  <RouteProgressBar />
-                  <AdminAppBar user={user} />
-                  <main className={cx('byline-admin-layout-main', layoutStyles.main)}>
-                    <AdminMenuDrawer
-                      analyticsEnabled={analyticsRuntime.enabled}
-                      scheduledPublicationEnabled={scheduledPublicationRuntime.enabled}
-                    />
-                    <Content>
-                      <Outlet />
-                    </Content>
-                  </main>
-                </AdminMenuProvider>
-              </BylineAiAdminProvider>
-            </BylineFieldServicesProvider>
-          </BylineAdminServicesProvider>
-        </I18nProvider>
+        <SessionChangeBoundary user={user}>
+          <I18nProvider
+            bundle={i18n.translations ?? {}}
+            activeLocale={activeLocale}
+            defaultLocale={i18n.admin.defaultLocale}
+            localeDefinitions={localeDefinitions}
+            setLocale={handleSetLocale}
+          >
+            <BylineAdminServicesProvider services={bylineAdminServices}>
+              <BylineFieldServicesProvider services={bylineFieldServices}>
+                <BylineAiAdminProvider>
+                  <AdminMenuProvider>
+                    <RouteProgressBar />
+                    <AdminAppBar user={user} />
+                    <main className={cx('byline-admin-layout-main', layoutStyles.main)}>
+                      <AdminMenuDrawer
+                        analyticsEnabled={analyticsRuntime.enabled}
+                        scheduledPublicationEnabled={scheduledPublicationRuntime.enabled}
+                      />
+                      <Content>
+                        <Outlet />
+                      </Content>
+                    </main>
+                  </AdminMenuProvider>
+                </BylineAiAdminProvider>
+              </BylineFieldServicesProvider>
+            </BylineAdminServicesProvider>
+          </I18nProvider>
+        </SessionChangeBoundary>
       )
     },
     errorComponent: RouteError,

package/src/routes/create-sign-in-route.tsx

@@ -25,6 +25,7 @@ import { resolveAdminCallbackPath, resolveAdminSignInRedirect } from './admin-pa
 import { resolveSignInHomeUrl } from './sign-in-home-url.js'
 
 interface SignInSearch {
+  reauthenticate?: boolean
   callbackUrl?: string
 }
 
@@ -42,7 +43,13 @@ export function createSignInRoute(path: string, { homeUrl }: CreateSignInRouteOp
   const Route: any = createFileRoute(path as never)({
     validateSearch: (search: Record<string, unknown>): SignInSearch => {
       const callbackUrl = resolveAdminCallbackPath(search.callbackUrl)
-      return { callbackUrl }
+      return {
+        callbackUrl,
+        reauthenticate:
+          search.reauthenticate === '1' ||
+          search.reauthenticate === 1 ||
+          search.reauthenticate === true,
+      }
     },
     beforeLoad: async () => {
       // Resolve the active locale on the server before render so the
@@ -54,11 +61,12 @@ export function createSignInRoute(path: string, { homeUrl }: CreateSignInRouteOp
       return { activeLocale }
     },
     component: function SignInRouteComponent() {
-      const { callbackUrl } = Route.useSearch() as SignInSearch
+      const { callbackUrl, reauthenticate } = Route.useSearch() as SignInSearch
       const { activeLocale } = Route.useRouteContext() as { activeLocale: LocaleCode }
       return (
         <SignInPage
           redirectTo={resolveAdminSignInRedirect(callbackUrl)}
+          reauthenticate={reauthenticate}
           activeLocale={activeLocale}
           homeUrl={resolvedHomeUrl}
         />

package/src/server-fns/admin-account/change-password.test.node.ts

@@ -0,0 +1,69 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+// Handler-level tests isolate transport; session-middleware tests exercise the real pre-handler boundary.
+vi.mock('../../integrations/session-middleware.js', () => ({ adminSessionMiddleware: {} }))
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  context: vi.fn(),
+  command: vi.fn(),
+  clear: vi.fn(),
+  preview: vi.fn(),
+}))
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const chain = {
+      middleware: () => chain,
+      validator: () => ({ handler: (handler: unknown) => handler }),
+    }
+    return chain
+  },
+}))
+vi.mock('@byline/admin/admin-account', () => ({ changeAccountPasswordCommand: mocks.command }))
+vi.mock('@byline/client/server', () => ({
+  getAdminRequestContext: mocks.context,
+  clearSessionCookies: mocks.clear,
+  clearPreviewCookie: mocks.preview,
+}))
+vi.mock('../../integrations/byline-core.js', () => ({ bylineCore: () => ({ adminStore: {} }) }))
+
+import { changeAccountPassword } from './change-password.js'
+
+const call = changeAccountPassword as unknown as (args: { data: unknown }) => Promise<unknown>
+beforeEach(() => {
+  vi.resetAllMocks()
+  mocks.context.mockResolvedValue({ actor: { id: 'current' } })
+})
+describe('password change cookie policy', () => {
+  it('clears the changing session and preview only after the mutation succeeds', async () => {
+    mocks.command.mockImplementation(async () => {
+      expect(mocks.clear).not.toHaveBeenCalled()
+      return { id: 'current', vid: 2 }
+    })
+    await expect(call({ data: {} })).resolves.toEqual({ id: 'current', vid: 2 })
+    expect(mocks.clear).toHaveBeenCalledOnce()
+    expect(mocks.preview).toHaveBeenCalledOnce()
+  })
+  it.each(['current password', 'stale revision', 'database rollback'])(
+    'does not clear cookies after %s failure',
+    async (reason) => {
+      mocks.command.mockRejectedValue(new Error(reason))
+      await expect(call({ data: {} })).rejects.toThrow(reason)
+      expect(mocks.clear).not.toHaveBeenCalled()
+      expect(mocks.preview).not.toHaveBeenCalled()
+    }
+  )
+  it('does not mutate or clear cookies when authentication fails', async () => {
+    mocks.context.mockRejectedValue(new Error('unauthenticated'))
+    await expect(call({ data: {} })).rejects.toThrow('unauthenticated')
+    expect(mocks.command).not.toHaveBeenCalled()
+    expect(mocks.clear).not.toHaveBeenCalled()
+  })
+})

package/src/server-fns/admin-account/change-password.ts

@@ -9,9 +9,14 @@
 import { createServerFn } from '@tanstack/react-start'
 
 import { type AccountResponse, changeAccountPasswordCommand } from '@byline/admin/admin-account'
-import { getAdminRequestContext } from '@byline/client/server'
+import {
+  clearPreviewCookie,
+  clearSessionCookies,
+  getAdminRequestContext,
+} from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface ChangeAccountPasswordInput {
   vid: number
@@ -20,8 +25,14 @@ export interface ChangeAccountPasswordInput {
 }
 
 export const changeAccountPassword = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: ChangeAccountPasswordInput) => input)
   .handler(async ({ data }): Promise<AccountResponse> => {
     const context = await getAdminRequestContext()
-    return changeAccountPasswordCommand(context, data, { store: bylineCore().adminStore! })
+    const account = await changeAccountPasswordCommand(context, data, {
+      store: bylineCore().adminStore!,
+    })
+    clearSessionCookies()
+    clearPreviewCookie()
+    return account
   })

package/src/server-fns/admin-account/get.ts

@@ -12,6 +12,7 @@ import { type AccountResponse, getAccountCommand } from '@byline/admin/admin-acc
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 /**
  * Read the currently signed-in admin's full account row. Used by the
@@ -20,6 +21,7 @@ import { bylineCore } from '../../integrations/byline-core.js'
  * doesn't carry.
  */
 export const getAccount = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input?: Record<string, never>) => input ?? {})
   .handler(async ({ data }): Promise<AccountResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-account/update.ts

@@ -12,6 +12,7 @@ import { type AccountResponse, updateAccountCommand } from '@byline/admin/admin-
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface UpdateAccountInput {
   vid: number
@@ -24,6 +25,7 @@ export interface UpdateAccountInput {
 }
 
 export const updateAccount = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: UpdateAccountInput) => input)
   .handler(async ({ data }): Promise<AccountResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-activity/get.ts

@@ -13,6 +13,7 @@ import { ADMIN_ACTIVITY_ABILITIES } from '@byline/admin/admin-activity'
 import { getAdminRequestContext } from '@byline/client/server'
 import { ERR_AUDIT_UNSUPPORTED, getLogger, getServerConfig } from '@byline/core'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { type ActorLabelMap, resolveActorLabels } from '../collections/actors.js'
 import type { AuditLogEntryDto } from '../collections/audit.js'
 
@@ -59,6 +60,7 @@ export interface SystemActivityResponse {
  * than by any document's own read gate.
  */
 export const getSystemActivityLog = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: SystemActivitySearchParams) => input ?? {})
   .handler(async ({ data }): Promise<SystemActivityResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-permissions/get-role-abilities.ts

@@ -15,8 +15,10 @@ import {
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const getRoleAbilities = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string }) => input)
   .handler(async ({ data }): Promise<GetRoleAbilitiesResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-permissions/list-registered.ts

@@ -15,14 +15,16 @@ import {
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 /**
  * List every registered ability — fed from `bylineCore().abilities`,
  * populated at init time by collection auto-registration plus
  * `registerAdminAbilities`. No DB read.
  */
-export const listRegisteredAbilities = createServerFn({ method: 'GET' }).handler(
-  async (): Promise<ListRegisteredAbilitiesResponse> => {
+export const listRegisteredAbilities = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
+  .handler(async (): Promise<ListRegisteredAbilitiesResponse> => {
     const context = await getAdminRequestContext()
     return listRegisteredAbilitiesCommand(
       context,
@@ -32,5 +34,4 @@ export const listRegisteredAbilities = createServerFn({ method: 'GET' }).handler
         abilities: bylineCore().abilities,
       }
     )
-  }
-)
+  })

package/src/server-fns/admin-permissions/set-role-abilities.ts

@@ -15,6 +15,7 @@ import {
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface SetRoleAbilitiesInput {
   id: string
@@ -22,6 +23,7 @@ export interface SetRoleAbilitiesInput {
 }
 
 export const setRoleAbilities = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: SetRoleAbilitiesInput) => input)
   .handler(async ({ data }): Promise<SetRoleAbilitiesResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-permissions/who-has.ts

@@ -12,8 +12,10 @@ import { type WhoHasAbilityResponse, whoHasAbilityCommand } from '@byline/admin/
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const whoHasAbility = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { ability: string }) => input)
   .handler(async ({ data }): Promise<WhoHasAbilityResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-roles/create.ts

@@ -12,6 +12,7 @@ import { type AdminRoleResponse, createAdminRoleCommand } from '@byline/admin/ad
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface CreateAdminRoleInput {
   name: string
@@ -21,6 +22,7 @@ export interface CreateAdminRoleInput {
 }
 
 export const createAdminRole = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: CreateAdminRoleInput) => input)
   .handler(async ({ data }): Promise<AdminRoleResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-roles/delete.ts

@@ -12,12 +12,14 @@ import { deleteAdminRoleCommand } from '@byline/admin/admin-roles'
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 // Return shape mirrors `OkResponse` from `@byline/admin/admin-users`.
 // Lifting the type to a shared spot is a small follow-up — the two
 // modules each declare their own identical `OkResponse` today, and the
 // root `@byline/admin` barrel can only re-export one of them.
 export const deleteAdminRole = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string; vid: number }) => input)
   .handler(async ({ data }): Promise<{ ok: true }> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-roles/get.ts

@@ -12,8 +12,10 @@ import { type AdminRoleResponse, getAdminRoleCommand } from '@byline/admin/admin
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const getAdminRole = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string }) => input)
   .handler(async ({ data }): Promise<AdminRoleResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-roles/list.ts

@@ -12,6 +12,7 @@ import { type AdminRoleListResponse, listAdminRolesCommand } from '@byline/admin
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 /**
  * List admin roles. Thin server-fn wrapper over `listAdminRolesCommand`
@@ -19,9 +20,9 @@ import { bylineCore } from '../../integrations/byline-core.js'
  * No paging or sorting at this layer; the role set is small by design
  * and ordered by the `order` column.
  */
-export const listAdminRoles = createServerFn({ method: 'GET' }).handler(
-  async (): Promise<AdminRoleListResponse> => {
+export const listAdminRoles = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
+  .handler(async (): Promise<AdminRoleListResponse> => {
     const context = await getAdminRequestContext()
     return listAdminRolesCommand(context, {}, { store: bylineCore().adminStore! })
-  }
-)
+  })

package/src/server-fns/admin-roles/reorder.ts

@@ -12,8 +12,10 @@ import { reorderAdminRolesCommand } from '@byline/admin/admin-roles'
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const reorderAdminRoles = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { ids: string[] }) => input)
   .handler(async ({ data }): Promise<{ ok: true }> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-roles/update.ts

@@ -12,6 +12,7 @@ import { type AdminRoleResponse, updateAdminRoleCommand } from '@byline/admin/ad
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface UpdateAdminRoleInput {
   id: string
@@ -24,6 +25,7 @@ export interface UpdateAdminRoleInput {
 }
 
 export const updateAdminRole = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: UpdateAdminRoleInput) => input)
   .handler(async ({ data }): Promise<AdminRoleResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/create.ts

@@ -12,6 +12,7 @@ import { type AdminUserResponse, createAdminUserCommand } from '@byline/admin/ad
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface CreateAdminUserInput {
   email: string
@@ -25,6 +26,7 @@ export interface CreateAdminUserInput {
 }
 
 export const createAdminUser = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: CreateAdminUserInput) => input)
   .handler(async ({ data }): Promise<AdminUserResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/delete.ts

@@ -12,8 +12,10 @@ import { deleteAdminUserCommand, type OkResponse } from '@byline/admin/admin-use
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export const deleteAdminUser = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string; vid: number }) => input)
   .handler(async ({ data }): Promise<OkResponse> => {
     const context = await getAdminRequestContext()

package/src/server-fns/admin-users/disable.ts

@@ -12,11 +12,13 @@ import { disableAdminUserCommand, type OkResponse } from '@byline/admin/admin-us
 import { getAdminRequestContext } from '@byline/client/server'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 // No UI affordance yet — paired with `enable.ts`, both ship ahead of the
 // detail-view enable/disable control they will be wired into. Keep until
 // that control lands; not dead code.
 export const disableAdminUser = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { id: string }) => input)
   .handler(async ({ data }): Promise<OkResponse> => {
     const context = await getAdminRequestContext()