@c9up/station 0.1.15 → 0.1.16

package/dist/StationProvider.js

@@ -19,9 +19,11 @@
  */
 import "./augmentations.js";
 import { fileURLToPath } from "node:url";
+import { editableColumns, isFrameworkManaged, isSecretColumn, viewColumns, writeOnlyKeys, } from "./columns.js";
+import { loginKeys, MemoryLoginLimiter, } from "./loginLimiter.js";
 import { ResourceRegistry } from "./ResourceRegistry.js";
 import { clearStation, getStation, setStation } from "./services/main.js";
-import { inProduction } from "./vendor/nodeEnv.js";
+import { inProduction, normalizeNodeEnv } from "./vendor/nodeEnv.js";
 // note: AuditEvent + ResourceAction are used by the CRUD handlers below;
 // the imports stay in one block for clarity.
 import { buildFormViewModel } from "./views/form.js";
@@ -45,6 +47,12 @@ function isInkerViewRenderer(value) {
         typeof value.renderToString === "function");
 }
 const MAX_PER_PAGE = 100;
+const DEFAULT_PERMISSION_PREFIX = "station";
+/**
+ * The auth cookie travels only to the admin: scoped to `/`, the admin bearer
+ * token rode along with every request to the rest of the application.
+ */
+const AUTH_COOKIE_PATH = "/admin";
 const DEFAULT_PER_PAGE = 25;
 const POSITIVE_INT_RE = /^[1-9][0-9]*$/;
 /** Process-scoped flags so we warn once per process, not once per request. */
@@ -53,6 +61,7 @@ let perPageClampWarned = false;
 let seedPermsWarned = false;
 let missingAuditWarned = false;
 let csrfBlockedWarned = false;
+let revokeUnavailableWarned = false;
 /** @internal Reset module-level flags between tests. */
 export function resetStationProviderFlags() {
     authWarnEmitted = false;
@@ -60,6 +69,7 @@ export function resetStationProviderFlags() {
     seedPermsWarned = false;
     missingAuditWarned = false;
     csrfBlockedWarned = false;
+    revokeUnavailableWarned = false;
 }
 /**
  * Stable fingerprint for a failed `station::errors/404` render, used to log each
@@ -80,16 +90,6 @@ function notFoundFailFingerprint(cause) {
  * unforeseen unbounded error-code space still cannot inflate the log or memory.
  */
 const NOT_FOUND_RENDER_FAIL_CAP = 32;
-const TIMESTAMP_PROPERTY_KEYS = new Set([
-    "createdAt",
-    "updatedAt",
-    "deletedAt",
-]);
-const TIMESTAMP_COLUMN_NAMES = new Set([
-    "created_at",
-    "updated_at",
-    "deleted_at",
-]);
 /**
  * Column `type` strings mapped to a numeric rune rule (mirrors form.ts input
  * inference). `bigint` is deliberately EXCLUDED: coercing it through `Number()`
@@ -118,9 +118,9 @@ export function resourcesNeedValidation(resources) {
  * Derive a `@c9up/rune` validation schema (57.7) from an entity's writable
  * column metadata — the structural replacement for the hand-rolled
  * `filterWritableBody`. The mass-assignment guarantee is now INHERENT:
- * `schema.validateResult()` returns only declared-column keys, so unknown body keys
- * (`role`, `passwordHash`, PK, timestamps) are dropped automatically — no
- * explicit filtering pass.
+ * `schema.validateResult()` returns only the keys of the editable columns it
+ * was given, so any other body key — an unknown one, a column outside the
+ * allow-list, the PK, a timestamp — is dropped automatically.
  *
  * Excluded, exactly as the old guard did: the primary key, framework-managed
  * timestamps (both the Lucid-style `autoManaged` flag AND the `created_at /
@@ -141,22 +141,16 @@ export function resourcesNeedValidation(resources) {
  * Returns the built schema plus the set of boolean columns — the handler
  * default-fills an ABSENT boolean key to `false` before validating (an
  * unchecked checkbox submits nothing; this preserves the old edit-clears-box
- * behaviour).
+ * behaviour). `columns` is the editable allow-list; framework-owned columns
+ * are dropped here too, so no caller can make them writable. `updateSchema`
+ * differs only for `writeOnly` columns, which an edit may leave out.
  */
-export function deriveWritableSchema(columns, pkColumn, autoManaged, excludedProps, rune) {
+export function deriveWritableSchema(columns, pkColumn, autoManaged, excludedProps, rune, writeOnly = new Set()) {
     const fields = {};
+    const updateFields = {};
     const booleanKeys = new Set();
     for (const c of columns) {
-        if (c.propertyKey === pkColumn)
-            continue;
-        if (autoManaged.has(c.propertyKey))
-            continue;
-        if (TIMESTAMP_PROPERTY_KEYS.has(c.propertyKey))
-            continue;
-        const snake = c.propertyKey.replace(/([A-Z])/g, "_$1").toLowerCase();
-        if (TIMESTAMP_COLUMN_NAMES.has(snake))
-            continue;
-        if (excludedProps.has(c.propertyKey))
+        if (isFrameworkManaged(c, pkColumn, autoManaged, excludedProps))
             continue;
         const type = (c.type ?? "").toString().toLowerCase();
         if (type === "boolean") {
@@ -164,26 +158,38 @@ export function deriveWritableSchema(columns, pkColumn, autoManaged, excludedPro
             // boolean is always present here → required, no `.optional()`.
             booleanKeys.add(c.propertyKey);
             fields[c.propertyKey] = rune.rules.boolean().parse(isCheckedValue);
+            updateFields[c.propertyKey] = rune.rules.boolean().parse(isCheckedValue);
             continue;
         }
-        // A column is required iff the model declares neither nullability nor a
-        // default. DB-side defaults (serial, `DEFAULT`) are invisible to metadata
-        // (documented residual limitation — see story Dev Notes); the PK, the
-        // common serial case, is already excluded above.
-        const required = c.nullable !== true && c.default === undefined;
-        let chain = NUMBER_COLUMN_TYPES.has(type)
-            ? rune.rules.number().parse(parseNumeric)
-            : JSON_COLUMN_TYPES.has(type)
-                ? rune.rules.any()
-                : rune.rules.string();
-        if (!required) {
-            chain = chain.optional();
-            if (c.nullable === true)
-                chain = chain.nullable();
-        }
-        fields[c.propertyKey] = chain;
+        fields[c.propertyKey] = columnChain(c, type, rune, false);
+        updateFields[c.propertyKey] = columnChain(c, type, rune, writeOnly.has(c.propertyKey));
     }
-    return { schema: rune.schema(fields), booleanKeys };
+    return {
+        schema: rune.schema(fields),
+        updateSchema: rune.schema(updateFields),
+        booleanKeys,
+    };
+}
+/**
+ * The rule for one non-boolean column. A column is required iff the model
+ * declares neither nullability nor a default — unless `keepable`: an edit may
+ * omit a write-only column to keep its stored value. DB-side defaults
+ * (serial, `DEFAULT`) are invisible to metadata (documented residual
+ * limitation); the PK, the common serial case, is never editable.
+ */
+function columnChain(c, type, rune, keepable) {
+    const required = !keepable && c.nullable !== true && c.default === undefined;
+    let chain = NUMBER_COLUMN_TYPES.has(type)
+        ? rune.rules.number().parse(parseNumeric)
+        : JSON_COLUMN_TYPES.has(type)
+            ? rune.rules.any()
+            : rune.rules.string();
+    if (!required) {
+        chain = chain.optional();
+        if (c.nullable === true)
+            chain = chain.nullable();
+    }
+    return chain;
 }
 /**
  * Validate a request body against a derived schema (57.7). Default-fills any
@@ -191,10 +197,15 @@ export function deriveWritableSchema(columns, pkColumn, autoManaged, excludedPro
  * preserving the old `filterWritableBody` checkbox semantics, then runs rune's
  * synchronous, never-throwing `validateResult()`. On success `result.data` holds only
  * declared-column keys (mass-assignment inherent). Exported for the unit tests
- * that pin the coercion CRUX.
+ * that pin the coercion CRUX. A blank `writeOnly` value counts as not
+ * submitted: the form never pre-fills those, so blank means "unchanged".
  */
-export function validateWritableBody(schema, booleanKeys, body) {
+export function validateWritableBody(schema, booleanKeys, body, writeOnly = new Set()) {
     const input = { ...body };
+    for (const key of writeOnly) {
+        if (input[key] === "")
+            delete input[key];
+    }
     for (const key of booleanKeys) {
         if (!(key in input))
             input[key] = false;
@@ -243,8 +254,6 @@ function fieldErrors(errors) {
 }
 /** Session flash key under which the per-field validation errors are stashed (AdonisJS `flashMessages.errors` parity). */
 const FLASH_ERRORS_KEY = "errors";
-/** Column propertyKeys whose values are secrets — never flashed to the session nor echoed back into HTML (AdonisJS parity). */
-const SENSITIVE_KEY_RE = /password|passwd|secret|token|apikey/i;
 /**
  * The subset of a submitted body safe to re-surface on a validation error:
  * declared columns only — so `_csrf`, `_method`, and any mass-assignment /
@@ -255,7 +264,7 @@ const SENSITIVE_KEY_RE = /password|passwd|secret|token|apikey/i;
 function flashableInput(submitted, columns) {
     const out = {};
     for (const c of columns) {
-        if (SENSITIVE_KEY_RE.test(c.propertyKey))
+        if (isSecretColumn(c))
             continue;
         if (c.propertyKey in submitted)
             out[c.propertyKey] = submitted[c.propertyKey];
@@ -295,42 +304,46 @@ function readFlash(ctx, columns) {
     };
 }
 /**
- * Same-origin / relative check for a `Referer` — replicates ream's
- * `RedirectBuilder.back()` open-redirect guard (Station consumes the response
- * through its own `redirect(url)` seam and can't reach ream's builder). A
- * relative path is trusted; an absolute URL only when its origin matches the
- * request URL. Anything else is untrusted → the caller uses its safe fallback.
+ * The path a `Referer` points back to, when it may be trusted — AdonisJS's
+ * `isValidRedirectUrl` + `redirect().back()`: a relative path is trusted, an
+ * absolute URL only when its host is the request's own authority (`Host` /
+ * `:authority`, never a forwarded host), and the redirect goes to the path
+ * alone. Comparing with `request.url()` could never work: in ream that is
+ * the path, while a browser's Referer is a full URL. Deliberately stricter
+ * than upstream in one place: with no authority to compare against, an
+ * absolute Referer is refused rather than accepted.
  */
-function isSameOriginReferer(referer, requestUrl) {
+function trustedRefererPath(referer, authority) {
     // A relative path is trusted only when it starts with a single "/" and
     // contains no backslash: browsers normalise "\\" to "/", so "/\\evil.com"
     // becomes the protocol-relative "//evil.com" that a lone `!startsWith("//")`
     // check would let through.
-    if (referer.startsWith("/") &&
-        !referer.startsWith("//") &&
-        !referer.includes("\\")) {
-        return true;
-    }
-    if (requestUrl === undefined)
-        return false;
+    if (referer.startsWith("//") || referer.includes("\\"))
+        return undefined;
     try {
-        return new URL(referer).origin === new URL(requestUrl).origin;
+        if (referer.startsWith("/")) {
+            const url = new URL(referer, "http://localhost");
+            return url.host === "localhost" ? url.pathname : undefined;
+        }
+        if (authority === null || authority === undefined || authority === "") {
+            return undefined;
+        }
+        const url = new URL(referer);
+        return url.host === authority ? url.pathname : undefined;
     }
     catch {
-        return false;
+        return undefined;
     }
 }
 /**
- * `redirect().back()` over Station's `redirect(url)` seam (57.7): prefer a
- * trusted same-origin `Referer`, else the caller's `fallback` (the form URL) —
- * the same behaviour as ream's `RedirectBuilder.back(fallback)`, open-redirect
- * safe.
+ * `redirect().back()` over Station's `redirect(url)` seam (57.7): the path of a
+ * trusted `Referer`, else the caller's `fallback` (the form URL).
  */
 function redirectBack(ctx, fallback) {
     const referer = ctx.request.header?.("referer");
-    const target = typeof referer === "string" &&
-        isSameOriginReferer(referer, ctx.request.url?.())
-        ? referer
+    const authority = ctx.request.authority?.() ?? ctx.request.header?.("host") ?? undefined;
+    const target = typeof referer === "string"
+        ? (trustedRefererPath(referer, authority) ?? fallback)
         : fallback;
     ctx.response.redirect(target);
 }
@@ -355,10 +368,13 @@ function isCheckedValue(value) {
  * field). The fallback is shallow but warned ONCE per process so
  * operators see it.
  */
-function snapshotEntity(entity, columns) {
+function snapshotEntity(entity, columns, redacted) {
     const out = {};
-    for (const c of columns)
-        out[c.propertyKey] = entity[c.propertyKey];
+    for (const c of columns) {
+        out[c.propertyKey] = redacted.has(c.propertyKey)
+            ? REDACTED
+            : entity[c.propertyKey];
+    }
     try {
         return structuredClone(out);
     }
@@ -386,6 +402,15 @@ function snapshotEntity(entity, columns) {
     }
 }
 let auditCloneWarnEmitted = false;
+/** What an audit snapshot holds in place of a secret column's value. */
+const REDACTED = "[redacted]";
+/**
+ * The redacted columns an edit changed — read from the raw values, so the
+ * audit trail says "password changed" without carrying either hash.
+ */
+function changedRedacted(before, entity, redacted) {
+    return [...redacted].filter((key) => !Object.is(before[key], entity[key]));
+}
 /**
  * Filesystem path to the `.inker` templates Station ships inside the
  * package (57.1, D3). Resolved from `import.meta.url` so the SAME path
@@ -410,11 +435,16 @@ export default class StationProvider {
     // 54.7 auth state — populated when warden is wired AND
     // StationConfig.requireAuth is true (default when warden is present).
     #authManager;
+    #loginLimiter;
+    #cookieSecure;
+    #securityAudit;
     #authConfig = {
         requireAuth: false,
         requireRole: undefined,
         loginPath: "/admin/login",
         cookieName: "station_auth",
+        permissionPrefix: DEFAULT_PERMISSION_PREFIX,
+        accessPermission: undefined,
     };
     constructor(app) {
         this.app = app;
@@ -454,7 +484,15 @@ export default class StationProvider {
         const peers = await this.#loadPeers();
         if (!peers)
             return;
-        const { router, atlas, rune } = peers;
+        const { atlas, rune } = peers;
+        const router = withRouteMiddleware(peers.router, userConfig.middleware);
+        this.#loginLimiter = buildLoginLimiter(userConfig.loginRateLimit);
+        this.#cookieSecure = userConfig.cookieSecure;
+        if (userConfig.audit !== undefined &&
+            typeof userConfig.audit !== "function") {
+            throw new TypeError("[station] `station.audit` must be a function");
+        }
+        this.#securityAudit = userConfig.audit;
         // Phase 1a2 — resolve the SHARED inker renderer (AdonisJS/Edge parity)
         // and mount Station's package templates as the `station` disk. Unlike
         // warden (whose absence keeps the open dev-preview path), a view engine
@@ -697,6 +735,10 @@ export default class StationProvider {
      * not installed/bound the gate stays open and a one-time warning is emitted.
      */
     async #configureAuth(userConfig) {
+        const permissionPrefix = userConfig.permissionPrefix ?? DEFAULT_PERMISSION_PREFIX;
+        if (typeof permissionPrefix !== "string" || permissionPrefix === "") {
+            throw new Error("[station] `station.permissionPrefix` must be a non-empty string: admin permissions need their own namespace.");
+        }
         const wardenWanted = userConfig.requireAuth !== false;
         if (wardenWanted) {
             try {
@@ -707,6 +749,10 @@ export default class StationProvider {
                     requireRole: userConfig.requireRole,
                     loginPath: userConfig.loginPath ?? "/admin/login",
                     cookieName: userConfig.cookieName ?? "station_auth",
+                    permissionPrefix,
+                    accessPermission: userConfig.accessPermission === false
+                        ? undefined
+                        : (userConfig.accessPermission ?? `${permissionPrefix}.access`),
                 };
             }
             catch (cause) {
@@ -725,14 +771,22 @@ export default class StationProvider {
             return;
         // An admin panel with no auth is full CRUD on every registered resource
         // for anyone who can reach the route. That is a different product, and
-        // in production it has to be asked for rather than fallen into — the
-        // same bet bay makes about losing a job on a Redis without LMOVE.
+        // it has to be asked for rather than fallen into — the same bet bay
+        // makes about losing a job on a Redis without LMOVE.
         //
         // `requireAuth: false` written down IS the asking. Defaulted (undefined)
-        // is not: it means nobody decided, and nobody deciding must not be how
-        // an unauthenticated admin reaches production.
-        if (inProduction() && userConfig.requireAuth !== false) {
-            throw new Error("[station] Admin routes would mount with NO authorisation in production: " +
+        // is not: it means nobody decided, and nobody deciding is only tolerated
+        // on a machine positively named development or test. An unset NODE_ENV,
+        // `staging`, `preview`… fail closed like production: they are exactly
+        // the boxes nobody configured, and staging often holds a copy of
+        // production data (ream's `Application.inDev` takes the same stance).
+        const env = normalizeNodeEnv(process.env.NODE_ENV);
+        const devOrTest = env === "development" || env === "test";
+        if (!devOrTest && userConfig.requireAuth !== false) {
+            const where = inProduction()
+                ? "production"
+                : `a non-development environment (NODE_ENV=${process.env.NODE_ENV === undefined ? "unset" : JSON.stringify(process.env.NODE_ENV)})`;
+            throw new Error(`[station] Admin routes would mount with NO authorisation in ${where}: ` +
                 "no working `auth` binding is registered, so every `/admin/*` route — " +
                 "including create, update and delete — is open to anyone who can reach it.\n" +
                 "  Wire @c9up/warden's WardenProvider, or set `station.requireAuth: false` " +
@@ -744,10 +798,11 @@ export default class StationProvider {
         // Said even when the deployment opted in: agreeing once in a config file
         // is not the same as being reminded that this process is running that
         // way. The line has to be in the logs of the incident.
-        const optedIn = inProduction() && userConfig.requireAuth === false;
-        console.warn("[station] Admin routes mounted without auth. Wire @c9up/warden (and set `station.requireAuth: true` if you opted out) and seed the per-action `<resource>.<action>` permissions in the Warden rights store BEFORE production. See https://ream.dev/modules/station#auth." +
+        const optedIn = !devOrTest && userConfig.requireAuth === false;
+        const envName = env === "unknown" ? "AN UNCONFIGURED ENVIRONMENT" : env.toUpperCase();
+        console.warn("[station] Admin routes mounted without auth. Wire @c9up/warden (and set `station.requireAuth: true` if you opted out) and seed the per-action admin permissions in the Warden rights store BEFORE production. See https://ream.dev/modules/station#auth." +
             (optedIn
-                ? "\n  Running this way in PRODUCTION because `station.requireAuth: false` was set."
+                ? `\n  Running this way in ${envName} because \`station.requireAuth: false\` was set.`
                 : ""));
     }
     /** Phase 3 — mount the login surface + per-resource CRUD routes. */
@@ -801,18 +856,22 @@ export default class StationProvider {
             if (resource.actions.includes("edit")) {
                 router.get(`/admin/${slug}/:id/edit`, gate(this.#buildEditFormHandler(resource)));
                 router.put(`/admin/${slug}/:id`, gate(this.#buildUpdateHandler(resource)));
-                // Browser forms can't issue PUT — accept POST with `_method=PUT`
-                // from the auto-generated form (form.ts stamps the hidden input).
-                router.post(`/admin/${slug}/:id`, gate(this.#buildMethodOverrideHandler(resource)));
             }
             if (resource.actions.includes("destroy")) {
                 router.delete(`/admin/${slug}/:id`, gate(this.#buildDestroyHandler(resource)));
             }
+            // Browser forms can't issue PUT/DELETE — accept POST with `_method`
+            // from the auto-generated form (form.ts stamps the hidden input),
+            // dispatching only to the actions this resource enables.
+            if (resource.actions.includes("edit") ||
+                resource.actions.includes("destroy")) {
+                router.post(`/admin/${slug}/:id`, gate(this.#buildMethodOverrideHandler(resource)));
+            }
         }
     }
     /**
      * 56.5 — every admin action is now gated behind a
-     * `<resource>.<action>` permission resolved through @c9up/warden
+     * `<prefix>.<resource>.<action>` permission resolved through @c9up/warden
      * (`auth.hasPermission`). Warn ONCE at boot, only when the auth layer
      * is wired, that the host must seed roles/grants in the Warden rights
      * store — otherwise every admin request 403s with no hint. The old
@@ -831,7 +890,14 @@ export default class StationProvider {
         const [example] = resources;
         if (example === undefined)
             return;
-        console.warn(`[station] Admin actions are gated behind '<resource>.<action>' permissions resolved through @c9up/warden (e.g. '${example.name}.list', '${example.name}.create'). Seed roles/grants in the Warden rights store (store.defineRole('admin', ['${example.name}.list', '${example.name}.create', ...]) then assignRole) or every admin request will 403. See https://ream.dev/modules/station#authorization.`);
+        const prefix = this.#authConfig.permissionPrefix;
+        const access = this.#authConfig.accessPermission;
+        const perms = [
+            ...(access === undefined ? [] : [access]),
+            `${prefix}.${example.name}.list`,
+            `${prefix}.${example.name}.create`,
+        ];
+        console.warn(`[station] Admin actions are gated behind '${prefix}.<resource>.<action>' permissions resolved through @c9up/warden${access === undefined ? "" : `, and entering the admin behind '${access}'`}. Seed roles/grants in the Warden rights store (store.defineRole('admin', [${perms.map((p) => `'${p}'`).join(", ")}, ...]) then assignRole) or every admin request will 403. See https://ream.dev/modules/station#authorization.`);
     }
     #warnAuditGapsOnce(resources) {
         if (missingAuditWarned)
@@ -870,8 +936,9 @@ export default class StationProvider {
      * `@c9up/rune` — so an undefined here is an internal invariant break; throw
      * loud (fail-closed) rather than silently accept an unvalidated body.
      */
-    #requireWritableSchema(resource) {
-        const { writableSchema } = this.#requireContext(resource);
+    #requireWritableSchema(resource, mode) {
+        const context = this.#requireContext(resource);
+        const writableSchema = mode === "create" ? context.writableSchema : context.updateSchema;
         if (writableSchema === undefined) {
             throw new Error(`[station] No validation schema for ${resource.entity.name} — @c9up/rune must be installed to accept admin writes.`);
         }
@@ -911,8 +978,8 @@ export default class StationProvider {
         // Echo only declared, non-sensitive columns back to the form — never
         // `_csrf`, secrets, or mass-assignment keys (both the flash store and the
         // re-rendered HTML). An empty result falls back to `row`.
-        const { columns, pkColumn } = this.#requireContext(resource);
-        const safe = flashableInput(submitted, columns);
+        const { formColumns, pkColumn, writeOnly } = this.#requireContext(resource);
+        const safe = flashableInput(submitted, formColumns);
         if (ctx.session !== undefined) {
             // AdonisJS PRG: flash old input + errors, redirect back to the form.
             ctx.session.flashAll(safe);
@@ -924,8 +991,9 @@ export default class StationProvider {
         // submitted values + errors are still shown rather than silently dropped.
         const vm = buildFormViewModel({
             resource,
-            columns,
+            columns: formColumns,
             pkColumn,
+            writeOnly,
             row,
             values: Object.keys(safe).length > 0 ? safe : undefined,
             errors: fieldErrors(errors),
@@ -938,15 +1006,13 @@ export default class StationProvider {
     }
     #buildListHandler(resource) {
         return async (ctx) => {
-            const { repo, columns, pkColumn } = this.#requireContext(resource);
+            const { repo, listColumns, pkColumn } = this.#requireContext(resource);
             // 56.5: the list action is gated behind `<resource>.list` like
             // every other action — resolved through the Warden `"auth"`
             // layer. (Retro 2026-06-01: list previously skipped the gate
             // entirely, leaking the index regardless of authorization.)
-            if (!(await authorizeAction(resource, "list", ctx, this.#authManager))) {
-                deny(ctx);
+            if (!(await this.#authorize(ctx, resource, "list")))
                 return;
-            }
             const qs = ctx.request.qs();
             const page = clampPositiveInt(qs.page, 1);
             const perPageRaw = clampPositiveInt(qs.perPage, DEFAULT_PER_PAGE);
@@ -961,6 +1027,18 @@ export default class StationProvider {
             // Station keeps only the `MAX_PER_PAGE` clamp (above) and the
             // redirect-to-last-page wrapper — atlas floors perPage to ≥1 but
             // does not cap it.
+            // Past this page `(page-1)*perPage` is no longer an exact integer:
+            // atlas / the driver reject that offset, which surfaced as a 500.
+            // No table that size exists, so such a page is past the end — count
+            // through page 1 and send the caller to the real last page.
+            if (page > Math.floor(Number.MAX_SAFE_INTEGER / perPage) + 1) {
+                const first = await repo
+                    .query()
+                    .orderBy(pkColumn, "desc")
+                    .paginate(1, perPage);
+                ctx.response.redirect(`/admin/${resource.name}?page=${Math.max(1, first.meta.lastPage)}&perPage=${perPage}`);
+                return;
+            }
             const result = await repo
                 .query()
                 .orderBy(pkColumn, "desc")
@@ -974,7 +1052,7 @@ export default class StationProvider {
             const viewModel = buildListViewModel({
                 resource,
                 rows: result.all(),
-                columns,
+                columns: listColumns,
                 pkColumn,
                 page: result.meta.currentPage,
                 perPage: result.meta.perPage,
@@ -988,14 +1066,12 @@ export default class StationProvider {
     }
     #buildShowHandler(resource) {
         return async (ctx) => {
-            const { repo, columns, pkColumn } = this.#requireContext(resource);
+            const { repo, showColumns, pkColumn } = this.#requireContext(resource);
             // Authorize BEFORE the existence check so an unauthorized caller
             // can't distinguish 404 (absent) from 403 (exists) — no row-existence
             // oracle for a user without `<resource>.show`.
-            if (!(await authorizeAction(resource, "show", ctx, this.#authManager))) {
-                deny(ctx);
+            if (!(await this.#authorize(ctx, resource, "show")))
                 return;
-            }
             const id = ctx.params.id ?? "";
             const row = await repo.find(id);
             if (row === null) {
@@ -1008,7 +1084,7 @@ export default class StationProvider {
             const viewModel = buildShowViewModel({
                 resource,
                 row,
-                columns,
+                columns: showColumns,
                 pkColumn,
             });
             const html = await this.#renderView(ctx, "station::show", viewModel);
@@ -1018,18 +1094,17 @@ export default class StationProvider {
     }
     #buildNewFormHandler(resource) {
         return async (ctx) => {
-            const { columns, pkColumn } = this.#requireContext(resource);
-            if (!(await authorizeAction(resource, "create", ctx, this.#authManager))) {
-                deny(ctx);
+            const { formColumns, pkColumn, writeOnly } = this.#requireContext(resource);
+            if (!(await this.#authorize(ctx, resource, "create")))
                 return;
-            }
             // 57.7 — after a failed create redirected back (PRG), the flash carries
             // the old input + per-field errors; re-populate + surface them.
-            const { values, errors } = readFlash(ctx, columns);
+            const { values, errors } = readFlash(ctx, formColumns);
             const vm = buildFormViewModel({
                 resource,
-                columns,
+                columns: formColumns,
                 pkColumn,
+                writeOnly,
                 values,
                 errors,
                 csrfEnabled: ctx.store?.get("csrfToken") != null,
@@ -1046,21 +1121,20 @@ export default class StationProvider {
             // DB work — no 404-vs-403 oracle to a forged request. A seeded token is
             // not proof; only `csrfProtected === true` is (AC4/AC7).
             if (ctx.request.csrfProtected !== true) {
-                denyCsrf(ctx);
+                await this.#denyCsrf(ctx);
                 return;
             }
-            const { repo, pkColumn, columns, booleanKeys } = this.#requireContext(resource);
-            if (!(await authorizeAction(resource, "create", ctx, this.#authManager))) {
-                deny(ctx);
+            const { repo, pkColumn, columns, booleanKeys, writeOnly, redacted } = this.#requireContext(resource);
+            if (!(await this.#authorize(ctx, resource, "create")))
                 return;
-            }
             const body = await readBody(ctx);
             // 57.7 — validate + mass-assignment guard in one pass. `result.data`
-            // holds ONLY declared-column keys, so an attacker's `{ role: "admin" }`
-            // / `{ passwordHash: "x" }` / PK / timestamps are never present (dropped
-            // by the schema, not a separate filter), and each field is type-checked.
+            // holds ONLY editable-column keys (the allow-list: `editable`, or every
+            // non-secret, non-hidden, non-framework column), so a forged `isAdmin`
+            // on a hidden column, a secret column, the PK or a timestamp is dropped
+            // by the schema, and each field is type-checked.
             // Invalid input fail-closes with a 422 BEFORE any repository write (AC4).
-            const result = validateWritableBody(this.#requireWritableSchema(resource), booleanKeys, body);
+            const result = validateWritableBody(this.#requireWritableSchema(resource, "create"), booleanKeys, body, writeOnly);
             if (!result.valid) {
                 // PRG fallback URL = the create form (AdonisJS `redirect().back()`).
                 const formUrl = `/admin/${encodeURIComponent(resource.name)}/new`;
@@ -1073,7 +1147,8 @@ export default class StationProvider {
                 resource: resource.name,
                 recordId: created[pkColumn],
                 userId: ctx.auth?.user?.id,
-                after: snapshotEntity(created, columns),
+                ...requestOrigin(ctx),
+                after: snapshotEntity(created, columns, redacted),
                 at: new Date(),
             });
             redirectToShow(ctx, resource, created[pkColumn]);
@@ -1081,12 +1156,10 @@ export default class StationProvider {
     }
     #buildEditFormHandler(resource) {
         return async (ctx) => {
-            const { repo, columns, pkColumn } = this.#requireContext(resource);
+            const { repo, formColumns, pkColumn, writeOnly } = this.#requireContext(resource);
             // Authorize before the existence check (no 404-vs-403 oracle).
-            if (!(await authorizeAction(resource, "edit", ctx, this.#authManager))) {
-                deny(ctx);
+            if (!(await this.#authorize(ctx, resource, "edit")))
                 return;
-            }
             const id = ctx.params.id ?? "";
             const row = await repo.find(id);
             if (row === null) {
@@ -1099,11 +1172,12 @@ export default class StationProvider {
             // 57.7 — after a failed update redirected back (PRG), the flash carries
             // the submitted values + errors; they win over the DB `row` so the user
             // sees what they typed. A normal edit GET has no flash → fields from row.
-            const { values, errors } = readFlash(ctx, columns);
+            const { values, errors } = readFlash(ctx, formColumns);
             const vm = buildFormViewModel({
                 resource,
-                columns,
+                columns: formColumns,
                 pkColumn,
+                writeOnly,
                 row,
                 values,
                 errors,
@@ -1118,15 +1192,13 @@ export default class StationProvider {
         return async (ctx) => {
             // Fail-close on CSRF before any auth/DB work (see #buildCreateHandler).
             if (ctx.request.csrfProtected !== true) {
-                denyCsrf(ctx);
+                await this.#denyCsrf(ctx);
                 return;
             }
-            const { repo, pkColumn, columns, booleanKeys } = this.#requireContext(resource);
+            const { repo, pkColumn, columns, booleanKeys, writeOnly, redacted } = this.#requireContext(resource);
             // Authorize before the existence check (no 404-vs-403 oracle).
-            if (!(await authorizeAction(resource, "edit", ctx, this.#authManager))) {
-                deny(ctx);
+            if (!(await this.#authorize(ctx, resource, "edit")))
                 return;
-            }
             const id = ctx.params.id ?? "";
             const entity = await repo.find(id);
             if (entity === null) {
@@ -1142,7 +1214,7 @@ export default class StationProvider {
             // poisons the audit diff nor emits a success event; the form re-renders
             // 422 with the submitted values + per-field errors (the existing entity
             // still supplies the id/action).
-            const result = validateWritableBody(this.#requireWritableSchema(resource), booleanKeys, body);
+            const result = validateWritableBody(this.#requireWritableSchema(resource, "update"), booleanKeys, body, writeOnly);
             if (!result.valid) {
                 // PRG fallback URL = this row's edit form (AdonisJS `redirect().back()`).
                 const formUrl = `/admin/${encodeURIComponent(resource.name)}/${encodeURIComponent(id)}/edit`;
@@ -1154,19 +1226,24 @@ export default class StationProvider {
             // would shadow the original values after setProp). `result.data`
             // holds only declared, type-checked columns — the mass-assignment
             // guarantee (PK / timestamps / unknown keys dropped) is inherent.
-            const beforeSnapshot = snapshotEntity(entity, columns);
+            const beforeSnapshot = snapshotEntity(entity, columns, redacted);
+            const rawSecrets = {};
+            for (const key of redacted)
+                rawSecrets[key] = entity[key];
             for (const [key, value] of Object.entries(result.data)) {
                 entity.setProp(key, value);
             }
             await repo.save(entity);
-            const afterSnapshot = snapshotEntity(entity, columns);
+            const afterSnapshot = snapshotEntity(entity, columns, redacted);
             await emitAudit(resource, {
                 action: "edit",
                 resource: resource.name,
                 recordId: entity[pkColumn],
                 userId: ctx.auth?.user?.id,
+                ...requestOrigin(ctx),
                 before: beforeSnapshot,
                 after: afterSnapshot,
+                redactedChanges: changedRedacted(rawSecrets, entity, redacted),
                 at: new Date(),
             });
             redirectToShow(ctx, resource, entity[pkColumn]);
@@ -1176,47 +1253,55 @@ export default class StationProvider {
         // Browser forms can only emit GET / POST. The auto-generated edit
         // form ships `<input type="hidden" name="_method" value="PUT">`
         // so the POST /admin/:r/:id endpoint can route to the update
-        // handler. A POST without `_method=PUT` (or with `_method=DELETE`)
-        // dispatches accordingly.
-        const updateHandler = this.#buildUpdateHandler(resource);
-        const destroyHandler = this.#buildDestroyHandler(resource);
+        // handler. Only the enabled actions get a handler: an override naming a
+        // disabled one is refused like any unsupported method, so `actions`
+        // stays the boundary of what the admin can do to a resource.
+        const updateHandler = resource.actions.includes("edit")
+            ? this.#buildUpdateHandler(resource)
+            : undefined;
+        const destroyHandler = resource.actions.includes("destroy")
+            ? this.#buildDestroyHandler(resource)
+            : undefined;
+        const allowed = [
+            ...(updateHandler === undefined ? [] : ["PUT", "PATCH"]),
+            ...(destroyHandler === undefined ? [] : ["DELETE"]),
+        ];
         return async (ctx) => {
             // Fail-close on CSRF before reading the body (see #buildCreateHandler).
             // The PUT/DELETE branches delegate to already-guarded handlers, but the
             // unsupported-override 405 branch would otherwise do work on a forged
             // request and leak a 403-vs-405 oracle — guard the entrypoint too.
             if (ctx.request.csrfProtected !== true) {
-                denyCsrf(ctx);
+                await this.#denyCsrf(ctx);
                 return;
             }
             const body = await readBody(ctx);
             const override = String(body._method ?? "").toUpperCase();
-            if (override === "PUT" || override === "PATCH") {
+            if (updateHandler !== undefined &&
+                (override === "PUT" || override === "PATCH")) {
                 return updateHandler(ctx);
             }
-            if (override === "DELETE") {
+            if (destroyHandler !== undefined && override === "DELETE") {
                 return destroyHandler(ctx);
             }
-            // Unsupported override — refuse rather than silently downgrade
-            // to a no-op so misconfigured forms surface immediately.
+            // Unsupported or disabled override — refuse rather than silently
+            // downgrade to a no-op so misconfigured forms surface immediately.
             ctx.response.status(405);
             ctx.response.type("text/html; charset=utf-8");
-            ctx.response.send(`<h1>405 Method Not Allowed</h1><p>POST /admin/${escapeMin(resource.name)}/:id requires <code>_method=PUT</code> or <code>_method=DELETE</code>.</p>`);
+            ctx.response.send(`<h1>405 Method Not Allowed</h1><p>POST /admin/${escapeMin(resource.name)}/:id accepts <code>_method</code> = ${escapeMin(allowed.join(" | "))}.</p>`);
         };
     }
     #buildDestroyHandler(resource) {
         return async (ctx) => {
             // Fail-close on CSRF before any auth/DB work (see #buildCreateHandler).
             if (ctx.request.csrfProtected !== true) {
-                denyCsrf(ctx);
+                await this.#denyCsrf(ctx);
                 return;
             }
-            const { repo, pkColumn, columns } = this.#requireContext(resource);
+            const { repo, pkColumn, columns, redacted } = this.#requireContext(resource);
             // Authorize before the existence check (no 404-vs-403 oracle).
-            if (!(await authorizeAction(resource, "destroy", ctx, this.#authManager))) {
-                deny(ctx);
+            if (!(await this.#authorize(ctx, resource, "destroy")))
                 return;
-            }
             const id = ctx.params.id ?? "";
             const row = await repo.find(id);
             if (row === null) {
@@ -1226,13 +1311,14 @@ export default class StationProvider {
                 ctx.response.send(notFoundHtml);
                 return;
             }
-            const before = snapshotEntity(row, columns);
+            const before = snapshotEntity(row, columns, redacted);
             await repo.delete(row);
             await emitAudit(resource, {
                 action: "destroy",
                 resource: resource.name,
                 recordId: row[pkColumn],
                 userId: ctx.auth?.user?.id,
+                ...requestOrigin(ctx),
                 before,
                 at: new Date(),
             });
@@ -1333,7 +1419,7 @@ export default class StationProvider {
                 // Clear the stale cookie regardless of response shape, so neither
                 // a browser refresh nor an XHR caller retries with the dead token.
                 ctx.response.clearCookie?.(this.#authConfig.cookieName, {
-                    path: "/",
+                    path: AUTH_COOKIE_PATH,
                 });
                 if (this.#wantsJsonResponse(ctx)) {
                     ctx.response.status(401);
@@ -1369,6 +1455,11 @@ export default class StationProvider {
                     roleOk = false;
                 }
                 if (!roleOk) {
+                    await this.#securityEvent(ctx, {
+                        action: "denied",
+                        userId: user.id,
+                        permission: `role:${required}`,
+                    });
                     if (this.#wantsJsonResponse(ctx)) {
                         ctx.response.status(403);
                         ctx.response.json({ error: "insufficient role" });
@@ -1380,6 +1471,30 @@ export default class StationProvider {
                     return;
                 }
             }
+            // Entering the admin is its own grant (bug 214): without it, any app
+            // user holding a same-named permission for the public app got in.
+            const access = this.#authConfig.accessPermission;
+            if (access !== undefined) {
+                let accessOk;
+                try {
+                    accessOk =
+                        (await manager.hasPermission(user, access, "global")) === true;
+                }
+                catch (err) {
+                    const detail = err instanceof Error ? err.message : String(err);
+                    console.error(`[station] access check threw for '${access}' — denying (fail-closed): ${detail}`);
+                    accessOk = false;
+                }
+                if (!accessOk) {
+                    await this.#securityEvent(ctx, {
+                        action: "denied",
+                        userId: user.id,
+                        permission: access,
+                    });
+                    deny(ctx);
+                    return;
+                }
+            }
             const existingAuth = ctx.auth ?? {};
             ctx.auth = {
                 ...existingAuth,
@@ -1407,11 +1522,11 @@ export default class StationProvider {
                     }
                 }
             }
-            const qs = ctx.request.qs();
-            const errorParam = qs.error;
+            // No `?error=` read: Station never redirects with one (a failed POST
+            // re-renders inline), so its only use was a third party writing
+            // arbitrary text into the sign-in page's alert.
             const vm = buildLoginViewModel({
                 action: this.#authConfig.loginPath,
-                error: typeof errorParam === "string" ? errorParam : undefined,
                 csrfEnabled: ctx.store?.get("csrfToken") != null,
             });
             const html = await this.#renderView(ctx, "station::login", vm);
@@ -1431,7 +1546,7 @@ export default class StationProvider {
             // AuthManager work (see #buildCreateHandler). Login is open by design
             // (no auth gate), so CSRF is the sole pre-check here.
             if (ctx.request.csrfProtected !== true) {
-                denyCsrf(ctx);
+                await this.#denyCsrf(ctx);
                 return;
             }
             const manager = this.#authManager;
@@ -1457,12 +1572,21 @@ export default class StationProvider {
                 ctx.response.send(html);
                 return;
             }
+            // Counted BEFORE the credential check (warden's AuthRateLimiter
+            // contract): a refused attempt never reaches authenticate.
+            const keys = loginKeys(ctx.request.ip?.() ?? "unknown", email);
+            if (!(await this.#admitLogin(ctx, keys, email)))
+                return;
             const result = await manager.authenticate({ email, password });
             // Warden returns the issued token on `user.token`, not at the
             // top level — reading `result.token` (which never exists) sent
             // every valid login down the 401 branch.
             const token = typeof result.user?.token === "string" ? result.user.token : undefined;
             if (!result.authenticated || token === undefined) {
+                await this.#securityEvent(ctx, {
+                    action: "login_failed",
+                    identifier: email,
+                });
                 const vm = buildLoginViewModel({
                     action: this.#authConfig.loginPath,
                     email,
@@ -1475,15 +1599,132 @@ export default class StationProvider {
                 ctx.response.send(html);
                 return;
             }
+            await this.#loginLimiter?.clear(...keys);
+            await this.#securityEvent(ctx, {
+                action: "login",
+                userId: result.user?.id,
+                identifier: email,
+            });
+            // No maxAge: a session cookie, gone with the browser; the token's own
+            // expiry is enforced by verify() on every request.
             ctx.response.cookie?.(this.#authConfig.cookieName, token, {
                 httpOnly: true,
                 sameSite: "Lax",
-                secure: process.env.NODE_ENV === "production",
-                path: "/",
+                secure: this.#cookieSecure ?? secureByDefault(ctx),
+                path: AUTH_COOKIE_PATH,
             });
             ctx.response.redirect("/admin");
         };
     }
+    /**
+     * The per-action gate: allow, or record the refusal and answer 403.
+     */
+    async #authorize(ctx, resource, action) {
+        const prefix = this.#authConfig.permissionPrefix;
+        if (await authorizeAction(resource, action, ctx, this.#authManager, prefix)) {
+            return true;
+        }
+        await this.#securityEvent(ctx, {
+            action: "denied",
+            userId: ctx.auth?.user?.id,
+            resource: resource.name,
+            resourceAction: action,
+            permission: `${prefix}.${resource.name}.${action}`,
+        });
+        deny(ctx);
+        return false;
+    }
+    /** Record a CSRF block, then refuse it. */
+    async #denyCsrf(ctx) {
+        await this.#securityEvent(ctx, { action: "csrf_denied" });
+        denyCsrf(ctx);
+    }
+    /**
+     * Send a security event to `station.audit`, stamped with the request
+     * origin. A failing sink is logged, never allowed to change the response.
+     */
+    async #securityEvent(ctx, event) {
+        const sink = this.#securityAudit;
+        if (sink === undefined)
+            return;
+        try {
+            await sink({
+                ...event,
+                ...requestOrigin(ctx),
+                path: ctx.request.url?.(),
+                at: new Date(),
+            });
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            console.error(`[station] security audit sink threw on ${event.action}: ${detail}. The event was NOT recorded.`);
+        }
+    }
+    /**
+     * Revoke `token` through the default guard when it supports revocation.
+     * A guard without it (or a JwtStrategy without a blacklist, whose
+     * `revoke` throws) is reported once: logout then only clears the cookie.
+     */
+    async #revoke(token) {
+        const strategy = this.#authManager?.getStrategy?.();
+        let reason = "the auth guard has no revoke(token)";
+        if (typeof strategy === "object" &&
+            strategy !== null &&
+            "revoke" in strategy &&
+            typeof strategy.revoke === "function") {
+            try {
+                await strategy.revoke(token);
+                return;
+            }
+            catch (err) {
+                reason = err instanceof Error ? err.message : String(err);
+            }
+        }
+        if (revokeUnavailableWarned)
+            return;
+        revokeUnavailableWarned = true;
+        console.warn(`[station] Logout cannot revoke the admin token (${reason}); it stays valid until it expires. Give warden's JwtStrategy a \`blacklist\` so a logged-out token is refused.`);
+    }
+    /**
+     * Count a login attempt and answer the refusal when the limiter says no:
+     * 429 + Retry-After when exhausted, 503 when the limiter itself failed (a
+     * throttle that cannot count must not wave attempts through).
+     */
+    async #admitLogin(ctx, keys, email) {
+        const limiter = this.#loginLimiter;
+        if (limiter === undefined)
+            return true;
+        let decision;
+        try {
+            decision = await limiter.attempt(...keys);
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            console.error(`[station] login rate limiter failed — refusing the attempt (fail-closed): ${detail}`);
+            ctx.response.status(503);
+            ctx.response.type("text/plain; charset=utf-8");
+            ctx.response.send("Sign-in is temporarily unavailable.");
+            return false;
+        }
+        if (decision.allowed)
+            return true;
+        await this.#securityEvent(ctx, {
+            action: "login_throttled",
+            identifier: email,
+        });
+        ctx.response.status(429);
+        ctx.response.header("Retry-After", String(Math.max(1, Math.ceil(decision.retryAfterSeconds))));
+        const vm = buildLoginViewModel({
+            action: this.#authConfig.loginPath,
+            email,
+            error: "Too many sign-in attempts. Try again later.",
+            csrfEnabled: ctx.store?.get("csrfToken") != null,
+        });
+        const html = await this.#renderView(ctx, "station::login", vm);
+        ctx.response.type("text/html; charset=utf-8");
+        ctx.response.send(html);
+        return false;
+    }
     /**
      * `POST /admin/logout` — clear the session cookie and redirect to
      * the login page. POST (not GET) so a crafted `<img src>` can't log
@@ -1494,16 +1735,83 @@ export default class StationProvider {
             // Fail-close on CSRF: a forged cross-site POST must not be able to log
             // an admin out (session-fixation nuisance) (see #buildCreateHandler).
             if (ctx.request.csrfProtected !== true) {
-                denyCsrf(ctx);
+                await this.#denyCsrf(ctx);
                 return;
             }
+            // Clearing the cookie alone left the token valid until it expired:
+            // a copy taken before logout (shared machine, proxy log) still
+            // opened the admin.
+            const token = this.#readAuthToken(ctx);
+            if (token !== undefined) {
+                // Who is leaving, read before the token is revoked — only when
+                // someone is listening, since it costs a verify().
+                const userId = this.#securityAudit === undefined
+                    ? undefined
+                    : (await this.#authManager?.verify(token))?.user?.id;
+                await this.#revoke(token);
+                await this.#securityEvent(ctx, { action: "logout", userId });
+            }
+            else {
+                await this.#securityEvent(ctx, { action: "logout" });
+            }
             ctx.response.clearCookie?.(this.#authConfig.cookieName, {
-                path: "/",
+                path: AUTH_COOKIE_PATH,
             });
             ctx.response.redirect(this.#authConfig.loginPath);
         };
     }
 }
+/** Who sent the request, as far as the host can tell. */
+function requestOrigin(ctx) {
+    return {
+        ip: ctx.request.ip?.(),
+        userAgent: ctx.request.header?.("user-agent"),
+        requestId: ctx.request.id?.() ?? ctx.request.header?.("x-request-id"),
+    };
+}
+/**
+ * `Secure` unless this is a development/test process on plain HTTP — an
+ * unknown environment gets the production answer, and `NODE_ENV=prod` is
+ * production too.
+ */
+function secureByDefault(ctx) {
+    const env = normalizeNodeEnv(process.env.NODE_ENV);
+    if (env !== "development" && env !== "test")
+        return true;
+    return ctx.request.secure?.() === true;
+}
+function buildLoginLimiter(config) {
+    if (config === false)
+        return undefined;
+    if (config?.limiter !== undefined)
+        return config.limiter;
+    return new MemoryLoginLimiter(config?.maxAttempts, config?.windowSeconds);
+}
+/**
+ * A router whose every route gets `names` attached through the route's own
+ * `middleware(...names)` (ream's / AdonisJS's route API). A router that hands
+ * back no such method cannot honour the config, which is refused loudly.
+ */
+function withRouteMiddleware(router, names) {
+    if (names === undefined || names.length === 0)
+        return router;
+    const attach = (route) => {
+        if (typeof route !== "object" ||
+            route === null ||
+            !("middleware" in route) ||
+            typeof route.middleware !== "function") {
+            throw new Error("[station] `station.middleware` is set but the router's routes have no middleware() method to attach it with.");
+        }
+        route.middleware(...names);
+        return route;
+    };
+    return {
+        get: (path, handler) => attach(router.get(path, handler)),
+        post: (path, handler) => attach(router.post(path, handler)),
+        put: (path, handler) => attach(router.put(path, handler)),
+        delete: (path, handler) => attach(router.delete(path, handler)),
+    };
+}
 /**
  * Cross-package bridge — Station's `Resource.entity` is intentionally
  * typed `new (...args: never[]) => unknown` so the package type-compiles
@@ -1538,15 +1846,27 @@ function buildResourceContext(resource, db, atlas, rune) {
     const excludedProps = new Set(atlas.getRelationMetadata(resource.entity).map((r) => r.propertyKey));
     if (atlas.hasSoftDeletes(resource.entity))
         excludedProps.add("deletedAt");
+    const listColumns = viewColumns(columns, resource.list.columns, resource, "list.columns");
+    const showColumns = viewColumns(columns, resource.show.columns, resource, "show.columns");
+    const formColumns = editableColumns(columns, resource, pkColumn, autoManaged, excludedProps);
+    const writeOnly = writeOnlyKeys(formColumns, resource);
     const derived = rune === null
         ? undefined
-        : deriveWritableSchema(columns, pkColumn, autoManaged, excludedProps, rune);
+        : deriveWritableSchema(formColumns, pkColumn, autoManaged, excludedProps, rune, writeOnly);
     return {
         repo,
         columns,
+        listColumns,
+        showColumns,
+        formColumns,
+        writeOnly,
+        redacted: new Set(resource.auditSecrets
+            ? []
+            : columns.filter(isSecretColumn).map((c) => c.propertyKey)),
         pkColumn,
         autoManaged,
         writableSchema: derived?.schema,
+        updateSchema: derived?.updateSchema,
         booleanKeys: derived?.booleanKeys ?? new Set(),
     };
 }
@@ -1624,7 +1944,7 @@ function isRouterProxyUninit(err) {
 /**
  * 56.5 authorization gate. Returns true when the action is allowed.
  * Station authorizes EXCLUSIVELY through Warden's unified layer: the
- * decision is `auth.hasPermission(user, "<resource>.<action>", scope)`
+ * decision is `auth.hasPermission(user, "<prefix>.<resource>.<action>", scope)`
  * resolved via the container `"auth"` AuthManager (D1/D2). No
  * Station-local RBAC computation, no token-payload read.
  *
@@ -1644,7 +1964,8 @@ function isRouterProxyUninit(err) {
  * The result MUST be awaited at every call site — a forgotten `await`
  * yields a truthy Promise = silent ALLOW (AC10 probe 3).
  */
-async function authorizeAction(resource, action, ctx, authManager, scope = "global") {
+async function authorizeAction(resource, action, ctx, authManager, prefix, scope = "global") {
+    const permission = `${prefix}.${resource.name}.${action}`;
     if (authManager === undefined)
         return true;
     const user = ctx.auth?.user;
@@ -1657,13 +1978,13 @@ async function authorizeAction(resource, action, ctx, authManager, scope = "glob
         // Coerce to a strict boolean: the duck-typed manager could resolve a
         // truthy non-boolean, and `!truthy` would silently ALLOW. Anything
         // not exactly `true` denies (fail-closed).
-        return ((await authManager.hasPermission(user, `${resource.name}.${action}`, scope)) === true);
+        return (await authManager.hasPermission(user, permission, scope)) === true;
     }
     catch (err) {
         // A rights-store I/O failure (DB/Redis-backed resolver) must not pass
         // the gate. Deny and surface it loud rather than 500-ing or allowing.
         const detail = err instanceof Error ? err.message : String(err);
-        console.error(`[station] authorization check threw for '${resource.name}.${action}' — denying (fail-closed): ${detail}`);
+        console.error(`[station] authorization check threw for '${permission}' — denying (fail-closed): ${detail}`);
         return false;
     }
 }