@c9up/station 0.1.14 → 0.1.16

package/src/StationProvider.ts

@@ -26,10 +26,29 @@ import type {
 	DatabaseConnection,
 	DateColumnConfig,
 } from "@c9up/atlas";
+import {
+	editableColumns,
+	isFrameworkManaged,
+	isSecretColumn,
+	viewColumns,
+	writeOnlyKeys,
+} from "./columns.js";
+import {
+	loginKeys,
+	MemoryLoginLimiter,
+	type StationLoginLimiter,
+	type StationLoginRateLimitConfig,
+} from "./loginLimiter.js";
 import { ResourceRegistry } from "./ResourceRegistry.js";
 import { clearStation, getStation, setStation } from "./services/main.js";
-import type { AuditEvent, Resource, ResourceAction } from "./types.js";
-import { inProduction } from "./vendor/nodeEnv.js";
+import type {
+	AuditEvent,
+	Resource,
+	ResourceAction,
+	SecurityAuditEvent,
+	SecurityAuditSink,
+} from "./types.js";
+import { inProduction, normalizeNodeEnv } from "./vendor/nodeEnv.js";
 // note: AuditEvent + ResourceAction are used by the CRUD handlers below;
 // the imports stay in one block for clarity.
 import { buildFormViewModel } from "./views/form.js";
@@ -69,9 +88,18 @@ interface StationHttpContext {
 	request: {
 		qs(): Record<string, string | undefined>;
 		body?(): Promise<unknown> | unknown;
-		url?(): string;
 		header?(name: string): string | undefined;
 		cookie?(name: string): string | undefined;
+		/** The request path (ream's `url()` without the query string). */
+		url?(): string;
+		/** `X-Request-Id`, when the proxy or client set one (AdonisJS `id`). */
+		id?(): string | undefined;
+		/** `:authority` or `Host` — never a forwarded host (AdonisJS `authority`). */
+		authority?(): string | null;
+		/** Client IP as the host resolved it (trusted-proxy aware in ream). */
+		ip?(): string;
+		/** Whether the request came over HTTPS (trusted-proxy aware in ream). */
+		secure?(): boolean;
 		/**
 		 * `true` only when the host's `@c9up/blackhole` middleware enforced +
 		 * validated CSRF for this request (a first-class ream `HttpContext`
@@ -200,7 +228,18 @@ interface StationPaginator {
 /** Per-resource snapshot built once at `start()`, reused on every request. */
 interface ResourceContext {
 	repo: StationRepository;
+	/** Every column — audit snapshots read these (secrets redacted there). */
 	columns: ReadonlyArray<ColumnMetadata>;
+	/** What the list page renders (bug 209: secrets excluded by default). */
+	listColumns: ReadonlyArray<ColumnMetadata>;
+	/** What the show page renders. */
+	showColumns: ReadonlyArray<ColumnMetadata>;
+	/** The editable allow-list — the form's fields and the schema's keys. */
+	formColumns: ReadonlyArray<ColumnMetadata>;
+	/** Editable columns never pre-filled; an empty submission keeps them. */
+	writeOnly: ReadonlySet<string>;
+	/** Columns whose values audit snapshots replace with "[redacted]". */
+	redacted: ReadonlySet<string>;
 	pkColumn: string;
 	/**
 	 * Property keys of framework-managed timestamp columns — those declared
@@ -220,6 +259,8 @@ interface ResourceContext {
 	 * unchecked box submits nothing).
 	 */
 	writableSchema?: RuneSchema;
+	/** Same keys, write-only columns optional: an edit may leave them as stored. */
+	updateSchema?: RuneSchema;
 	booleanKeys: ReadonlySet<string>;
 }
 
@@ -419,6 +460,12 @@ interface WardenAuthManager {
 		role: string,
 		scope?: StationScope,
 	): Promise<boolean>;
+	/**
+	 * The guard `verify(token)` uses when no name is given (warden's
+	 * `getStrategy()`). Logout calls its `revoke(token)` when it has one —
+	 * JwtStrategy does, backed by its jti blacklist.
+	 */
+	getStrategy?(name?: string): unknown;
 }
 
 /**
@@ -435,11 +482,23 @@ export interface StationConfig {
 	 */
 	requireAuth?: boolean;
 	/**
-	 * Role required to pass the auth gate. When omitted, any
-	 * authenticated user can access `/admin/*` (the per-action
-	 * `<resource>.<action>` permission gate still applies).
+	 * Role required to pass the auth gate, on top of {@link accessPermission}.
 	 */
 	requireRole?: string;
+	/**
+	 * Namespace of every admin permission: actions are gated behind
+	 * `<prefix>.<resource>.<action>` (e.g. `station.users.edit`) and entry
+	 * behind `<prefix>.access`. Defaults to `"station"`, so a grant the
+	 * application made for its own features (`users.edit`) never opens the
+	 * admin.
+	 */
+	permissionPrefix?: string;
+	/**
+	 * Permission every request must hold to enter `/admin/*`, checked before
+	 * the per-action one. Defaults to `<permissionPrefix>.access`. `false`
+	 * removes this gate (the per-action permissions still apply).
+	 */
+	accessPermission?: string | false;
 	/**
 	 * Where to redirect on a failed auth check. Defaults to
 	 * `/admin/login`.
@@ -450,9 +509,38 @@ export interface StationConfig {
 	 * to avoid colliding with app-level session cookies.
 	 */
 	cookieName?: string;
+	/**
+	 * `Secure` flag of the auth cookie. Defaults to on everywhere except a
+	 * development/test process served over plain HTTP, so an unknown
+	 * environment behaves like production.
+	 */
+	cookieSecure?: boolean;
+	/**
+	 * Brute-force throttle on `POST /admin/login`: 5 attempts per IP and per
+	 * identifier every 15 minutes by default, in this process's memory. Pass
+	 * `limiter` (warden's `AuthRateLimiter` fits) to share counts across
+	 * instances. `false` turns it off — only for an app that throttles the
+	 * route itself (see {@link middleware}).
+	 */
+	loginRateLimit?: StationLoginRateLimitConfig | false;
+	/** Named router middleware attached to every route Station mounts. */
+	middleware?: ReadonlyArray<string>;
+	/**
+	 * Sink for the admin's security events: sign-in success, failure and
+	 * throttling, logout, authorization denials and CSRF blocks, each with the
+	 * client IP and request id. Write events keep going to each resource's
+	 * own `audit`.
+	 */
+	audit?: SecurityAuditSink;
 }
 
 const MAX_PER_PAGE = 100;
+const DEFAULT_PERMISSION_PREFIX = "station";
+/**
+ * The auth cookie travels only to the admin: scoped to `/`, the admin bearer
+ * token rode along with every request to the rest of the application.
+ */
+const AUTH_COOKIE_PATH = "/admin";
 const DEFAULT_PER_PAGE = 25;
 const POSITIVE_INT_RE = /^[1-9][0-9]*$/;
 
@@ -462,6 +550,7 @@ let perPageClampWarned = false;
 let seedPermsWarned = false;
 let missingAuditWarned = false;
 let csrfBlockedWarned = false;
+let revokeUnavailableWarned = false;
 
 /** @internal Reset module-level flags between tests. */
 export function resetStationProviderFlags(): void {
@@ -470,6 +559,7 @@ export function resetStationProviderFlags(): void {
 	seedPermsWarned = false;
 	missingAuditWarned = false;
 	csrfBlockedWarned = false;
+	revokeUnavailableWarned = false;
 }
 
 /**
@@ -491,17 +581,6 @@ function notFoundFailFingerprint(cause: unknown): string {
  */
 const NOT_FOUND_RENDER_FAIL_CAP = 32;
 
-const TIMESTAMP_PROPERTY_KEYS: ReadonlySet<string> = new Set([
-	"createdAt",
-	"updatedAt",
-	"deletedAt",
-]);
-const TIMESTAMP_COLUMN_NAMES: ReadonlySet<string> = new Set([
-	"created_at",
-	"updated_at",
-	"deleted_at",
-]);
-
 /**
  * Column `type` strings mapped to a numeric rune rule (mirrors form.ts input
  * inference). `bigint` is deliberately EXCLUDED: coercing it through `Number()`
@@ -537,9 +616,9 @@ export function resourcesNeedValidation(
  * Derive a `@c9up/rune` validation schema (57.7) from an entity's writable
  * column metadata — the structural replacement for the hand-rolled
  * `filterWritableBody`. The mass-assignment guarantee is now INHERENT:
- * `schema.validateResult()` returns only declared-column keys, so unknown body keys
- * (`role`, `passwordHash`, PK, timestamps) are dropped automatically — no
- * explicit filtering pass.
+ * `schema.validateResult()` returns only the keys of the editable columns it
+ * was given, so any other body key — an unknown one, a column outside the
+ * allow-list, the PK, a timestamp — is dropped automatically.
  *
  * Excluded, exactly as the old guard did: the primary key, framework-managed
  * timestamps (both the Lucid-style `autoManaged` flag AND the `created_at /
@@ -560,7 +639,9 @@ export function resourcesNeedValidation(
  * Returns the built schema plus the set of boolean columns — the handler
  * default-fills an ABSENT boolean key to `false` before validating (an
  * unchecked checkbox submits nothing; this preserves the old edit-clears-box
- * behaviour).
+ * behaviour). `columns` is the editable allow-list; framework-owned columns
+ * are dropped here too, so no caller can make them writable. `updateSchema`
+ * differs only for `writeOnly` columns, which an edit may leave out.
  */
 export function deriveWritableSchema(
 	columns: ReadonlyArray<ColumnMetadata>,
@@ -568,41 +649,65 @@ export function deriveWritableSchema(
 	autoManaged: ReadonlySet<string>,
 	excludedProps: ReadonlySet<string>,
 	rune: RuneModule,
-): { schema: RuneSchema; booleanKeys: ReadonlySet<string> } {
+	writeOnly: ReadonlySet<string> = new Set(),
+): {
+	schema: RuneSchema;
+	updateSchema: RuneSchema;
+	booleanKeys: ReadonlySet<string>;
+} {
 	const fields: Record<string, RuneRuleChain> = {};
+	const updateFields: Record<string, RuneRuleChain> = {};
 	const booleanKeys = new Set<string>();
 	for (const c of columns) {
-		if (c.propertyKey === pkColumn) continue;
-		if (autoManaged.has(c.propertyKey)) continue;
-		if (TIMESTAMP_PROPERTY_KEYS.has(c.propertyKey)) continue;
-		const snake = c.propertyKey.replace(/([A-Z])/g, "_$1").toLowerCase();
-		if (TIMESTAMP_COLUMN_NAMES.has(snake)) continue;
-		if (excludedProps.has(c.propertyKey)) continue;
+		if (isFrameworkManaged(c, pkColumn, autoManaged, excludedProps)) continue;
 		const type = (c.type ?? "").toString().toLowerCase();
 		if (type === "boolean") {
 			// Checkbox: the handler pre-fills an absent key to `false`, so every
 			// boolean is always present here → required, no `.optional()`.
 			booleanKeys.add(c.propertyKey);
 			fields[c.propertyKey] = rune.rules.boolean().parse(isCheckedValue);
+			updateFields[c.propertyKey] = rune.rules.boolean().parse(isCheckedValue);
 			continue;
 		}
-		// A column is required iff the model declares neither nullability nor a
-		// default. DB-side defaults (serial, `DEFAULT`) are invisible to metadata
-		// (documented residual limitation — see story Dev Notes); the PK, the
-		// common serial case, is already excluded above.
-		const required = c.nullable !== true && c.default === undefined;
-		let chain: RuneRuleChain = NUMBER_COLUMN_TYPES.has(type)
-			? rune.rules.number().parse(parseNumeric)
-			: JSON_COLUMN_TYPES.has(type)
-				? rune.rules.any()
-				: rune.rules.string();
-		if (!required) {
-			chain = chain.optional();
-			if (c.nullable === true) chain = chain.nullable();
-		}
-		fields[c.propertyKey] = chain;
+		fields[c.propertyKey] = columnChain(c, type, rune, false);
+		updateFields[c.propertyKey] = columnChain(
+			c,
+			type,
+			rune,
+			writeOnly.has(c.propertyKey),
+		);
+	}
+	return {
+		schema: rune.schema(fields),
+		updateSchema: rune.schema(updateFields),
+		booleanKeys,
+	};
+}
+
+/**
+ * The rule for one non-boolean column. A column is required iff the model
+ * declares neither nullability nor a default — unless `keepable`: an edit may
+ * omit a write-only column to keep its stored value. DB-side defaults
+ * (serial, `DEFAULT`) are invisible to metadata (documented residual
+ * limitation); the PK, the common serial case, is never editable.
+ */
+function columnChain(
+	c: ColumnMetadata,
+	type: string,
+	rune: RuneModule,
+	keepable: boolean,
+): RuneRuleChain {
+	const required = !keepable && c.nullable !== true && c.default === undefined;
+	let chain: RuneRuleChain = NUMBER_COLUMN_TYPES.has(type)
+		? rune.rules.number().parse(parseNumeric)
+		: JSON_COLUMN_TYPES.has(type)
+			? rune.rules.any()
+			: rune.rules.string();
+	if (!required) {
+		chain = chain.optional();
+		if (c.nullable === true) chain = chain.nullable();
 	}
-	return { schema: rune.schema(fields), booleanKeys };
+	return chain;
 }
 
 /**
@@ -611,14 +716,19 @@ export function deriveWritableSchema(
  * preserving the old `filterWritableBody` checkbox semantics, then runs rune's
  * synchronous, never-throwing `validateResult()`. On success `result.data` holds only
  * declared-column keys (mass-assignment inherent). Exported for the unit tests
- * that pin the coercion CRUX.
+ * that pin the coercion CRUX. A blank `writeOnly` value counts as not
+ * submitted: the form never pre-fills those, so blank means "unchanged".
  */
 export function validateWritableBody(
 	schema: RuneSchema,
 	booleanKeys: ReadonlySet<string>,
 	body: Record<string, unknown>,
+	writeOnly: ReadonlySet<string> = new Set(),
 ): RuneValidationResult {
 	const input: Record<string, unknown> = { ...body };
+	for (const key of writeOnly) {
+		if (input[key] === "") delete input[key];
+	}
 	for (const key of booleanKeys) {
 		if (!(key in input)) input[key] = false;
 	}
@@ -668,9 +778,6 @@ function fieldErrors(
 /** Session flash key under which the per-field validation errors are stashed (AdonisJS `flashMessages.errors` parity). */
 const FLASH_ERRORS_KEY = "errors";
 
-/** Column propertyKeys whose values are secrets — never flashed to the session nor echoed back into HTML (AdonisJS parity). */
-const SENSITIVE_KEY_RE = /password|passwd|secret|token|apikey/i;
-
 /**
  * The subset of a submitted body safe to re-surface on a validation error:
  * declared columns only — so `_csrf`, `_method`, and any mass-assignment /
@@ -684,7 +791,7 @@ function flashableInput(
 ): Record<string, unknown> {
 	const out: Record<string, unknown> = {};
 	for (const c of columns) {
-		if (SENSITIVE_KEY_RE.test(c.propertyKey)) continue;
+		if (isSecretColumn(c)) continue;
 		if (c.propertyKey in submitted)
 			out[c.propertyKey] = submitted[c.propertyKey];
 	}
@@ -730,44 +837,50 @@ function readFlash(
 }
 
 /**
- * Same-origin / relative check for a `Referer` — replicates ream's
- * `RedirectBuilder.back()` open-redirect guard (Station consumes the response
- * through its own `redirect(url)` seam and can't reach ream's builder). A
- * relative path is trusted; an absolute URL only when its origin matches the
- * request URL. Anything else is untrusted → the caller uses its safe fallback.
+ * The path a `Referer` points back to, when it may be trusted — AdonisJS's
+ * `isValidRedirectUrl` + `redirect().back()`: a relative path is trusted, an
+ * absolute URL only when its host is the request's own authority (`Host` /
+ * `:authority`, never a forwarded host), and the redirect goes to the path
+ * alone. Comparing with `request.url()` could never work: in ream that is
+ * the path, while a browser's Referer is a full URL. Deliberately stricter
+ * than upstream in one place: with no authority to compare against, an
+ * absolute Referer is refused rather than accepted.
  */
-function isSameOriginReferer(referer: string, requestUrl?: string): boolean {
+function trustedRefererPath(
+	referer: string,
+	authority: string | null | undefined,
+): string | undefined {
 	// A relative path is trusted only when it starts with a single "/" and
 	// contains no backslash: browsers normalise "\\" to "/", so "/\\evil.com"
 	// becomes the protocol-relative "//evil.com" that a lone `!startsWith("//")`
 	// check would let through.
-	if (
-		referer.startsWith("/") &&
-		!referer.startsWith("//") &&
-		!referer.includes("\\")
-	) {
-		return true;
-	}
-	if (requestUrl === undefined) return false;
+	if (referer.startsWith("//") || referer.includes("\\")) return undefined;
 	try {
-		return new URL(referer).origin === new URL(requestUrl).origin;
+		if (referer.startsWith("/")) {
+			const url = new URL(referer, "http://localhost");
+			return url.host === "localhost" ? url.pathname : undefined;
+		}
+		if (authority === null || authority === undefined || authority === "") {
+			return undefined;
+		}
+		const url = new URL(referer);
+		return url.host === authority ? url.pathname : undefined;
 	} catch {
-		return false;
+		return undefined;
 	}
 }
 
 /**
- * `redirect().back()` over Station's `redirect(url)` seam (57.7): prefer a
- * trusted same-origin `Referer`, else the caller's `fallback` (the form URL) —
- * the same behaviour as ream's `RedirectBuilder.back(fallback)`, open-redirect
- * safe.
+ * `redirect().back()` over Station's `redirect(url)` seam (57.7): the path of a
+ * trusted `Referer`, else the caller's `fallback` (the form URL).
  */
 function redirectBack(ctx: StationHttpContext, fallback: string): void {
 	const referer = ctx.request.header?.("referer");
+	const authority =
+		ctx.request.authority?.() ?? ctx.request.header?.("host") ?? undefined;
 	const target =
-		typeof referer === "string" &&
-		isSameOriginReferer(referer, ctx.request.url?.())
-			? referer
+		typeof referer === "string"
+			? (trustedRefererPath(referer, authority) ?? fallback)
 			: fallback;
 	ctx.response.redirect(target);
 }
@@ -796,9 +909,14 @@ function isCheckedValue(value: unknown): boolean {
 function snapshotEntity(
 	entity: Record<string, unknown>,
 	columns: ReadonlyArray<ColumnMetadata>,
+	redacted: ReadonlySet<string>,
 ): Record<string, unknown> {
 	const out: Record<string, unknown> = {};
-	for (const c of columns) out[c.propertyKey] = entity[c.propertyKey];
+	for (const c of columns) {
+		out[c.propertyKey] = redacted.has(c.propertyKey)
+			? REDACTED
+			: entity[c.propertyKey];
+	}
 	try {
 		return structuredClone(out);
 	} catch (err) {
@@ -826,6 +944,21 @@ function snapshotEntity(
 }
 let auditCloneWarnEmitted = false;
 
+/** What an audit snapshot holds in place of a secret column's value. */
+const REDACTED = "[redacted]";
+
+/**
+ * The redacted columns an edit changed — read from the raw values, so the
+ * audit trail says "password changed" without carrying either hash.
+ */
+function changedRedacted(
+	before: Readonly<Record<string, unknown>>,
+	entity: Readonly<Record<string, unknown>>,
+	redacted: ReadonlySet<string>,
+): string[] {
+	return [...redacted].filter((key) => !Object.is(before[key], entity[key]));
+}
+
 /**
  * Filesystem path to the `.inker` templates Station ships inside the
  * package (57.1, D3). Resolved from `import.meta.url` so the SAME path
@@ -851,14 +984,21 @@ export default class StationProvider {
 	// 54.7 auth state — populated when warden is wired AND
 	// StationConfig.requireAuth is true (default when warden is present).
 	#authManager: WardenAuthManager | undefined;
+	#loginLimiter: StationLoginLimiter | undefined;
+	#cookieSecure: boolean | undefined;
+	#securityAudit: SecurityAuditSink | undefined;
 	#authConfig: Required<Pick<StationConfig, "loginPath" | "cookieName">> & {
 		requireAuth: boolean;
 		requireRole: string | undefined;
+		permissionPrefix: string;
+		accessPermission: string | undefined;
 	} = {
 		requireAuth: false,
 		requireRole: undefined,
 		loginPath: "/admin/login",
 		cookieName: "station_auth",
+		permissionPrefix: DEFAULT_PERMISSION_PREFIX,
+		accessPermission: undefined,
 	};
 
 	constructor(protected app: StationAppContext) {}
@@ -905,7 +1045,17 @@ export default class StationProvider {
 		// peer is a degraded-host signal: #loadPeers returns null → silent stop.
 		const peers = await this.#loadPeers();
 		if (!peers) return;
-		const { router, atlas, rune } = peers;
+		const { atlas, rune } = peers;
+		const router = withRouteMiddleware(peers.router, userConfig.middleware);
+		this.#loginLimiter = buildLoginLimiter(userConfig.loginRateLimit);
+		this.#cookieSecure = userConfig.cookieSecure;
+		if (
+			userConfig.audit !== undefined &&
+			typeof userConfig.audit !== "function"
+		) {
+			throw new TypeError("[station] `station.audit` must be a function");
+		}
+		this.#securityAudit = userConfig.audit;
 
 		// Phase 1a2 — resolve the SHARED inker renderer (AdonisJS/Edge parity)
 		// and mount Station's package templates as the `station` disk. Unlike
@@ -1181,6 +1331,13 @@ export default class StationProvider {
 	 * not installed/bound the gate stays open and a one-time warning is emitted.
 	 */
 	async #configureAuth(userConfig: StationConfig): Promise<void> {
+		const permissionPrefix =
+			userConfig.permissionPrefix ?? DEFAULT_PERMISSION_PREFIX;
+		if (typeof permissionPrefix !== "string" || permissionPrefix === "") {
+			throw new Error(
+				"[station] `station.permissionPrefix` must be a non-empty string: admin permissions need their own namespace.",
+			);
+		}
 		const wardenWanted = userConfig.requireAuth !== false;
 		if (wardenWanted) {
 			try {
@@ -1191,6 +1348,11 @@ export default class StationProvider {
 					requireRole: userConfig.requireRole,
 					loginPath: userConfig.loginPath ?? "/admin/login",
 					cookieName: userConfig.cookieName ?? "station_auth",
+					permissionPrefix,
+					accessPermission:
+						userConfig.accessPermission === false
+							? undefined
+							: (userConfig.accessPermission ?? `${permissionPrefix}.access`),
 				};
 			} catch (cause) {
 				// Container has no working `auth` binding → warden not wired.
@@ -1211,15 +1373,23 @@ export default class StationProvider {
 
 		// An admin panel with no auth is full CRUD on every registered resource
 		// for anyone who can reach the route. That is a different product, and
-		// in production it has to be asked for rather than fallen into — the
-		// same bet bay makes about losing a job on a Redis without LMOVE.
+		// it has to be asked for rather than fallen into — the same bet bay
+		// makes about losing a job on a Redis without LMOVE.
 		//
 		// `requireAuth: false` written down IS the asking. Defaulted (undefined)
-		// is not: it means nobody decided, and nobody deciding must not be how
-		// an unauthenticated admin reaches production.
-		if (inProduction() && userConfig.requireAuth !== false) {
+		// is not: it means nobody decided, and nobody deciding is only tolerated
+		// on a machine positively named development or test. An unset NODE_ENV,
+		// `staging`, `preview`… fail closed like production: they are exactly
+		// the boxes nobody configured, and staging often holds a copy of
+		// production data (ream's `Application.inDev` takes the same stance).
+		const env = normalizeNodeEnv(process.env.NODE_ENV);
+		const devOrTest = env === "development" || env === "test";
+		if (!devOrTest && userConfig.requireAuth !== false) {
+			const where = inProduction()
+				? "production"
+				: `a non-development environment (NODE_ENV=${process.env.NODE_ENV === undefined ? "unset" : JSON.stringify(process.env.NODE_ENV)})`;
 			throw new Error(
-				"[station] Admin routes would mount with NO authorisation in production: " +
+				`[station] Admin routes would mount with NO authorisation in ${where}: ` +
 					"no working `auth` binding is registered, so every `/admin/*` route — " +
 					"including create, update and delete — is open to anyone who can reach it.\n" +
 					"  Wire @c9up/warden's WardenProvider, or set `station.requireAuth: false` " +
@@ -1232,11 +1402,13 @@ export default class StationProvider {
 		// Said even when the deployment opted in: agreeing once in a config file
 		// is not the same as being reminded that this process is running that
 		// way. The line has to be in the logs of the incident.
-		const optedIn = inProduction() && userConfig.requireAuth === false;
+		const optedIn = !devOrTest && userConfig.requireAuth === false;
+		const envName =
+			env === "unknown" ? "AN UNCONFIGURED ENVIRONMENT" : env.toUpperCase();
 		console.warn(
-			"[station] Admin routes mounted without auth. Wire @c9up/warden (and set `station.requireAuth: true` if you opted out) and seed the per-action `<resource>.<action>` permissions in the Warden rights store BEFORE production. See https://ream.dev/modules/station#auth." +
+			"[station] Admin routes mounted without auth. Wire @c9up/warden (and set `station.requireAuth: true` if you opted out) and seed the per-action admin permissions in the Warden rights store BEFORE production. See https://ream.dev/modules/station#auth." +
 				(optedIn
-					? "\n  Running this way in PRODUCTION because `station.requireAuth: false` was set."
+					? `\n  Running this way in ${envName} because \`station.requireAuth: false\` was set.`
 					: ""),
 		);
 	}
@@ -1315,12 +1487,6 @@ export default class StationProvider {
 					`/admin/${slug}/:id`,
 					gate(this.#buildUpdateHandler(resource)),
 				);
-				// Browser forms can't issue PUT — accept POST with `_method=PUT`
-				// from the auto-generated form (form.ts stamps the hidden input).
-				router.post(
-					`/admin/${slug}/:id`,
-					gate(this.#buildMethodOverrideHandler(resource)),
-				);
 			}
 			if (resource.actions.includes("destroy")) {
 				router.delete(
@@ -1328,12 +1494,24 @@ export default class StationProvider {
 					gate(this.#buildDestroyHandler(resource)),
 				);
 			}
+			// Browser forms can't issue PUT/DELETE — accept POST with `_method`
+			// from the auto-generated form (form.ts stamps the hidden input),
+			// dispatching only to the actions this resource enables.
+			if (
+				resource.actions.includes("edit") ||
+				resource.actions.includes("destroy")
+			) {
+				router.post(
+					`/admin/${slug}/:id`,
+					gate(this.#buildMethodOverrideHandler(resource)),
+				);
+			}
 		}
 	}
 
 	/**
 	 * 56.5 — every admin action is now gated behind a
-	 * `<resource>.<action>` permission resolved through @c9up/warden
+	 * `<prefix>.<resource>.<action>` permission resolved through @c9up/warden
 	 * (`auth.hasPermission`). Warn ONCE at boot, only when the auth layer
 	 * is wired, that the host must seed roles/grants in the Warden rights
 	 * store — otherwise every admin request 403s with no hint. The old
@@ -1348,8 +1526,15 @@ export default class StationProvider {
 		seedPermsWarned = true;
 		const [example] = resources;
 		if (example === undefined) return;
+		const prefix = this.#authConfig.permissionPrefix;
+		const access = this.#authConfig.accessPermission;
+		const perms = [
+			...(access === undefined ? [] : [access]),
+			`${prefix}.${example.name}.list`,
+			`${prefix}.${example.name}.create`,
+		];
 		console.warn(
-			`[station] Admin actions are gated behind '<resource>.<action>' permissions resolved through @c9up/warden (e.g. '${example.name}.list', '${example.name}.create'). Seed roles/grants in the Warden rights store (store.defineRole('admin', ['${example.name}.list', '${example.name}.create', ...]) then assignRole) or every admin request will 403. See https://ream.dev/modules/station#authorization.`,
+			`[station] Admin actions are gated behind '${prefix}.<resource>.<action>' permissions resolved through @c9up/warden${access === undefined ? "" : `, and entering the admin behind '${access}'`}. Seed roles/grants in the Warden rights store (store.defineRole('admin', [${perms.map((p) => `'${p}'`).join(", ")}, ...]) then assignRole) or every admin request will 403. See https://ream.dev/modules/station#authorization.`,
 		);
 	}
 
@@ -1398,8 +1583,13 @@ export default class StationProvider {
 	 * `@c9up/rune` — so an undefined here is an internal invariant break; throw
 	 * loud (fail-closed) rather than silently accept an unvalidated body.
 	 */
-	#requireWritableSchema(resource: Resource): RuneSchema {
-		const { writableSchema } = this.#requireContext(resource);
+	#requireWritableSchema(
+		resource: Resource,
+		mode: "create" | "update",
+	): RuneSchema {
+		const context = this.#requireContext(resource);
+		const writableSchema =
+			mode === "create" ? context.writableSchema : context.updateSchema;
 		if (writableSchema === undefined) {
 			throw new Error(
 				`[station] No validation schema for ${resource.entity.name} — @c9up/rune must be installed to accept admin writes.`,
@@ -1449,8 +1639,8 @@ export default class StationProvider {
 		// Echo only declared, non-sensitive columns back to the form — never
 		// `_csrf`, secrets, or mass-assignment keys (both the flash store and the
 		// re-rendered HTML). An empty result falls back to `row`.
-		const { columns, pkColumn } = this.#requireContext(resource);
-		const safe = flashableInput(submitted, columns);
+		const { formColumns, pkColumn, writeOnly } = this.#requireContext(resource);
+		const safe = flashableInput(submitted, formColumns);
 		if (ctx.session !== undefined) {
 			// AdonisJS PRG: flash old input + errors, redirect back to the form.
 			ctx.session.flashAll(safe);
@@ -1462,8 +1652,9 @@ export default class StationProvider {
 		// submitted values + errors are still shown rather than silently dropped.
 		const vm = buildFormViewModel({
 			resource,
-			columns,
+			columns: formColumns,
 			pkColumn,
+			writeOnly,
 			row,
 			values: Object.keys(safe).length > 0 ? safe : undefined,
 			errors: fieldErrors(errors),
@@ -1479,15 +1670,12 @@ export default class StationProvider {
 		resource: Resource,
 	): (ctx: StationHttpContext) => Promise<void> {
 		return async (ctx) => {
-			const { repo, columns, pkColumn } = this.#requireContext(resource);
+			const { repo, listColumns, pkColumn } = this.#requireContext(resource);
 			// 56.5: the list action is gated behind `<resource>.list` like
 			// every other action — resolved through the Warden `"auth"`
 			// layer. (Retro 2026-06-01: list previously skipped the gate
 			// entirely, leaking the index regardless of authorization.)
-			if (!(await authorizeAction(resource, "list", ctx, this.#authManager))) {
-				deny(ctx);
-				return;
-			}
+			if (!(await this.#authorize(ctx, resource, "list"))) return;
 			const qs = ctx.request.qs();
 			const page = clampPositiveInt(qs.page, 1);
 			const perPageRaw = clampPositiveInt(qs.perPage, DEFAULT_PER_PAGE);
@@ -1505,6 +1693,20 @@ export default class StationProvider {
 			// Station keeps only the `MAX_PER_PAGE` clamp (above) and the
 			// redirect-to-last-page wrapper — atlas floors perPage to ≥1 but
 			// does not cap it.
+			// Past this page `(page-1)*perPage` is no longer an exact integer:
+			// atlas / the driver reject that offset, which surfaced as a 500.
+			// No table that size exists, so such a page is past the end — count
+			// through page 1 and send the caller to the real last page.
+			if (page > Math.floor(Number.MAX_SAFE_INTEGER / perPage) + 1) {
+				const first = await repo
+					.query()
+					.orderBy(pkColumn, "desc")
+					.paginate(1, perPage);
+				ctx.response.redirect(
+					`/admin/${resource.name}?page=${Math.max(1, first.meta.lastPage)}&perPage=${perPage}`,
+				);
+				return;
+			}
 			const result = await repo
 				.query()
 				.orderBy(pkColumn, "desc")
@@ -1521,7 +1723,7 @@ export default class StationProvider {
 			const viewModel = buildListViewModel({
 				resource,
 				rows: result.all(),
-				columns,
+				columns: listColumns,
 				pkColumn,
 				page: result.meta.currentPage,
 				perPage: result.meta.perPage,
@@ -1538,14 +1740,11 @@ export default class StationProvider {
 		resource: Resource,
 	): (ctx: StationHttpContext) => Promise<void> {
 		return async (ctx) => {
-			const { repo, columns, pkColumn } = this.#requireContext(resource);
+			const { repo, showColumns, pkColumn } = this.#requireContext(resource);
 			// Authorize BEFORE the existence check so an unauthorized caller
 			// can't distinguish 404 (absent) from 403 (exists) — no row-existence
 			// oracle for a user without `<resource>.show`.
-			if (!(await authorizeAction(resource, "show", ctx, this.#authManager))) {
-				deny(ctx);
-				return;
-			}
+			if (!(await this.#authorize(ctx, resource, "show"))) return;
 			const id = ctx.params.id ?? "";
 			const row = await repo.find(id);
 			if (row === null) {
@@ -1558,7 +1757,7 @@ export default class StationProvider {
 			const viewModel = buildShowViewModel({
 				resource,
 				row,
-				columns,
+				columns: showColumns,
 				pkColumn,
 			});
 			const html = await this.#renderView(ctx, "station::show", viewModel);
@@ -1571,20 +1770,17 @@ export default class StationProvider {
 		resource: Resource,
 	): (ctx: StationHttpContext) => Promise<void> {
 		return async (ctx) => {
-			const { columns, pkColumn } = this.#requireContext(resource);
-			if (
-				!(await authorizeAction(resource, "create", ctx, this.#authManager))
-			) {
-				deny(ctx);
-				return;
-			}
+			const { formColumns, pkColumn, writeOnly } =
+				this.#requireContext(resource);
+			if (!(await this.#authorize(ctx, resource, "create"))) return;
 			// 57.7 — after a failed create redirected back (PRG), the flash carries
 			// the old input + per-field errors; re-populate + surface them.
-			const { values, errors } = readFlash(ctx, columns);
+			const { values, errors } = readFlash(ctx, formColumns);
 			const vm = buildFormViewModel({
 				resource,
-				columns,
+				columns: formColumns,
 				pkColumn,
+				writeOnly,
 				values,
 				errors,
 				csrfEnabled: ctx.store?.get("csrfToken") != null,
@@ -1604,27 +1800,24 @@ export default class StationProvider {
 			// DB work — no 404-vs-403 oracle to a forged request. A seeded token is
 			// not proof; only `csrfProtected === true` is (AC4/AC7).
 			if (ctx.request.csrfProtected !== true) {
-				denyCsrf(ctx);
+				await this.#denyCsrf(ctx);
 				return;
 			}
-			const { repo, pkColumn, columns, booleanKeys } =
+			const { repo, pkColumn, columns, booleanKeys, writeOnly, redacted } =
 				this.#requireContext(resource);
-			if (
-				!(await authorizeAction(resource, "create", ctx, this.#authManager))
-			) {
-				deny(ctx);
-				return;
-			}
+			if (!(await this.#authorize(ctx, resource, "create"))) return;
 			const body = await readBody(ctx);
 			// 57.7 — validate + mass-assignment guard in one pass. `result.data`
-			// holds ONLY declared-column keys, so an attacker's `{ role: "admin" }`
-			// / `{ passwordHash: "x" }` / PK / timestamps are never present (dropped
-			// by the schema, not a separate filter), and each field is type-checked.
+			// holds ONLY editable-column keys (the allow-list: `editable`, or every
+			// non-secret, non-hidden, non-framework column), so a forged `isAdmin`
+			// on a hidden column, a secret column, the PK or a timestamp is dropped
+			// by the schema, and each field is type-checked.
 			// Invalid input fail-closes with a 422 BEFORE any repository write (AC4).
 			const result = validateWritableBody(
-				this.#requireWritableSchema(resource),
+				this.#requireWritableSchema(resource, "create"),
 				booleanKeys,
 				body,
+				writeOnly,
 			);
 			if (!result.valid) {
 				// PRG fallback URL = the create form (AdonisJS `redirect().back()`).
@@ -1638,7 +1831,8 @@ export default class StationProvider {
 				resource: resource.name,
 				recordId: created[pkColumn],
 				userId: ctx.auth?.user?.id,
-				after: snapshotEntity(created, columns),
+				...requestOrigin(ctx),
+				after: snapshotEntity(created, columns, redacted),
 				at: new Date(),
 			});
 			redirectToShow(ctx, resource, created[pkColumn]);
@@ -1649,12 +1843,10 @@ export default class StationProvider {
 		resource: Resource,
 	): (ctx: StationHttpContext) => Promise<void> {
 		return async (ctx) => {
-			const { repo, columns, pkColumn } = this.#requireContext(resource);
+			const { repo, formColumns, pkColumn, writeOnly } =
+				this.#requireContext(resource);
 			// Authorize before the existence check (no 404-vs-403 oracle).
-			if (!(await authorizeAction(resource, "edit", ctx, this.#authManager))) {
-				deny(ctx);
-				return;
-			}
+			if (!(await this.#authorize(ctx, resource, "edit"))) return;
 			const id = ctx.params.id ?? "";
 			const row = await repo.find(id);
 			if (row === null) {
@@ -1667,11 +1859,12 @@ export default class StationProvider {
 			// 57.7 — after a failed update redirected back (PRG), the flash carries
 			// the submitted values + errors; they win over the DB `row` so the user
 			// sees what they typed. A normal edit GET has no flash → fields from row.
-			const { values, errors } = readFlash(ctx, columns);
+			const { values, errors } = readFlash(ctx, formColumns);
 			const vm = buildFormViewModel({
 				resource,
-				columns,
+				columns: formColumns,
 				pkColumn,
+				writeOnly,
 				row,
 				values,
 				errors,
@@ -1689,16 +1882,13 @@ export default class StationProvider {
 		return async (ctx) => {
 			// Fail-close on CSRF before any auth/DB work (see #buildCreateHandler).
 			if (ctx.request.csrfProtected !== true) {
-				denyCsrf(ctx);
+				await this.#denyCsrf(ctx);
 				return;
 			}
-			const { repo, pkColumn, columns, booleanKeys } =
+			const { repo, pkColumn, columns, booleanKeys, writeOnly, redacted } =
 				this.#requireContext(resource);
 			// Authorize before the existence check (no 404-vs-403 oracle).
-			if (!(await authorizeAction(resource, "edit", ctx, this.#authManager))) {
-				deny(ctx);
-				return;
-			}
+			if (!(await this.#authorize(ctx, resource, "edit"))) return;
 			const id = ctx.params.id ?? "";
 			const entity = await repo.find(id);
 			if (entity === null) {
@@ -1715,9 +1905,10 @@ export default class StationProvider {
 			// 422 with the submitted values + per-field errors (the existing entity
 			// still supplies the id/action).
 			const result = validateWritableBody(
-				this.#requireWritableSchema(resource),
+				this.#requireWritableSchema(resource, "update"),
 				booleanKeys,
 				body,
+				writeOnly,
 			);
 			if (!result.valid) {
 				// PRG fallback URL = this row's edit form (AdonisJS `redirect().back()`).
@@ -1737,19 +1928,23 @@ export default class StationProvider {
 			// would shadow the original values after setProp). `result.data`
 			// holds only declared, type-checked columns — the mass-assignment
 			// guarantee (PK / timestamps / unknown keys dropped) is inherent.
-			const beforeSnapshot = snapshotEntity(entity, columns);
+			const beforeSnapshot = snapshotEntity(entity, columns, redacted);
+			const rawSecrets: Record<string, unknown> = {};
+			for (const key of redacted) rawSecrets[key] = entity[key];
 			for (const [key, value] of Object.entries(result.data)) {
 				entity.setProp(key, value);
 			}
 			await repo.save(entity);
-			const afterSnapshot = snapshotEntity(entity, columns);
+			const afterSnapshot = snapshotEntity(entity, columns, redacted);
 			await emitAudit(resource, {
 				action: "edit",
 				resource: resource.name,
 				recordId: entity[pkColumn],
 				userId: ctx.auth?.user?.id,
+				...requestOrigin(ctx),
 				before: beforeSnapshot,
 				after: afterSnapshot,
+				redactedChanges: changedRedacted(rawSecrets, entity, redacted),
 				at: new Date(),
 			});
 			redirectToShow(ctx, resource, entity[pkColumn]);
@@ -1762,33 +1957,45 @@ export default class StationProvider {
 		// Browser forms can only emit GET / POST. The auto-generated edit
 		// form ships `<input type="hidden" name="_method" value="PUT">`
 		// so the POST /admin/:r/:id endpoint can route to the update
-		// handler. A POST without `_method=PUT` (or with `_method=DELETE`)
-		// dispatches accordingly.
-		const updateHandler = this.#buildUpdateHandler(resource);
-		const destroyHandler = this.#buildDestroyHandler(resource);
+		// handler. Only the enabled actions get a handler: an override naming a
+		// disabled one is refused like any unsupported method, so `actions`
+		// stays the boundary of what the admin can do to a resource.
+		const updateHandler = resource.actions.includes("edit")
+			? this.#buildUpdateHandler(resource)
+			: undefined;
+		const destroyHandler = resource.actions.includes("destroy")
+			? this.#buildDestroyHandler(resource)
+			: undefined;
+		const allowed = [
+			...(updateHandler === undefined ? [] : ["PUT", "PATCH"]),
+			...(destroyHandler === undefined ? [] : ["DELETE"]),
+		];
 		return async (ctx) => {
 			// Fail-close on CSRF before reading the body (see #buildCreateHandler).
 			// The PUT/DELETE branches delegate to already-guarded handlers, but the
 			// unsupported-override 405 branch would otherwise do work on a forged
 			// request and leak a 403-vs-405 oracle — guard the entrypoint too.
 			if (ctx.request.csrfProtected !== true) {
-				denyCsrf(ctx);
+				await this.#denyCsrf(ctx);
 				return;
 			}
 			const body = await readBody(ctx);
 			const override = String(body._method ?? "").toUpperCase();
-			if (override === "PUT" || override === "PATCH") {
+			if (
+				updateHandler !== undefined &&
+				(override === "PUT" || override === "PATCH")
+			) {
 				return updateHandler(ctx);
 			}
-			if (override === "DELETE") {
+			if (destroyHandler !== undefined && override === "DELETE") {
 				return destroyHandler(ctx);
 			}
-			// Unsupported override — refuse rather than silently downgrade
-			// to a no-op so misconfigured forms surface immediately.
+			// Unsupported or disabled override — refuse rather than silently
+			// downgrade to a no-op so misconfigured forms surface immediately.
 			ctx.response.status(405);
 			ctx.response.type("text/html; charset=utf-8");
 			ctx.response.send(
-				`<h1>405 Method Not Allowed</h1><p>POST /admin/${escapeMin(resource.name)}/:id requires <code>_method=PUT</code> or <code>_method=DELETE</code>.</p>`,
+				`<h1>405 Method Not Allowed</h1><p>POST /admin/${escapeMin(resource.name)}/:id accepts <code>_method</code> = ${escapeMin(allowed.join(" | "))}.</p>`,
 			);
 		};
 	}
@@ -1799,17 +2006,13 @@ export default class StationProvider {
 		return async (ctx) => {
 			// Fail-close on CSRF before any auth/DB work (see #buildCreateHandler).
 			if (ctx.request.csrfProtected !== true) {
-				denyCsrf(ctx);
+				await this.#denyCsrf(ctx);
 				return;
 			}
-			const { repo, pkColumn, columns } = this.#requireContext(resource);
+			const { repo, pkColumn, columns, redacted } =
+				this.#requireContext(resource);
 			// Authorize before the existence check (no 404-vs-403 oracle).
-			if (
-				!(await authorizeAction(resource, "destroy", ctx, this.#authManager))
-			) {
-				deny(ctx);
-				return;
-			}
+			if (!(await this.#authorize(ctx, resource, "destroy"))) return;
 			const id = ctx.params.id ?? "";
 			const row = await repo.find(id);
 			if (row === null) {
@@ -1819,13 +2022,14 @@ export default class StationProvider {
 				ctx.response.send(notFoundHtml);
 				return;
 			}
-			const before = snapshotEntity(row, columns);
+			const before = snapshotEntity(row, columns, redacted);
 			await repo.delete(row);
 			await emitAudit(resource, {
 				action: "destroy",
 				resource: resource.name,
 				recordId: row[pkColumn],
 				userId: ctx.auth?.user?.id,
+				...requestOrigin(ctx),
 				before,
 				at: new Date(),
 			});
@@ -1938,7 +2142,7 @@ export default class StationProvider {
 				// Clear the stale cookie regardless of response shape, so neither
 				// a browser refresh nor an XHR caller retries with the dead token.
 				ctx.response.clearCookie?.(this.#authConfig.cookieName, {
-					path: "/",
+					path: AUTH_COOKIE_PATH,
 				});
 				if (this.#wantsJsonResponse(ctx)) {
 					ctx.response.status(401);
@@ -1975,6 +2179,11 @@ export default class StationProvider {
 					roleOk = false;
 				}
 				if (!roleOk) {
+					await this.#securityEvent(ctx, {
+						action: "denied",
+						userId: user.id,
+						permission: `role:${required}`,
+					});
 					if (this.#wantsJsonResponse(ctx)) {
 						ctx.response.status(403);
 						ctx.response.json({ error: "insufficient role" });
@@ -1986,6 +2195,31 @@ export default class StationProvider {
 					return;
 				}
 			}
+			// Entering the admin is its own grant (bug 214): without it, any app
+			// user holding a same-named permission for the public app got in.
+			const access = this.#authConfig.accessPermission;
+			if (access !== undefined) {
+				let accessOk: boolean;
+				try {
+					accessOk =
+						(await manager.hasPermission(user, access, "global")) === true;
+				} catch (err) {
+					const detail = err instanceof Error ? err.message : String(err);
+					console.error(
+						`[station] access check threw for '${access}' — denying (fail-closed): ${detail}`,
+					);
+					accessOk = false;
+				}
+				if (!accessOk) {
+					await this.#securityEvent(ctx, {
+						action: "denied",
+						userId: user.id,
+						permission: access,
+					});
+					deny(ctx);
+					return;
+				}
+			}
 			const existingAuth = ctx.auth ?? {};
 			ctx.auth = {
 				...existingAuth,
@@ -2014,11 +2248,11 @@ export default class StationProvider {
 					}
 				}
 			}
-			const qs = ctx.request.qs();
-			const errorParam = qs.error;
+			// No `?error=` read: Station never redirects with one (a failed POST
+			// re-renders inline), so its only use was a third party writing
+			// arbitrary text into the sign-in page's alert.
 			const vm = buildLoginViewModel({
 				action: this.#authConfig.loginPath,
-				error: typeof errorParam === "string" ? errorParam : undefined,
 				csrfEnabled: ctx.store?.get("csrfToken") != null,
 			});
 			const html = await this.#renderView(ctx, "station::login", vm);
@@ -2039,7 +2273,7 @@ export default class StationProvider {
 			// AuthManager work (see #buildCreateHandler). Login is open by design
 			// (no auth gate), so CSRF is the sole pre-check here.
 			if (ctx.request.csrfProtected !== true) {
-				denyCsrf(ctx);
+				await this.#denyCsrf(ctx);
 				return;
 			}
 			const manager = this.#authManager;
@@ -2065,6 +2299,10 @@ export default class StationProvider {
 				ctx.response.send(html);
 				return;
 			}
+			// Counted BEFORE the credential check (warden's AuthRateLimiter
+			// contract): a refused attempt never reaches authenticate.
+			const keys = loginKeys(ctx.request.ip?.() ?? "unknown", email);
+			if (!(await this.#admitLogin(ctx, keys, email))) return;
 			const result = await manager.authenticate({ email, password });
 			// Warden returns the issued token on `user.token`, not at the
 			// top level — reading `result.token` (which never exists) sent
@@ -2072,6 +2310,10 @@ export default class StationProvider {
 			const token =
 				typeof result.user?.token === "string" ? result.user.token : undefined;
 			if (!result.authenticated || token === undefined) {
+				await this.#securityEvent(ctx, {
+					action: "login_failed",
+					identifier: email,
+				});
 				const vm = buildLoginViewModel({
 					action: this.#authConfig.loginPath,
 					email,
@@ -2084,16 +2326,158 @@ export default class StationProvider {
 				ctx.response.send(html);
 				return;
 			}
+			await this.#loginLimiter?.clear(...keys);
+			await this.#securityEvent(ctx, {
+				action: "login",
+				userId: result.user?.id,
+				identifier: email,
+			});
+			// No maxAge: a session cookie, gone with the browser; the token's own
+			// expiry is enforced by verify() on every request.
 			ctx.response.cookie?.(this.#authConfig.cookieName, token, {
 				httpOnly: true,
 				sameSite: "Lax",
-				secure: process.env.NODE_ENV === "production",
-				path: "/",
+				secure: this.#cookieSecure ?? secureByDefault(ctx),
+				path: AUTH_COOKIE_PATH,
 			});
 			ctx.response.redirect("/admin");
 		};
 	}
 
+	/**
+	 * The per-action gate: allow, or record the refusal and answer 403.
+	 */
+	async #authorize(
+		ctx: StationHttpContext,
+		resource: Resource,
+		action: ResourceAction,
+	): Promise<boolean> {
+		const prefix = this.#authConfig.permissionPrefix;
+		if (
+			await authorizeAction(resource, action, ctx, this.#authManager, prefix)
+		) {
+			return true;
+		}
+		await this.#securityEvent(ctx, {
+			action: "denied",
+			userId: ctx.auth?.user?.id,
+			resource: resource.name,
+			resourceAction: action,
+			permission: `${prefix}.${resource.name}.${action}`,
+		});
+		deny(ctx);
+		return false;
+	}
+
+	/** Record a CSRF block, then refuse it. */
+	async #denyCsrf(ctx: StationHttpContext): Promise<void> {
+		await this.#securityEvent(ctx, { action: "csrf_denied" });
+		denyCsrf(ctx);
+	}
+
+	/**
+	 * Send a security event to `station.audit`, stamped with the request
+	 * origin. A failing sink is logged, never allowed to change the response.
+	 */
+	async #securityEvent(
+		ctx: StationHttpContext,
+		event: Omit<
+			SecurityAuditEvent,
+			"at" | "ip" | "userAgent" | "requestId" | "path"
+		>,
+	): Promise<void> {
+		const sink = this.#securityAudit;
+		if (sink === undefined) return;
+		try {
+			await sink({
+				...event,
+				...requestOrigin(ctx),
+				path: ctx.request.url?.(),
+				at: new Date(),
+			});
+		} catch (err) {
+			const detail = err instanceof Error ? err.message : String(err);
+			console.error(
+				`[station] security audit sink threw on ${event.action}: ${detail}. The event was NOT recorded.`,
+			);
+		}
+	}
+
+	/**
+	 * Revoke `token` through the default guard when it supports revocation.
+	 * A guard without it (or a JwtStrategy without a blacklist, whose
+	 * `revoke` throws) is reported once: logout then only clears the cookie.
+	 */
+	async #revoke(token: string): Promise<void> {
+		const strategy = this.#authManager?.getStrategy?.();
+		let reason = "the auth guard has no revoke(token)";
+		if (
+			typeof strategy === "object" &&
+			strategy !== null &&
+			"revoke" in strategy &&
+			typeof strategy.revoke === "function"
+		) {
+			try {
+				await strategy.revoke(token);
+				return;
+			} catch (err) {
+				reason = err instanceof Error ? err.message : String(err);
+			}
+		}
+		if (revokeUnavailableWarned) return;
+		revokeUnavailableWarned = true;
+		console.warn(
+			`[station] Logout cannot revoke the admin token (${reason}); it stays valid until it expires. Give warden's JwtStrategy a \`blacklist\` so a logged-out token is refused.`,
+		);
+	}
+
+	/**
+	 * Count a login attempt and answer the refusal when the limiter says no:
+	 * 429 + Retry-After when exhausted, 503 when the limiter itself failed (a
+	 * throttle that cannot count must not wave attempts through).
+	 */
+	async #admitLogin(
+		ctx: StationHttpContext,
+		keys: string[],
+		email: string,
+	): Promise<boolean> {
+		const limiter = this.#loginLimiter;
+		if (limiter === undefined) return true;
+		let decision: { allowed: boolean; retryAfterSeconds: number };
+		try {
+			decision = await limiter.attempt(...keys);
+		} catch (err) {
+			const detail = err instanceof Error ? err.message : String(err);
+			console.error(
+				`[station] login rate limiter failed — refusing the attempt (fail-closed): ${detail}`,
+			);
+			ctx.response.status(503);
+			ctx.response.type("text/plain; charset=utf-8");
+			ctx.response.send("Sign-in is temporarily unavailable.");
+			return false;
+		}
+		if (decision.allowed) return true;
+		await this.#securityEvent(ctx, {
+			action: "login_throttled",
+			identifier: email,
+		});
+		ctx.response.status(429);
+		ctx.response.header(
+			"Retry-After",
+			String(Math.max(1, Math.ceil(decision.retryAfterSeconds))),
+		);
+		const vm = buildLoginViewModel({
+			action: this.#authConfig.loginPath,
+			email,
+			error: "Too many sign-in attempts. Try again later.",
+			csrfEnabled: ctx.store?.get("csrfToken") != null,
+		});
+		const html = await this.#renderView(ctx, "station::login", vm);
+		ctx.response.type("text/html; charset=utf-8");
+		ctx.response.send(html);
+		return false;
+	}
+
 	/**
 	 * `POST /admin/logout` — clear the session cookie and redirect to
 	 * the login page. POST (not GET) so a crafted `<img src>` can't log
@@ -2104,17 +2488,97 @@ export default class StationProvider {
 			// Fail-close on CSRF: a forged cross-site POST must not be able to log
 			// an admin out (session-fixation nuisance) (see #buildCreateHandler).
 			if (ctx.request.csrfProtected !== true) {
-				denyCsrf(ctx);
+				await this.#denyCsrf(ctx);
 				return;
 			}
+			// Clearing the cookie alone left the token valid until it expired:
+			// a copy taken before logout (shared machine, proxy log) still
+			// opened the admin.
+			const token = this.#readAuthToken(ctx);
+			if (token !== undefined) {
+				// Who is leaving, read before the token is revoked — only when
+				// someone is listening, since it costs a verify().
+				const userId =
+					this.#securityAudit === undefined
+						? undefined
+						: (await this.#authManager?.verify(token))?.user?.id;
+				await this.#revoke(token);
+				await this.#securityEvent(ctx, { action: "logout", userId });
+			} else {
+				await this.#securityEvent(ctx, { action: "logout" });
+			}
 			ctx.response.clearCookie?.(this.#authConfig.cookieName, {
-				path: "/",
+				path: AUTH_COOKIE_PATH,
 			});
 			ctx.response.redirect(this.#authConfig.loginPath);
 		};
 	}
 }
 
+/** Who sent the request, as far as the host can tell. */
+function requestOrigin(ctx: StationHttpContext): {
+	ip?: string;
+	userAgent?: string;
+	requestId?: string;
+} {
+	return {
+		ip: ctx.request.ip?.(),
+		userAgent: ctx.request.header?.("user-agent"),
+		requestId: ctx.request.id?.() ?? ctx.request.header?.("x-request-id"),
+	};
+}
+
+/**
+ * `Secure` unless this is a development/test process on plain HTTP — an
+ * unknown environment gets the production answer, and `NODE_ENV=prod` is
+ * production too.
+ */
+function secureByDefault(ctx: StationHttpContext): boolean {
+	const env = normalizeNodeEnv(process.env.NODE_ENV);
+	if (env !== "development" && env !== "test") return true;
+	return ctx.request.secure?.() === true;
+}
+
+function buildLoginLimiter(
+	config: StationConfig["loginRateLimit"],
+): StationLoginLimiter | undefined {
+	if (config === false) return undefined;
+	if (config?.limiter !== undefined) return config.limiter;
+	return new MemoryLoginLimiter(config?.maxAttempts, config?.windowSeconds);
+}
+
+/**
+ * A router whose every route gets `names` attached through the route's own
+ * `middleware(...names)` (ream's / AdonisJS's route API). A router that hands
+ * back no such method cannot honour the config, which is refused loudly.
+ */
+function withRouteMiddleware(
+	router: StationRouter,
+	names: ReadonlyArray<string> | undefined,
+): StationRouter {
+	if (names === undefined || names.length === 0) return router;
+	const attach = (route: unknown): unknown => {
+		if (
+			typeof route !== "object" ||
+			route === null ||
+			!("middleware" in route) ||
+			typeof route.middleware !== "function"
+		) {
+			throw new Error(
+				"[station] `station.middleware` is set but the router's routes have no middleware() method to attach it with.",
+			);
+		}
+		route.middleware(...names);
+		return route;
+	};
+	return {
+		get: (path, handler) => attach(router.get(path, handler)),
+		post: (path, handler) => attach(router.post(path, handler)),
+		put: (path, handler) => attach(router.put(path, handler)),
+		delete: (path, handler) => attach(router.delete(path, handler)),
+	};
+}
+
 /**
  * Cross-package bridge — Station's `Resource.entity` is intentionally
  * typed `new (...args: never[]) => unknown` so the package type-compiles
@@ -2163,22 +2627,53 @@ function buildResourceContext(
 		atlas.getRelationMetadata(resource.entity).map((r) => r.propertyKey),
 	);
 	if (atlas.hasSoftDeletes(resource.entity)) excludedProps.add("deletedAt");
+	const listColumns = viewColumns(
+		columns,
+		resource.list.columns,
+		resource,
+		"list.columns",
+	);
+	const showColumns = viewColumns(
+		columns,
+		resource.show.columns,
+		resource,
+		"show.columns",
+	);
+	const formColumns = editableColumns(
+		columns,
+		resource,
+		pkColumn,
+		autoManaged,
+		excludedProps,
+	);
+	const writeOnly = writeOnlyKeys(formColumns, resource);
 	const derived =
 		rune === null
 			? undefined
 			: deriveWritableSchema(
-					columns,
+					formColumns,
 					pkColumn,
 					autoManaged,
 					excludedProps,
 					rune,
+					writeOnly,
 				);
 	return {
 		repo,
 		columns,
+		listColumns,
+		showColumns,
+		formColumns,
+		writeOnly,
+		redacted: new Set(
+			resource.auditSecrets
+				? []
+				: columns.filter(isSecretColumn).map((c) => c.propertyKey),
+		),
 		pkColumn,
 		autoManaged,
 		writableSchema: derived?.schema,
+		updateSchema: derived?.updateSchema,
 		booleanKeys: derived?.booleanKeys ?? new Set<string>(),
 	};
 }
@@ -2263,7 +2758,7 @@ function isRouterProxyUninit(err: unknown): boolean {
 /**
  * 56.5 authorization gate. Returns true when the action is allowed.
  * Station authorizes EXCLUSIVELY through Warden's unified layer: the
- * decision is `auth.hasPermission(user, "<resource>.<action>", scope)`
+ * decision is `auth.hasPermission(user, "<prefix>.<resource>.<action>", scope)`
  * resolved via the container `"auth"` AuthManager (D1/D2). No
  * Station-local RBAC computation, no token-payload read.
  *
@@ -2288,8 +2783,10 @@ async function authorizeAction(
 	action: ResourceAction,
 	ctx: StationHttpContext,
 	authManager: WardenAuthManager | undefined,
+	prefix: string,
 	scope: StationScope = "global",
 ): Promise<boolean> {
+	const permission = `${prefix}.${resource.name}.${action}`;
 	if (authManager === undefined) return true;
 	const user = ctx.auth?.user;
 	// `=== undefined` alone is too narrow: a host whose middleware writes
@@ -2300,19 +2797,13 @@ async function authorizeAction(
 		// Coerce to a strict boolean: the duck-typed manager could resolve a
 		// truthy non-boolean, and `!truthy` would silently ALLOW. Anything
 		// not exactly `true` denies (fail-closed).
-		return (
-			(await authManager.hasPermission(
-				user,
-				`${resource.name}.${action}`,
-				scope,
-			)) === true
-		);
+		return (await authManager.hasPermission(user, permission, scope)) === true;
 	} catch (err) {
 		// A rights-store I/O failure (DB/Redis-backed resolver) must not pass
 		// the gate. Deny and surface it loud rather than 500-ing or allowing.
 		const detail = err instanceof Error ? err.message : String(err);
 		console.error(
-			`[station] authorization check threw for '${resource.name}.${action}' — denying (fail-closed): ${detail}`,
+			`[station] authorization check threw for '${permission}' — denying (fail-closed): ${detail}`,
 		);
 		return false;
 	}