@byline/host-tanstack-start 6.7.2 → 6.8.0

package/src/integrations/session-middleware.ts

@@ -30,78 +30,92 @@ import { sessionRequestKind } from './session-request-kind.js'
 
 const outcomeHeader = 'x-byline-auth-boundary'
 /** The boundary owns the retry signal; handler errors cannot turn into retryable outcomes. */
-export const adminSessionMiddleware = createMiddleware({ type: 'function' })
-  .client(async ({ next }) => {
-    if (typeof window === 'undefined')
-      return next({ sendContext: { bylineExpectedSessionId: null as string | null } })
-    const snapshot = sessionSnapshot()
-    requireUnchanged(snapshot)
-    return next({
-      sendContext: { bylineExpectedSessionId: snapshot.sessionId },
-      fetch: async (input, init) => {
-        // Re-serialize reusable BodyInit values (including FormData/Blob) on retry.
-        // Never clone/tee a Request: an unread branch can buffer an entire upload.
-        const reusable = !(input instanceof Request) && !(init?.body instanceof ReadableStream)
-        let response = await fetch(input, init)
-        if (response.headers.get(outcomeHeader) === 'changed') {
-          flagSessionChanged()
-          throw ERR_SESSION_CHANGED({ message: 'session changed' })
-        }
-        if (response.headers.get(outcomeHeader) === 'renew') {
-          requireUnchanged(snapshot)
-          await renewSingleFlight(() =>
-            coordinateAuthAction(async () => {
-              const result = await renewAdminSession({
-                data: { expectedSessionId: snapshot.sessionId ?? undefined },
-              }).catch((error) => {
-                if (error?.code === 'ERR_SESSION_CHANGED') flagSessionChanged()
-                throw error
+function createAdminSessionMiddleware(coordinateCookies: boolean) {
+  return createMiddleware({ type: 'function' })
+    .client(async ({ next }) => {
+      if (typeof window === 'undefined')
+        return next({ sendContext: { bylineExpectedSessionId: null as string | null } })
+      const snapshot = sessionSnapshot()
+      requireUnchanged(snapshot)
+      return next({
+        sendContext: { bylineExpectedSessionId: snapshot.sessionId },
+        fetch: async (input, init) => {
+          // Re-serialize reusable BodyInit values (including FormData/Blob) on retry.
+          // Never clone/tee a Request: an unread branch can buffer an entire upload.
+          const reusable = !(input instanceof Request) && !(init?.body instanceof ReadableStream)
+          // Queue each cookie-mutating fetch separately. Renewal uses the same queue,
+          // so holding it across the complete middleware would deadlock on expiry.
+          const send = () =>
+            coordinateCookies
+              ? coordinateAuthAction(async () => {
+                  requireUnchanged(snapshot)
+                  return fetch(input, init)
+                })
+              : fetch(input, init)
+          let response = await send()
+          if (response.headers.get(outcomeHeader) === 'changed') {
+            flagSessionChanged()
+            throw ERR_SESSION_CHANGED({ message: 'session changed' })
+          }
+          if (response.headers.get(outcomeHeader) === 'renew') {
+            requireUnchanged(snapshot)
+            await renewSingleFlight(() =>
+              coordinateAuthAction(async () => {
+                const result = await renewAdminSession({
+                  data: { expectedSessionId: snapshot.sessionId ?? undefined },
+                }).catch((error) => {
+                  if (error?.code === 'ERR_SESSION_CHANGED') flagSessionChanged()
+                  throw error
+                })
+                if (snapshot.sessionId && result.sessionId !== snapshot.sessionId) {
+                  flagSessionChanged()
+                  throw ERR_SESSION_CHANGED({ message: 'session changed during renewal' })
+                }
+                observeSession(result.sessionId)
               })
-              if (snapshot.sessionId && result.sessionId !== snapshot.sessionId) {
-                flagSessionChanged()
-                throw ERR_SESSION_CHANGED({ message: 'session changed during renewal' })
-              }
-              observeSession(result.sessionId)
-            })
-          )
+            )
+            requireUnchanged(snapshot)
+            if (!reusable)
+              throw ERR_ACCESS_EXPIRED({ message: 'Session renewed. Please retry the operation.' })
+            response = await send()
+            if (response.headers.get(outcomeHeader) === 'changed') flagSessionChanged()
+          }
           requireUnchanged(snapshot)
-          if (!reusable)
-            throw ERR_ACCESS_EXPIRED({ message: 'Session renewed. Please retry the operation.' })
-          response = await fetch(input, init)
-          if (response.headers.get(outcomeHeader) === 'changed') flagSessionChanged()
-        }
-        requireUnchanged(snapshot)
-        return response
-      },
+          return response
+        },
+      })
+    })
+    .server(async ({ next, context, method }) => {
+      const kind = sessionRequestKind(getRequest())
+      if (!kind) throw new Error('sessionRequestMiddleware is not configured')
+      let auth: Awaited<ReturnType<typeof getAdminRequestContext>>
+      try {
+        auth = await getAdminRequestContext()
+      } catch (error) {
+        if (error instanceof AuthError && error.code === 'ERR_ACCESS_EXPIRED')
+          setResponseHeader(outcomeHeader, 'renew')
+        throw error
+      }
+      const expected = context.bylineExpectedSessionId
+      if ((kind === 'serverFn' || method !== 'GET') && (!expected || expected !== auth.sessionId)) {
+        setResponseHeader(outcomeHeader, 'changed')
+        throw ERR_SESSION_CHANGED({ message: 'session changed before operation' })
+      }
+      if (!auth.sessionId) throw ERR_UNAUTHENTICATED({ message: 'provider omitted login identity' })
+      // Strip the reserved signal after any handler outcome, including exceptions.
+      try {
+        const result = await next()
+        const response = (result as { result?: unknown }).result
+        if (response instanceof Response) response.headers.delete(outcomeHeader)
+        return result
+      } catch (error) {
+        if (error instanceof Response) error.headers.delete(outcomeHeader)
+        throw error
+      } finally {
+        setResponseHeader(outcomeHeader, 'handled')
+      }
     })
-  })
-  .server(async ({ next, context, method }) => {
-    const kind = sessionRequestKind(getRequest())
-    if (!kind) throw new Error('sessionRequestMiddleware is not configured')
-    let auth: Awaited<ReturnType<typeof getAdminRequestContext>>
-    try {
-      auth = await getAdminRequestContext()
-    } catch (error) {
-      if (error instanceof AuthError && error.code === 'ERR_ACCESS_EXPIRED')
-        setResponseHeader(outcomeHeader, 'renew')
-      throw error
-    }
-    const expected = context.bylineExpectedSessionId
-    if ((kind === 'serverFn' || method !== 'GET') && (!expected || expected !== auth.sessionId)) {
-      setResponseHeader(outcomeHeader, 'changed')
-      throw ERR_SESSION_CHANGED({ message: 'session changed before operation' })
-    }
-    if (!auth.sessionId) throw ERR_UNAUTHENTICATED({ message: 'provider omitted login identity' })
-    // Strip the reserved signal after any handler outcome, including exceptions.
-    try {
-      const result = await next()
-      const response = (result as { result?: unknown }).result
-      if (response instanceof Response) response.headers.delete(outcomeHeader)
-      return result
-    } catch (error) {
-      if (error instanceof Response) error.headers.delete(outcomeHeader)
-      throw error
-    } finally {
-      setResponseHeader(outcomeHeader, 'handled')
-    }
-  })
+}
+
+export const adminSessionMiddleware = createAdminSessionMiddleware(false)
+export const adminSessionMutationMiddleware = createAdminSessionMiddleware(true)

package/src/integrations/sign-in-body.test.node.ts

@@ -8,7 +8,14 @@
 
 import { describe, expect, it } from 'vitest'
 
-import { checkSignInBody, SIGN_IN_MAX_BODY_BYTES, wasSignInBodyChecked } from './sign-in-body.js'
+import {
+  checkPasskeyBody,
+  checkSignInBody,
+  PASSKEY_MAX_BODY_BYTES,
+  SIGN_IN_MAX_BODY_BYTES,
+  wasPasskeyBodyChecked,
+  wasSignInBodyChecked,
+} from './sign-in-body.js'
 
 function request(body: BodyInit, headers: Record<string, string> = {}) {
   return new Request('https://app.test/_serverFn/login', {
@@ -57,3 +64,26 @@ describe('sign-in body boundary', () => {
     expect((await checkSignInBody(new Request('https://app.test')))?.status).toBe(405)
   })
 })
+
+describe('passkey envelope limits', () => {
+  it('allows a bounded attestation envelope but keeps password proof at 16 KiB', async () => {
+    const req = request('x'.repeat(20_000))
+    expect(await checkPasskeyBody(req)).toBeUndefined()
+    expect(wasPasskeyBodyChecked(req)).toBe(true)
+    expect(wasPasskeyBodyChecked(req, true)).toBe(false)
+    expect((await checkPasskeyBody(req, true))?.status).toBe(413)
+  })
+  it('rejects actual oversized chunked envelopes and never grants a body marker', async () => {
+    const req = request(
+      new ReadableStream({
+        start(controller) {
+          controller.enqueue(new Uint8Array(PASSKEY_MAX_BODY_BYTES))
+          controller.enqueue(new Uint8Array(1))
+          controller.close()
+        },
+      })
+    )
+    expect((await checkPasskeyBody(req))?.status).toBe(413)
+    expect(wasPasskeyBodyChecked(req)).toBe(false)
+  })
+})

package/src/integrations/sign-in-body.ts

@@ -8,7 +8,9 @@
 
 /** Limit the serialized RPC envelope, not just its eventual credential fields. */
 export const SIGN_IN_MAX_BODY_BYTES = 16 * 1024
+export const PASSKEY_MAX_BODY_BYTES = 64 * 1024
 const checked = new WeakSet<Request>()
+const passkeyChecked = new WeakMap<Request, number>()
 
 export function wasSignInBodyChecked(request: Request): boolean {
   return checked.has(request)
@@ -16,13 +18,36 @@ export function wasSignInBodyChecked(request: Request): boolean {
 
 /** Read a bounded clone before Start parses the original. Never await tee cancellation. */
 export async function checkSignInBody(request: Request): Promise<Response | undefined> {
+  const rejected = await checkBody(request, SIGN_IN_MAX_BODY_BYTES)
+  if (!rejected) checked.add(request)
+  return rejected
+}
+
+export function wasPasskeyBodyChecked(request: Request, passwordProof = false): boolean {
+  return (
+    passkeyChecked.get(request) ===
+    (passwordProof ? SIGN_IN_MAX_BODY_BYTES : PASSKEY_MAX_BODY_BYTES)
+  )
+}
+
+export async function checkPasskeyBody(
+  request: Request,
+  passwordProof = false
+): Promise<Response | undefined> {
+  const limit = passwordProof ? SIGN_IN_MAX_BODY_BYTES : PASSKEY_MAX_BODY_BYTES
+  const rejected = await checkBody(request, limit)
+  if (!rejected) passkeyChecked.set(request, limit)
+  return rejected
+}
+
+async function checkBody(request: Request, limit: number): Promise<Response | undefined> {
   if (request.method !== 'POST')
     return new Response('Method not allowed', { status: 405, headers: { Allow: 'POST' } })
   if (!request.headers.get('content-type')?.toLowerCase().startsWith('application/json')) {
     return new Response('Expected JSON', { status: 415 })
   }
   const declared = request.headers.get('content-length')
-  if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > SIGN_IN_MAX_BODY_BYTES)) {
+  if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > limit)) {
     return new Response('Payload too large', { status: 413 })
   }
   const reader = request.clone().body?.getReader()
@@ -37,9 +62,8 @@ export async function checkSignInBody(request: Request): Promise<Response | unde
       const { value, done } = await Promise.race([reader.read(), deadline])
       if (done) break
       size += value.byteLength
-      if (size > SIGN_IN_MAX_BODY_BYTES) return new Response('Payload too large', { status: 413 })
+      if (size > limit) return new Response('Payload too large', { status: 413 })
     }
-    checked.add(request)
     return undefined
   } catch {
     return new Response('Incomplete request body', { status: 408 })

package/src/integrations/sign-in-middleware.ts

@@ -7,18 +7,51 @@
  */
 
 import { createMiddleware } from '@tanstack/react-start'
+import { setResponseHeader } from '@tanstack/react-start/server'
 
+import {
+  passkeyEnrollment,
+  passkeyEnrollmentOptions,
+  passkeyList,
+  passkeyManagementContext,
+  passkeyPasswordProof,
+  passkeyProof,
+  passkeyProofOptions,
+  passkeyRemove,
+  passkeyRename,
+  passkeySignIn,
+  passkeySignInOptions,
+} from '../server-fns/auth/passkeys.js'
 import { adminSignIn } from '../server-fns/auth/sign-in.js'
-import { checkSignInBody } from './sign-in-body.js'
+import { checkPasskeyBody, checkSignInBody } from './sign-in-body.js'
 
 /** Register after CSRF in Start's global requestMiddleware, before RPC deserialization. */
 export const passwordSignInMiddleware = createMiddleware().server(async (ctx) => {
-  const endpoint = new URL(adminSignIn.url, ctx.request.url).pathname.replace(/\/$/, '')
-  if (
-    ctx.handlerType !== 'serverFn' ||
-    (ctx.pathname !== endpoint && !ctx.pathname.startsWith(`${endpoint}/`))
-  )
-    return ctx.next()
-  const rejected = await checkSignInBody(ctx.request)
-  return rejected ?? ctx.next()
+  if (ctx.handlerType !== 'serverFn') return ctx.next()
+  const matches = (url: string) => {
+    const endpoint = new URL(url, ctx.request.url).pathname.replace(/\/$/, '')
+    return ctx.pathname === endpoint || ctx.pathname.startsWith(`${endpoint}/`)
+  }
+  if (matches(adminSignIn.url)) return (await checkSignInBody(ctx.request)) ?? ctx.next()
+  const passkeys = [
+    passkeyManagementContext,
+    passkeySignInOptions,
+    passkeySignIn,
+    passkeyPasswordProof,
+    passkeyProofOptions,
+    passkeyProof,
+    passkeyEnrollmentOptions,
+    passkeyEnrollment,
+    passkeyList,
+    passkeyRename,
+    passkeyRemove,
+  ]
+  if (!passkeys.some((fn) => matches(fn.url))) return ctx.next()
+  setResponseHeader('Cache-Control', 'no-store')
+  const rejected = await checkPasskeyBody(ctx.request, matches(passkeyPasswordProof.url))
+  if (rejected) {
+    rejected.headers.set('Cache-Control', 'no-store')
+    return rejected
+  }
+  return ctx.next()
 })

package/src/server-fns/auth/passkey-admission.test.node.ts

@@ -0,0 +1,173 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import type {
+  PasskeyProvider,
+  PasskeyRequestProtection,
+  PasswordSignInProtection,
+} from '@byline/auth'
+import { AuthError, AuthErrorCodes } from '@byline/auth'
+import { describe, expect, it, vi } from 'vitest'
+
+import { withPasskeyAdmission } from './passkey-admission.js'
+
+function fixture() {
+  const release = vi.fn()
+  const denial = vi.fn()
+  const work = vi.fn(async () => 'done')
+  const protection: PasskeyRequestProtection = {
+    resolveClientIp: vi.fn(async () => '192.0.2.1'),
+    limiter: {
+      acquire: vi.fn(async () => release),
+      consume: vi.fn(async () => ({ allowed: true, retryAfterSeconds: 0 })),
+    },
+  }
+  const provider = { recordAdmissionDenied: denial } as unknown as PasskeyProvider
+  const input = {
+    provider,
+    purpose: 'sign-in' as const,
+    request: new Request('https://cms.example.test'),
+    bodyChecked: true,
+    protection,
+    work,
+  }
+  return { input, release, denial, work, protection }
+}
+
+describe('passkey host admission', () => {
+  it.each(['middleware', 'protection', 'address', 'capacity', 'counter'] as const)(
+    'fails closed before provider work for %s',
+    async (failure) => {
+      const f = fixture()
+      if (failure === 'middleware') f.input.bodyChecked = false
+      if (failure === 'protection')
+        f.input.protection = undefined as unknown as PasskeyRequestProtection
+      if (failure === 'address') vi.mocked(f.protection.resolveClientIp).mockResolvedValue(null)
+      if (failure === 'capacity') vi.mocked(f.protection.limiter.acquire).mockResolvedValue(null)
+      if (failure === 'counter')
+        vi.mocked(f.protection.limiter.consume).mockRejectedValue(new Error('storage secret'))
+      await expect(withPasskeyAdmission(f.input)).rejects.toMatchObject({
+        status: failure === 'capacity' ? 429 : 503,
+      })
+      expect(f.work).not.toHaveBeenCalled()
+      expect(f.denial).toHaveBeenCalledTimes(1)
+      expect(f.release).toHaveBeenCalledTimes(failure === 'counter' ? 1 : 0)
+    }
+  )
+  it('denies network saturation and releases capacity despite a throwing telemetry hook', async () => {
+    const f = fixture()
+    vi.mocked(f.protection.limiter.consume).mockResolvedValue({
+      allowed: false,
+      retryAfterSeconds: 17,
+    })
+    f.denial.mockImplementation(() => {
+      throw new Error('hook failure')
+    })
+    const error = await withPasskeyAdmission(f.input).catch((error: Response) => error)
+    expect(error).toBeInstanceOf(Response)
+    expect((error as Response).headers.get('Retry-After')).toBe('17')
+    expect((error as Response).headers.get('Cache-Control')).toBe('no-store')
+    expect(f.work).not.toHaveBeenCalled()
+    expect(f.release).toHaveBeenCalledTimes(1)
+  })
+  it('does not double-count provider failures as admission denials', async () => {
+    const f = fixture()
+    f.work.mockRejectedValue(new Error('verification failed'))
+    await expect(withPasskeyAdmission(f.input)).rejects.toThrow('verification failed')
+    expect(f.denial).not.toHaveBeenCalled()
+    expect(f.release).toHaveBeenCalledTimes(1)
+  })
+  it('runs the full password limiter using server-resolved account email and releases both leases', async () => {
+    const f = fixture()
+    const releasePassword = vi.fn()
+    const passwordProtection: PasswordSignInProtection = {
+      resolveClientIp: vi.fn(async () => '192.0.2.1'),
+      limiter: {
+        acquire: vi.fn(async () => releasePassword),
+        consume: vi.fn(async () => ({ allowed: true, retryAfterSeconds: 0 })),
+        recordResult: vi.fn(() => {
+          throw new Error('hook failure')
+        }),
+      },
+    }
+    const resolveActorEmail = vi.fn(async () => 'server-resolved@example.test')
+    const input = {
+      ...f.input,
+      purpose: 'password-proof' as const,
+      password: { protection: passwordProtection, resolveActorEmail },
+    }
+    await expect(withPasskeyAdmission(input)).resolves.toBe('done')
+    expect(passwordProtection.limiter.consume).toHaveBeenCalledWith({
+      email: 'server-resolved@example.test',
+      ip: '192.0.2.1',
+    })
+    expect(passwordProtection.limiter.recordResult).toHaveBeenCalledWith(
+      { email: 'server-resolved@example.test', ip: '192.0.2.1' },
+      'success'
+    )
+    expect(f.protection.limiter.acquire).toHaveBeenCalledBefore(resolveActorEmail)
+    expect(passwordProtection.limiter.acquire).toHaveBeenCalledBefore(
+      passwordProtection.limiter.consume
+    )
+    expect(f.release).toHaveBeenCalledTimes(1)
+    expect(releasePassword).toHaveBeenCalledTimes(1)
+    expect(f.denial).not.toHaveBeenCalled()
+    vi.mocked(passwordProtection.limiter.consume).mockResolvedValue({
+      allowed: false,
+      retryAfterSeconds: 4,
+    })
+    await expect(withPasskeyAdmission(input)).rejects.toMatchObject({ status: 429 })
+    expect(f.work).toHaveBeenCalledTimes(1)
+    expect(f.release).toHaveBeenCalledTimes(2)
+    expect(releasePassword).toHaveBeenCalledTimes(2)
+    expect(f.denial).toHaveBeenCalledExactlyOnceWith('password-proof', 'network')
+  })
+  it.each([
+    AuthErrorCodes.INVALID_CREDENTIALS,
+    AuthErrorCodes.FORBIDDEN,
+    AuthErrorCodes.SESSION_CHANGED,
+    AuthErrorCodes.PASSKEY_LIMIT,
+    AuthErrorCodes.PASSKEY_UNAVAILABLE,
+  ])('accounts for password-proof errors accurately: %s', async (code) => {
+    const f = fixture()
+    const releasePassword = vi.fn()
+    const recordResult = vi.fn()
+    f.work.mockRejectedValue(new AuthError(code, { message: 'Rejected' }))
+    const passwordProtection: PasswordSignInProtection = {
+      resolveClientIp: async () => '192.0.2.1',
+      limiter: {
+        acquire: async () => releasePassword,
+        consume: async () => ({ allowed: true, retryAfterSeconds: 0 }),
+        recordResult,
+      },
+    }
+    await expect(
+      withPasskeyAdmission({
+        ...f.input,
+        purpose: 'password-proof',
+        password: {
+          protection: passwordProtection,
+          resolveActorEmail: async () => 'server@example.test',
+        },
+      })
+    ).rejects.toMatchObject({ code })
+    expect(recordResult).toHaveBeenCalledTimes(code === AuthErrorCodes.INVALID_CREDENTIALS ? 1 : 0)
+    expect(f.denial).not.toHaveBeenCalled()
+    expect(releasePassword).toHaveBeenCalledTimes(1)
+    expect(f.release).toHaveBeenCalledTimes(1)
+  })
+
+  it('cannot use password proof without the full password protection', async () => {
+    const f = fixture()
+    await expect(
+      withPasskeyAdmission({ ...f.input, purpose: 'password-proof' })
+    ).rejects.toMatchObject({ status: 503 })
+    expect(f.work).not.toHaveBeenCalled()
+    expect(f.release).toHaveBeenCalledTimes(1)
+  })
+})

package/src/server-fns/auth/passkey-admission.ts

@@ -0,0 +1,125 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import type {
+  PasskeyAdmissionReason,
+  PasskeyOperation,
+  PasskeyProvider,
+  PasskeyRequestProtection,
+  PasswordSignInProtection,
+} from '@byline/auth'
+import { AuthError, AuthErrorCodes } from '@byline/auth'
+
+import { normalizeClientIp } from '../../integrations/client-ip.js'
+
+/** Host boundary shared by the passkey POST handlers. Body and CSRF guards run first. */
+export async function withPasskeyAdmission<T>(input: {
+  provider: PasskeyProvider
+  purpose: PasskeyOperation
+  request: Request
+  bodyChecked: boolean
+  protection: PasskeyRequestProtection | undefined
+  /** Required only for password proof; lookup must authenticate the expected login. */
+  password?: {
+    protection: PasswordSignInProtection | undefined
+    resolveActorEmail(): Promise<string>
+  }
+  work(metadata: { ip: string }): Promise<T>
+}): Promise<T> {
+  const recordDenial = (reason: PasskeyAdmissionReason) => {
+    try {
+      void Promise.resolve(input.provider.recordAdmissionDenied?.(input.purpose, reason)).catch(
+        () => {}
+      )
+    } catch {
+      /* Observability cannot change admission or strand capacity. */
+    }
+  }
+  const denied = (reason: PasskeyAdmissionReason, status: number, retry?: number): never => {
+    recordDenial(reason)
+    throw new Response(
+      status === 429
+        ? 'Too many authentication requests'
+        : 'Authentication temporarily unavailable',
+      {
+        status,
+        headers: {
+          'Cache-Control': 'no-store',
+          ...(retry ? { 'Retry-After': String(retry) } : {}),
+        },
+      }
+    )
+  }
+  const available = async <R>(work: () => Promise<R>): Promise<R> => {
+    try {
+      return await work()
+    } catch {
+      return denied('unavailable', 503)
+    }
+  }
+  const protection = input.protection
+  if (!input.bodyChecked || !protection) return denied('unavailable', 503)
+  const ip = await available(async () =>
+    normalizeClientIp(await protection.resolveClientIp(input.request))
+  )
+  if (!ip) return denied('unavailable', 503)
+  const release = await available(() => protection.limiter.acquire())
+  if (!release) return denied('capacity', 429, 1)
+  try {
+    const admission = await available(() => protection.limiter.consume({ ip }))
+    if (!admission.allowed) return denied('network', 429, admission.retryAfterSeconds)
+    if (input.purpose === 'password-proof' && !input.password) return denied('unavailable', 503)
+    if (!input.password) return await input.work({ ip })
+    const password = input.password
+    const passwordProtection = password.protection
+    if (!passwordProtection) return denied('unavailable', 503)
+    // Resolve the account from the authenticated expected login, never from submitted email.
+    let email: string
+    try {
+      email = await password.resolveActorEmail()
+    } catch (error) {
+      recordDenial('unavailable')
+      throw error
+    }
+    const passwordIp = await available(async () =>
+      normalizeClientIp(await passwordProtection.resolveClientIp(input.request))
+    )
+    if (!passwordIp) return denied('unavailable', 503)
+    const releasePassword = await available(() => passwordProtection.limiter.acquire())
+    if (!releasePassword) return denied('capacity', 429, 1)
+    try {
+      const passwordAdmission = await available(() =>
+        passwordProtection.limiter.consume({ email, ip: passwordIp })
+      )
+      if (!passwordAdmission.allowed)
+        return denied('network', 429, passwordAdmission.retryAfterSeconds)
+      const record = (outcome: 'success' | 'failure') => {
+        try {
+          void Promise.resolve(
+            passwordProtection.limiter.recordResult?.({ email, ip: passwordIp }, outcome)
+          ).catch(() => {})
+        } catch {
+          /* Best effort. */
+        }
+      }
+      try {
+        const result = await input.work({ ip })
+        record('success')
+        return result
+      } catch (error) {
+        if (error instanceof AuthError && error.code === AuthErrorCodes.INVALID_CREDENTIALS)
+          record('failure')
+        throw error
+      }
+    } finally {
+      releasePassword()
+    }
+  } finally {
+    release()
+  }
+}