@camstack/server 1.2.486 → 1.2.487

package/dist/api/core/auth.router.js

@@ -8,58 +8,71 @@
  * JWT signing stays in the server — it's a transport-level concern
  * (the server owns the secret and the HTTP session).
  *
- * Pre-auth login surfaces (OIDC / magic-link redirect buttons + the
+ * Pre-auth login surfaces (OIDC redirect buttons + the
  * passkey second-factor widget) are aggregated for the login page by the
  * public `listLoginMethods` procedure from the `login-method` cap
  * collection — the single, generic mechanism every auth addon contributes
  * to (superseding the removed `auth.listProviders`).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXCHANGE_SESSION_HEADER = void 0;
+exports.EXCHANGE_SESSION_HEADER = exports.BROWSER_HANDOFF_PATH = void 0;
 exports.createAuthRouter = createAuthRouter;
 const types_1 = require("@camstack/types");
 const server_1 = require("@trpc/server");
 const zod_1 = require("zod");
+const auth_network_policy_js_1 = require("../../auth/auth-network-policy.js");
 const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
 const auth_provider_gate_js_1 = require("../../auth/auth-provider-gate.js");
 const external_link_intents_js_1 = require("../../auth/external-link-intents.js");
 const passkey_provider_js_1 = require("../../auth/passkey-provider.js");
 const second_factors_js_1 = require("../../auth/second-factors.js");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
+const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
 const session_mint_js_1 = require("../../auth/session-mint.js");
 const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
 const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
 const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-// ── Public-auth rate limiting ────────────────────────────────────────
-// The public surface below (credential validation, passkey ceremonies,
-// one-time-code redemption) had NO throttling — unlimited online
-// guessing. Two tiers, fixed window per (procedure, client ip):
-//   • credential tier — anything that VERIFIES a secret (password, TOTP,
-//     passkey assertion, handoff code, session exchange): 10/min,
-//   • ceremony tier — begin-legs that only mint a challenge: 30/min.
-// Mesh-internal calls (no originating request) are never limited.
-const CREDENTIAL_ATTEMPT_LIMITER = (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 10 });
-const CEREMONY_LIMITER = (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 30 });
-function makeRateLimitedProcedure(limiter) {
+const auth_limits_js_1 = require("./auth-limits.js");
+const auth_admin_tokens_procedures_js_1 = require("./auth-admin-tokens.procedures.js");
+const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
+const auth_sessions_procedures_js_1 = require("./auth-sessions.procedures.js");
+/**
+ * A public procedure limited per (procedure, REAL client address) — see
+ * `auth-limits.ts` for the tiers and why the address is the forwarded client.
+ */
+function makeRateLimitedProcedure(limiter, network) {
     return trpc_middleware_js_1.publicProcedure.use(({ ctx, path, next }) => {
-        const key = (0, auth_rate_limit_js_1.clientKeyFromRequest)(ctx.req);
-        if (key !== null) {
-            const verdict = limiter.check(`${path}:${key}`);
-            if (!verdict.allowed) {
-                throw new server_1.TRPCError({
-                    code: 'TOO_MANY_REQUESTS',
-                    message: `Too many attempts — retry in ${verdict.retryAfterSeconds}s`,
-                });
-            }
-        }
+        (0, auth_limits_js_1.limitByClient)(limiter, path, ctx.req, network);
         return next({ ctx });
     });
 }
-/** Secret-verifying legs (password / TOTP / passkey assertion / codes). */
-const credentialProcedure = makeRateLimitedProcedure(CREDENTIAL_ATTEMPT_LIMITER);
-/** Challenge-minting begin-legs — looser, they verify nothing. */
-const ceremonyProcedure = makeRateLimitedProcedure(CEREMONY_LIMITER);
+/** Asks for the refresh-token flow (short access token + rotating refresh token). */
+const RefreshableInput = zod_1.z.boolean().optional();
+/** The request's User-Agent, trimmed, for the sessions list. */
+function clientLabel(req) {
+    const ua = req?.headers['user-agent'];
+    const value = Array.isArray(ua) ? ua[0] : ua;
+    return typeof value === 'string' && value.length > 0 ? value.slice(0, 200) : undefined;
+}
+/**
+ * Signed-in legs that mint or redeem a one-time code for the CALLER (native
+ * link claim, browser handoff — D801): per user, not per ip, because the
+ * caller is known and a tunnel puts every client behind one address.
+ */
+const SELF_CODE_LIMITER = (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 10 });
+const selfCodeProcedure = trpc_middleware_js_1.protectedProcedure.use(({ ctx, path, next }) => {
+    const verdict = SELF_CODE_LIMITER.check(`${path}:${ctx.user?.id ?? 'anonymous'}`);
+    if (!verdict.allowed) {
+        throw new server_1.TRPCError({
+            code: 'TOO_MANY_REQUESTS',
+            message: `Too many attempts — retry in ${verdict.retryAfterSeconds}s`,
+        });
+    }
+    return next({ ctx });
+});
+/** The hub route a browser-handoff code is redeemed at (`main.ts`). */
+exports.BROWSER_HANDOFF_PATH = '/api/auth/browser-handoff';
 /**
  * The available second-factor kinds a user may satisfy after the
  * password leg. Capability-driven — `totp` maps to the
@@ -92,12 +105,23 @@ const LoginResultSchema = zod_1.z.object({
     }),
     requiresTotp: zod_1.z.boolean().optional(),
     secondFactors: zod_1.z.array(second_factors_js_1.SecondFactorSchema).optional(),
+    /** When the access token expires (epoch ms). Absent on a challenge. */
+    expiresAt: zod_1.z.number().optional(),
+    /** The server-side login session. */
+    sessionId: zod_1.z.string().optional(),
+    /** When the session expires unless refreshed (epoch ms). */
+    sessionExpiresAt: zod_1.z.number().optional(),
+    /**
+     * Only when the client asked (`refreshable: true`): swap it at
+     * `auth.refreshSession` before `expiresAt`. Store it like a password.
+     */
+    refreshToken: zod_1.z.string().optional(),
 });
 // ── Login-method aggregation (login-method cap) ──────────────────────
 //
 // The PUBLIC `listLoginMethods` procedure walks the `login-method`
 // collection and returns the union that the login page renders directly:
-// `redirect` buttons (OIDC / magic-link), native `passkey` ceremonies, and
+// `redirect` buttons (OIDC), native `passkey` ceremonies, and
 // (generic mechanism, unused by shipped addons) pre-auth `widget`s.
 // The widget arm is enriched server-side with a public `bundleUrl` from
 // `addonId` + `bundle`, so the addon never encodes the static-route
@@ -177,7 +201,9 @@ function toShareTokenSummary(record) {
  * a leaked restricted token would otherwise widen its own reach.
  */
 function assertRealUserSession(user, what = 'Share-token management') {
-    if (user.isScoped || user.shareView) {
+    // An admin token is a script's credential, never a person's session: it
+    // must not turn itself into a session (handoff codes) or mint links.
+    if (user.isScoped || user.shareView || user.adminTokenId !== undefined) {
         throw new server_1.TRPCError({
             code: 'FORBIDDEN',
             message: `${what} requires a real user session`,
@@ -246,7 +272,6 @@ const MeSchema = zod_1.z
         allowedDevices: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
     }),
     isApiKey: zod_1.z.boolean(),
-    agentId: zod_1.z.string().optional(),
     /**
      * The caller's resolved effective scope. Absent only on the (unreachable
      * here — `me` is `protected`) null-principal branch.
@@ -254,7 +279,13 @@ const MeSchema = zod_1.z
     scope: EffectiveScopeSchema.optional(),
 })
     .nullable();
-function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService(), linkIntents = new external_link_intents_js_1.ExternalLinkIntents()) {
+function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService(), linkIntents = new external_link_intents_js_1.ExternalLinkIntents(), nativeLink = null, options = {}) {
+    const network = options.network ?? auth_network_policy_js_1.DEFAULT_AUTH_NETWORK_POLICY;
+    const limiters = options.limiters ?? auth_limits_js_1.PROCESS_AUTH_LIMITERS;
+    /** Secret-verifying legs (password / TOTP / passkey assertion / codes). */
+    const credentialProcedure = makeRateLimitedProcedure(limiters.credential, network);
+    /** Challenge-minting begin-legs — looser, they verify nothing. */
+    const ceremonyProcedure = makeRateLimitedProcedure(limiters.ceremony, network);
     const requireShareTokens = () => {
         if (!shareTokens) {
             throw new Error('Share tokens unavailable — service not wired on this node');
@@ -271,9 +302,21 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
     const minter = (0, session_mint_js_1.createSessionMinter)({
         signer: auth,
         directory: () => registry?.getSingleton('user-management'),
+        ...(options.sessions !== undefined ? { sessions: options.sessions } : {}),
     });
     const findUserById = minter.findUser;
-    const mintSessionForUserId = minter.mintForUserId;
+    /** How THIS request's login is recorded on its session. */
+    const issueFor = (req, method, refreshable) => {
+        const client = clientLabel(req);
+        const ip = network.clientAddress(req).ip;
+        return {
+            method,
+            refreshable: refreshable === true,
+            ...(client !== undefined ? { client } : {}),
+            ...(ip !== null ? { ip } : {}),
+        };
+    };
+    const mintSessionForUserId = (userId, issue) => minter.mintForUserId(userId, issue);
     /**
      * `mintSessionForUserId` with the "user vanished" failure mapped to a
      * clean 401 — for the token-exchange legs (`exchangeSession`,
@@ -281,9 +324,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
      * backing user may have been deleted mid-flight. Infrastructure
      * failures (user-management cap not registered) still surface as 500.
      */
-    const mintSessionOrUnauthorized = async (userId) => {
+    const mintSessionOrUnauthorized = async (userId, issue) => {
         try {
-            return await mintSessionForUserId(userId);
+            return await mintSessionForUserId(userId, issue);
         }
         catch (error) {
             if (error instanceof session_mint_js_1.SessionUserGoneError) {
@@ -302,6 +345,30 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             passkeyProvider: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer),
         }, userId, primary);
     };
+    /**
+     * The second factors THIS login owes: none when the operator listed a
+     * trusted network, the request came DIRECTLY from it (never through the
+     * tunnel or any proxy — `auth-network-policy.ts`), and the user has
+     * factors to skip. Every skip is audited.
+     */
+    const factorsOwedHere = async (userId, primary, req) => {
+        const factors = await collectSecondFactorsFor(userId, primary);
+        if (factors.length === 0)
+            return factors;
+        const address = network.clientAddress(req);
+        if (!network.isTrustedNetworkLogin(address))
+            return factors;
+        const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
+        if (internal === null)
+            return factors; // cannot audit it → do not skip it
+        await internal.audit.record({
+            action: 'second-factor-skipped',
+            userId,
+            ...(address.ip !== null ? { ip: address.ip } : {}),
+            detail: { method: primary, factors: factors.join(',') },
+        });
+        return [];
+    };
     /**
      * The login page's methods: every enabled auth addon's `login-method`
      * contributions (D777), validated and deduplicated. Shared by
@@ -312,7 +379,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             return [];
         const out = [];
         // Defense-in-depth dedupe: a routing bug in a grouped runner once
-        // resolved every provider to the same addon (3× identical magic-link
+        // resolved every provider to the same addon (3× identical login
         // buttons) — a duplicated contribution id must never render twice.
         const seenIds = new Set();
         for (const [addonId, provider] of registry.getCollectionEntries('login-method')) {
@@ -379,9 +446,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         : []);
     return (0, trpc_middleware_js_1.trpcRouter)({
         login: credentialProcedure
-            .input(zod_1.z.object({ username: zod_1.z.string(), password: zod_1.z.string() }))
+            .input(zod_1.z.object({ username: zod_1.z.string(), password: zod_1.z.string(), refreshable: RefreshableInput }))
             .output(LoginResultSchema)
-            .mutation(async ({ input }) => {
+            .mutation(async ({ input, ctx }) => {
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt) {
                 // The local-auth addon owns this cap. When this fires the
@@ -393,12 +460,15 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     'The `local-auth` addon failed to initialize; check server logs ' +
                     'for an error tagged `[hub/local-auth]`.');
             }
+            (0, auth_limits_js_1.assertAccountNotLocked)(limiters, input.username);
             const user = await userMgmt.validateCredentials({
                 username: input.username,
                 password: input.password,
             });
-            if (!user)
+            if (!user) {
+                (0, auth_limits_js_1.recordAccountFailure)(limiters, input.username);
                 throw new Error('Invalid credentials');
+            }
             // ── Second-factor gate ───────────────────────────────────────
             // After credentials validate, collect every ACTIVE second
             // factor (TOTP when enrolled; passkey only when enrolled AND
@@ -410,12 +480,13 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             // protected endpoints (the auth middleware rejects anything
             // without the standard session shape); the same token binds
             // both the TOTP and the passkey second legs (same userId).
-            const secondFactors = await collectSecondFactorsFor(user.id, 'password');
+            const secondFactors = await factorsOwedHere(user.id, 'password', ctx.req);
             if (secondFactors.length > 0) {
                 const challengeToken = auth.signTotpChallengeToken({
                     userId: user.id,
                     username: user.username,
                     isAdmin: user.isAdmin,
+                    method: 'password',
                 });
                 return {
                     token: challengeToken,
@@ -425,7 +496,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 };
             }
             // `user` is the record `validateCredentials` just read — fresh.
-            return minter.mintForRecord(user);
+            return minter.mintForRecord(user, issueFor(ctx.req, 'password', input.refreshable));
         }),
         /**
          * Second leg of the 2FA login. Accepts the challenge token minted
@@ -441,9 +512,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          *     deleted concurrently — rare).
          */
         loginVerifyTotp: credentialProcedure
-            .input(zod_1.z.object({ challengeToken: zod_1.z.string(), code: zod_1.z.string() }))
+            .input(zod_1.z.object({ challengeToken: zod_1.z.string(), code: zod_1.z.string(), refreshable: RefreshableInput }))
             .output(LoginResultSchema)
-            .mutation(async ({ input }) => {
+            .mutation(async ({ input, ctx }) => {
             const claims = auth.verifyTotpChallengeToken(input.challengeToken);
             if (!claims) {
                 throw new Error('Invalid or expired TOTP challenge — please re-enter your password');
@@ -452,13 +523,15 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             if (!userMgmt) {
                 throw new Error('Login unavailable — `user-management` capability not registered');
             }
+            (0, auth_limits_js_1.assertAccountNotLocked)(limiters, claims.username);
             const verify = typeof userMgmt.verifyTotp === 'function'
                 ? await userMgmt.verifyTotp({ userId: claims.userId, code: input.code.trim() })
                 : { valid: false };
             if (!verify.valid) {
+                (0, auth_limits_js_1.recordAccountFailure)(limiters, claims.username);
                 throw new Error('Invalid TOTP code');
             }
-            return mintSessionForUserId(claims.userId);
+            return mintSessionForUserId(claims.userId, issueFor(ctx.req, claims.method ?? 'password', input.refreshable));
         }),
         /**
          * Passkey second leg — step 1 of 2. Accepts the challenge token
@@ -488,9 +561,13 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * `loginVerifyTotp` uses (fresh user re-fetch for up-to-date scopes).
          */
         loginVerifyPasskey: credentialProcedure
-            .input(zod_1.z.object({ challengeToken: zod_1.z.string(), response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }))
+            .input(zod_1.z.object({
+            challengeToken: zod_1.z.string(),
+            response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+            refreshable: RefreshableInput,
+        }))
             .output(LoginResultSchema)
-            .mutation(async ({ input }) => {
+            .mutation(async ({ input, ctx }) => {
             const claims = auth.verifyTotpChallengeToken(input.challengeToken);
             if (!claims) {
                 throw new Error('Invalid or expired login challenge — please re-enter your password');
@@ -498,14 +575,16 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
+            (0, auth_limits_js_1.assertAccountNotLocked)(limiters, claims.username);
             const result = await provider.finishAuthentication({
                 userId: claims.userId,
                 response: input.response,
             });
             if (!result.verified) {
+                (0, auth_limits_js_1.recordAccountFailure)(limiters, claims.username);
                 throw new Error('Passkey verification failed');
             }
-            return mintSessionForUserId(claims.userId);
+            return mintSessionForUserId(claims.userId, issueFor(ctx.req, claims.method ?? 'password', input.refreshable));
         }),
         /**
          * Usernameless (passkey-FIRST) login — step 1 of 2. PUBLIC. Returns
@@ -515,9 +594,8 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * — no username, no password. The challenge is minted and stored by
          * the `user-passkeys` provider, deliberately NOT bound to any user.
          *
-         * Abuse surface: mirrors `login` — no rate limiting exists on any
-         * public auth procedure today; the challenge store is bounded only
-         * by its 5-min TTL prune.
+         * Abuse surface: limited per client address (ceremony tier); the
+         * challenge store is bounded by its 5-min TTL prune.
          */
         passkeyLoginBegin: ceremonyProcedure
             .input(zod_1.z.void())
@@ -544,9 +622,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * re-proving it adds nothing.
          */
         passkeyLoginFinish: credentialProcedure
-            .input(zod_1.z.object({ response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }))
+            .input(zod_1.z.object({ response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()), refreshable: RefreshableInput }))
             .output(LoginResultSchema)
-            .mutation(async ({ input }) => {
+            .mutation(async ({ input, ctx }) => {
             const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
@@ -556,13 +634,14 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             if (!result.verified || !result.userId) {
                 throw new server_1.TRPCError({ code: 'UNAUTHORIZED', message: 'Passkey verification failed' });
             }
-            const secondFactors = await collectSecondFactorsFor(result.userId, 'passkey');
+            const secondFactors = await factorsOwedHere(result.userId, 'passkey', ctx.req);
             if (secondFactors.length > 0) {
                 const challenged = await findUserById(result.userId);
                 const challengeToken = auth.signTotpChallengeToken({
                     userId: challenged.id,
                     username: challenged.username,
                     isAdmin: challenged.isAdmin,
+                    method: 'passkey',
                 });
                 return {
                     token: challengeToken,
@@ -575,7 +654,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     secondFactors,
                 };
             }
-            return mintSessionForUserId(result.userId);
+            return mintSessionForUserId(result.userId, issueFor(ctx.req, 'passkey', input.refreshable));
         }),
         /**
          * PUBLIC — upgrade the browser's httpOnly session COOKIE into a
@@ -598,9 +677,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          *     scopes), equivalent to what `auth.login` hands out.
          */
         exchangeSession: credentialProcedure
-            .input(zod_1.z.object({}).optional())
+            .input(zod_1.z.object({ refreshable: RefreshableInput }).optional())
             .output(LoginResultSchema)
-            .mutation(async ({ ctx }) => {
+            .mutation(async ({ ctx, input }) => {
             if (readRequestHeader(ctx.req, exports.EXCHANGE_SESSION_HEADER) !== '1') {
                 throw new server_1.TRPCError({
                     code: 'FORBIDDEN',
@@ -627,7 +706,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 typeof payload.userId !== 'string') {
                 throw new server_1.TRPCError({ code: 'UNAUTHORIZED', message: 'Invalid session cookie' });
             }
-            return mintSessionOrUnauthorized(payload.userId);
+            // A session of its own for the client that asked (the hub-served
+            // viewer): signing out of one never signs the other out.
+            return mintSessionOrUnauthorized(payload.userId, issueFor(ctx.req, 'exchange', input?.refreshable));
         }),
         // ── One-time handoff codes (native-app login handoff) ─────────────
         //
@@ -640,18 +721,24 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          *  sessions only — scoped (`cst_`) and share-view (`csv_`) callers
          *  must never convert themselves into a full session. */
         createHandoffCode: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
+            .input(zod_1.z.object({ purpose: zod_1.z.enum(['renew', 'new-session']).optional() }).optional())
             .output(zod_1.z.object({ code: zod_1.z.string(), expiresAt: zod_1.z.number() }))
-            .mutation(({ ctx }) => {
+            .mutation(({ ctx, input }) => {
             assertRealUserSession(ctx.user, 'Handoff-code minting');
-            return handoffCodes.create(ctx.user.id);
+            // `renew` (the default — what installed viewer apps call this for)
+            // continues THIS session; `new-session` (signing the native app in)
+            // opens a separate one for the redeemer.
+            return handoffCodes.create(ctx.user.id, {
+                ...(ctx.user.sessionId !== undefined ? { sessionId: ctx.user.sessionId } : {}),
+                purpose: input?.purpose ?? 'renew',
+            });
         }),
         /** PUBLIC — redeem a one-time handoff code for a session bearer.
          *  Unknown / expired / already-used codes → UNAUTHORIZED. */
         redeemHandoffCode: credentialProcedure
-            .input(zod_1.z.object({ code: zod_1.z.string().min(1) }))
+            .input(zod_1.z.object({ code: zod_1.z.string().min(1), refreshable: RefreshableInput }))
             .output(LoginResultSchema)
-            .mutation(async ({ input }) => {
+            .mutation(async ({ input, ctx }) => {
             const grant = handoffCodes.redeem(input.code);
             if (!grant) {
                 throw new server_1.TRPCError({
@@ -659,7 +746,24 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     message: 'Invalid or expired handoff code',
                 });
             }
-            return mintSessionOrUnauthorized(grant.userId);
+            if (grant.purpose === 'renew' && grant.sessionId !== undefined) {
+                // A legacy client renewing: the SAME session, its expiry slides. A
+                // session revoked meanwhile (logout elsewhere) renews nothing.
+                try {
+                    return await minter.continueSession(grant.userId, grant.sessionId);
+                }
+                catch (error) {
+                    if (error instanceof session_mint_js_1.SessionRefreshRefusedError ||
+                        error instanceof session_mint_js_1.SessionUserGoneError) {
+                        throw new server_1.TRPCError({
+                            code: 'UNAUTHORIZED',
+                            message: 'Session expired — sign in again',
+                        });
+                    }
+                    throw error;
+                }
+            }
+            return mintSessionOrUnauthorized(grant.userId, issueFor(ctx.req, 'handoff', input.refreshable));
         }),
         me: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.void())
@@ -735,7 +839,16 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             });
             if (!ok)
                 throw new Error('Current password is incorrect');
-            await userMgmt.resetPassword({ id: ctx.user.id, newPassword: input.newPassword });
+            // Hub-internal: the password changes AND every other session of the
+            // user ends (this one stays signed in).
+            const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
+            if (internal === null)
+                throw new Error('user-management capability not available');
+            await internal.setPassword({
+                userId: ctx.user.id,
+                newPassword: input.newPassword,
+                ...(ctx.user.sessionId !== undefined ? { keepSessionId: ctx.user.sessionId } : {}),
+            });
             return { success: true };
         }),
         setupOwnTotp: trpc_middleware_js_1.protectedProcedure
@@ -761,9 +874,11 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             return userMgmt.confirmTotp({ userId: ctx.user.id, code: input.code });
         }),
         disableOwnTotp: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
+            // Re-authentication required: a session alone must not strip 2FA.
+            .input(zod_1.z.object({ reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput }).optional())
             .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
-            .mutation(async ({ ctx }) => {
+            .mutation(async ({ ctx, input }) => {
+            (0, auth_reauth_procedures_js_1.assertReauthenticated)(auth, ctx.user, input?.reauthToken);
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt)
                 throw new Error('user-management capability not available');
@@ -831,11 +946,13 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             }
         }),
         removeOwnPasskey: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ credentialId: zod_1.z.string() }))
+            // Re-authentication required: removing a passkey can strip a factor.
+            .input(zod_1.z.object({ credentialId: zod_1.z.string(), reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional() }))
             .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
             .mutation(async ({ input, ctx }) => {
             if (!ctx.user)
                 throw new Error('Not authenticated');
+            (0, auth_reauth_procedures_js_1.assertReauthenticated)(auth, ctx.user, input.reauthToken);
             const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey management is not available');
@@ -939,22 +1056,30 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 });
             }
         }),
-        /** Own tokens for regular users; the full set for admins. */
+        /**
+         * Share links. `owner: 'self'` — the caller's own (My access);
+         * `owner: 'all'` — every user's, admin only. Omitted keeps the original
+         * answer (own for a user, all for an admin) for clients that predate it.
+         */
         listShareTokens: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
+            .input(zod_1.z.object({ owner: zod_1.z.enum(['self', 'all']).optional() }).optional())
             .output(zod_1.z.array(ShareTokenSummarySchema))
-            .query(async ({ ctx }) => {
+            .query(async ({ ctx, input }) => {
             assertRealUserSession(ctx.user);
             const service = requireShareTokens();
-            const records = ctx.user.isAdmin
-                ? await service.listAll()
-                : await service.listForUser(ctx.user.id);
+            const owner = input?.owner ?? (ctx.user.isAdmin ? 'all' : 'self');
+            if (owner === 'all' && !ctx.user.isAdmin) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: "Listing every user's share links requires an admin",
+                });
+            }
+            const records = owner === 'all' ? await service.listAll() : await service.listForUser(ctx.user.id);
             return records.map(toShareTokenSummary);
         }),
-        logout: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
-            .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
-            .mutation(() => ({ success: true })),
+        ...(0, auth_sessions_procedures_js_1.createSessionProcedures)({ registry, minter, credentialProcedure }),
+        ...(0, auth_reauth_procedures_js_1.createReauthProcedures)({ auth, registry, moleculer, limiters }),
+        ...(0, auth_admin_tokens_procedures_js_1.createAdminTokenProcedures)({ auth, registry, network }),
         // ── External sign-in identities (D782) ────────────────────────
         //
         // A signed-in user links an OIDC identity to THEIR OWN account. The
@@ -966,14 +1091,36 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             .input(zod_1.z.void())
             .output(zod_1.z.array(zod_1.z.object({ provider: zod_1.z.string(), label: zod_1.z.string() })))
             .query(async () => (await linkableProviders()).map(({ provider, label }) => ({ provider, label }))),
-        /** Start linking `provider` to the caller; the client navigates to `url`. */
+        /**
+         * Start linking `provider` to the caller; the client navigates to `url`.
+         * `returnTo` (D801): the native app's callback — allowlisted
+         * (`APP_AUTH_CALLBACK_URLS`); the finish then parks the link for the app
+         * to claim with `completeExternalLink` instead of needing a session cookie.
+         */
         beginExternalLink: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ provider: zod_1.z.string().min(1) }))
+            .input(zod_1.z.object({
+            provider: zod_1.z.string().min(1),
+            returnTo: zod_1.z.string().optional(),
+            /** From `auth.reauthenticate` — linking needs a fresh proof, not just a session. */
+            reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
+        }))
             .output(zod_1.z.object({ url: zod_1.z.string() }))
             .mutation(async ({ ctx, input }) => {
             if (!ctx.user)
                 throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
             assertRealUserSession(ctx.user, 'Linking a sign-in account');
+            // Per user AND per client: each call mints an entry in a bounded
+            // shared map, so a flood must not evict other users' pending links.
+            (0, auth_limits_js_1.limitByUser)(limiters.link, 'auth.beginExternalLink', ctx.user.id);
+            (0, auth_limits_js_1.limitByClient)(limiters.ceremony, 'auth.beginExternalLink', ctx.req, network);
+            (0, auth_reauth_procedures_js_1.assertReauthenticated)(auth, ctx.user, input.reauthToken);
+            const returnTo = input.returnTo === undefined ? undefined : (0, types_1.parseAppAuthCallback)(input.returnTo);
+            if (returnTo === null) {
+                throw new server_1.TRPCError({
+                    code: 'BAD_REQUEST',
+                    message: 'returnTo is not an allowed app callback',
+                });
+            }
             const target = (await linkableProviders()).find((p) => p.provider === input.provider);
             if (target === undefined) {
                 throw new server_1.TRPCError({
@@ -981,10 +1128,64 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     message: `Sign-in provider "${input.provider}" is not available for linking`,
                 });
             }
-            const handle = linkIntents.create(ctx.user.id, target.provider);
+            const handle = linkIntents.create(ctx.user.id, target.provider, returnTo);
             const separator = target.startUrl.includes('?') ? '&' : '?';
             return { url: `${target.startUrl}${separator}link=${encodeURIComponent(handle)}` };
         }),
+        /**
+         * Claim a native link the SSO finish parked (D801). Bound HERE: the
+         * caller must be the user the intent was minted for — a code delivered to
+         * another account's app links nothing. The code is spent by this call
+         * whatever the outcome.
+         */
+        completeExternalLink: selfCodeProcedure
+            .input(zod_1.z.object({ code: zod_1.z.string().min(1).max(256) }))
+            .output(zod_1.z.object({
+            outcome: zod_1.z.enum(['linked', 'conflict', 'expired', 'session']),
+            provider: zod_1.z.string().optional(),
+        }))
+            .mutation(async ({ ctx, input }) => {
+            if (!ctx.user)
+                throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
+            assertRealUserSession(ctx.user, 'Linking a sign-in account');
+            if (nativeLink === null) {
+                throw new server_1.TRPCError({
+                    code: 'PRECONDITION_FAILED',
+                    message: 'Native linking is not available',
+                });
+            }
+            const parked = nativeLink.completions.claim(input.code);
+            if (parked === null)
+                return { outcome: 'expired' };
+            if (parked.userId !== ctx.user.id)
+                return { outcome: 'session' };
+            const outcome = await nativeLink.link(parked);
+            return { outcome, provider: parked.provider };
+        }),
+        /**
+         * A one-time code that opens the hub's account page signed in as the
+         * caller, in a browser (D801) — for what only a browser can do at the
+         * hub's origin: a passkey's WebAuthn ceremony. Single-use, 60 s, and it
+         * lands on that page only: the route takes no destination.
+         */
+        createBrowserHandoff: selfCodeProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.object({ path: zod_1.z.string(), expiresAt: zod_1.z.number() }))
+            .mutation(({ ctx }) => {
+            if (!ctx.user)
+                throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
+            assertRealUserSession(ctx.user, 'Opening the account page in a browser');
+            if (nativeLink === null) {
+                throw new server_1.TRPCError({
+                    code: 'PRECONDITION_FAILED',
+                    message: 'Browser handoff is not available',
+                });
+            }
+            const { code, expiresAt } = nativeLink.browserHandoffs.create(ctx.user.id, {
+                purpose: 'new-session',
+            });
+            return { path: `${exports.BROWSER_HANDOFF_PATH}?code=${encodeURIComponent(code)}`, expiresAt };
+        }),
         /** The caller's linked identities; `available: false` when the provider instance is gone or off. */
         listOwnExternalIdentities: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.void())
@@ -1026,7 +1227,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         /**
          * PUBLIC — the login page's single source of pre-auth login surfaces.
          * Aggregates the `login-method` collection: every auth addon (OIDC,
-         * magic-link, WebAuthn) contributes `redirect` buttons and/or pre-auth
+         * WebAuthn) contributes `redirect` buttons and/or pre-auth
          * `widget`s, each tagged `stage: 'primary' | 'second-factor'`. The
          * login page renders `redirect` methods as generic buttons and mounts
          * `widget` methods via `loadRemoteBundle` — a future SSO addon plugs