@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/sessions/__tests__/rebuild-survival.integration.test.ts

@@ -1,4 +1,5 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createRegistry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
@@ -19,7 +20,7 @@ import { createUserFeature } from "../../user/feature";
 import { createSessionsFeature } from "../feature";
 import { userSessionEntity, userSessionTable } from "../schema/user-session";
 
-// read_user_sessions is a hot-path direct-write store: sessionCreator inserts
+// store_user_sessions is a hot-path direct-write store: sessionCreator inserts
 // rows and the revoke handlers update them WITHOUT emitting lifecycle events.
 // If the table is registered as an r.entity, the framework makes it a
 // rebuildable implicit projection whose replay finds zero matching events and
@@ -27,7 +28,7 @@ import { userSessionEntity, userSessionTable } from "../schema/user-session";
 // session on the next projection rebuild (deploy / `schema apply`). #498/#494.
 //
 // Pre-fix both tests are RED: the implicit projection "sessions:projection:
-// user-session-entity" exists and rebuilding it empties read_user_sessions.
+// user-session-entity" exists and rebuilding it empties store_user_sessions.
 // Post-fix (r.unmanagedTable) the table is no longer a rebuild target.
 
 const IMPLICIT_PROJECTION = "sessions:projection:user-session-entity";
@@ -48,7 +49,7 @@ afterAll(async () => {
 
 beforeEach(async () => {
   await asRawClient(testDb.db).unsafe(
-    "TRUNCATE read_user_sessions, kumiko_events, kumiko_projections RESTART IDENTITY CASCADE",
+    "TRUNCATE store_user_sessions, kumiko_events, kumiko_projections RESTART IDENTITY CASCADE",
   );
 });
 
@@ -56,7 +57,9 @@ beforeEach(async () => {
 // written directly on the hot path, then revoked — no events anywhere.
 const SID = "00000000-0000-0000-0000-000000000001";
 
-async function insertRevokedSession(db: DbConnection): Promise<void> {
+async function insertRevokedSession(
+  db: DbConnection | ReturnType<typeof createTenantDb>,
+): Promise<void> {
   const now = Temporal.Now.instant();
   await seedRow(db, userSessionTable, {
     id: SID,
@@ -70,16 +73,24 @@ async function insertRevokedSession(db: DbConnection): Promise<void> {
   await updateRows(db, userSessionTable, { revokedAt: now }, { id: SID, revokedAt: null });
 }
 
-describe("sessions / read_user_sessions survives projection rebuild", () => {
+describe("sessions / store_user_sessions survives projection rebuild", () => {
   test("is NOT registered as a rebuildable implicit projection", () => {
-    const registry = createRegistry([createSessionsFeature(), createUserFeature()]);
+    const registry = createRegistry([
+      authFoundationFeature,
+      createSessionsFeature(),
+      createUserFeature(),
+    ]);
     expect(registry.getAllProjections().has(IMPLICIT_PROJECTION)).toBe(false);
   });
 
   test("direct-written rows (incl. revoked state) survive a rebuild", async () => {
     await insertRevokedSession(createTenantDb(testDb.db, TENANT));
 
-    const registry = createRegistry([createSessionsFeature(), createUserFeature()]);
+    const registry = createRegistry([
+      authFoundationFeature,
+      createSessionsFeature(),
+      createUserFeature(),
+    ]);
     // Pre-fix: the implicit projection exists → rebuild swaps an empty shadow
     // → rows wiped. Post-fix: absent → no rebuild → rows untouched. Either way
     // a regression (re-adding r.entity) makes this fail.

package/src/sessions/__tests__/session-store-registration.test.ts

@@ -0,0 +1,21 @@
+// sessions self-registers as auth-foundation's sessionStore provider (#1371)
+// instead of only being wired by hand into buildServer({ auth: { ... } }).
+
+import { describe, expect, test } from "bun:test";
+import { EXT_SESSION_STORE } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { createSessionsFeature } from "../feature";
+
+describe("createSessionsFeature — sessionStore registration (#1371)", () => {
+  test('registers via r.useExtension(EXT_SESSION_STORE, "default", ...)', () => {
+    const feature = createSessionsFeature();
+    const usage = feature.extensionUsages.find((u) => u.extensionName === EXT_SESSION_STORE);
+    expect(usage).toBeDefined();
+    expect(usage?.entityName).toBe("default");
+    expect(typeof (usage?.options as { build?: unknown } | undefined)?.build).toBe("function");
+  });
+
+  test("requires auth-foundation (owner of EXT_SESSION_STORE)", () => {
+    const feature = createSessionsFeature();
+    expect(feature.requires).toContain("auth-foundation");
+  });
+});

package/src/sessions/__tests__/sessions-screens.boot.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, test } from "bun:test";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { authFoundationFeature } from "../../auth-foundation";
+import { createConfigFeature } from "../../config/feature";
+import { createPersonalAccessTokensFeature } from "../../personal-access-tokens";
+import { createTenantFeature } from "../../tenant";
+import { createUserFeature } from "../../user/feature";
+import { SESSION_DETAIL_SCREEN_ID, SESSION_LIST_SCREEN_ID } from "../constants";
+import { createSessionsFeature } from "../feature";
+
+describe("sessions screens + query access alignment (kumiko-framework#255)", () => {
+  const features = [
+    createConfigFeature(),
+    createUserFeature(),
+    createTenantFeature(),
+    authFoundationFeature,
+    createPersonalAccessTokensFeature({ scopes: {} }),
+    createSessionsFeature(),
+  ];
+
+  test("boot-validates with session-list/session-detail screens registered", () => {
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("session-list is projectionList, session-detail is projectionDetail, both admin-gated", () => {
+    const sessions = createSessionsFeature();
+    const list = sessions.screens[SESSION_LIST_SCREEN_ID];
+    expect(list?.type).toBe("projectionList");
+    const detail = sessions.screens[SESSION_DETAIL_SCREEN_ID];
+    expect(detail?.type).toBe("projectionDetail");
+    for (const screen of [list, detail]) {
+      if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+        expect(screen.access.roles).toEqual(["TenantAdmin", "Admin", "SystemAdmin"]);
+      }
+    }
+  });
+
+  test("session-list row-action navigates to session-detail with entityId 'id'", () => {
+    const sessions = createSessionsFeature();
+    const list = sessions.screens[SESSION_LIST_SCREEN_ID];
+    if (list?.type !== "projectionList") throw new Error("expected projectionList");
+    const openAction = list.rowActions?.find((a) => a.id === "open");
+    if (openAction?.kind !== "navigate") throw new Error("expected a navigate rowAction");
+    expect(openAction.screen).toBe(SESSION_DETAIL_SCREEN_ID);
+    expect(openAction.entityId).toBe("id");
+  });
+
+  test("sessions queries share the admin-or-higher access rule", () => {
+    const sessions = createSessionsFeature();
+    const roles = ["TenantAdmin", "Admin", "SystemAdmin"];
+    expect(rolesOf(sessions.queryHandlers["user-session:list"]?.access)).toEqual(roles);
+    expect(rolesOf(sessions.queryHandlers["user-session:detail"]?.access)).toEqual(roles);
+  });
+});

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -1,17 +1,28 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
+import {
+  configureBlindIndexKey,
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   setupTestStack,
   type TestStack,
+  TestUsers,
   testTenantId,
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createLateBoundHolder,
+  createTestEnvelopeCipher,
   deleteRows,
   resetTestTables,
   updateRows,
@@ -31,6 +42,7 @@ import { SessionHandlers, SessionQueries } from "../constants";
 import { createSessionsFeature } from "../feature";
 import { userSessionEntity, userSessionTable } from "../schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../session-callbacks";
+import { SESSION_REVOKED_EVENT_QN, type SessionRevokedPayload } from "../session-revoked-event";
 import { sessionCallbacksFromLateBound } from "../testing";
 import { makeSessionHelpers } from "./test-helpers";
 
@@ -47,8 +59,8 @@ const encryptionKey = randomBytes(32).toString("base64");
 const TENANT: TenantId = testTenantId(1);
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
 
   stack = await setupTestStack({
@@ -57,6 +69,7 @@ beforeAll(async () => {
       createUserFeature(),
       createTenantFeature(),
       createAuthEmailPasswordFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
     ],
     extraContext: { configResolver: resolver, configEncryption: encryption },
@@ -67,12 +80,13 @@ beforeAll(async () => {
     },
   });
   callbacks.set(createSessionCallbacks({ db: stack.db }));
-  h = makeSessionHelpers(stack, TENANT);
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator);
 
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await createEventsTable(stack.db);
 });
 
 afterAll(async () => {
@@ -80,7 +94,12 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await resetTestTables(stack.db, [userTable, tenantMembershipsTable, userSessionTable]);
+  await resetTestTables(stack.db, [
+    userTable,
+    tenantMembershipsTable,
+    userSessionTable,
+    eventsTable,
+  ]);
 });
 
 describe("sessions feature — login → check → revoke → rejected", () => {
@@ -89,9 +108,10 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     const { sid } = await h.login("persist@example.com", "pw-long-enough");
 
     const rows = await selectMany(stack.db, userSessionTable);
-    expect(rows).toHaveLength(1);
-    expect(rows[0]?.["id"]).toBe(sid);
-    expect(rows[0]?.["revokedAt"]).toBeNull();
+    const userRows = rows.filter((r) => r["userId"] !== TestUsers.systemAdmin.id);
+    expect(userRows).toHaveLength(1);
+    expect(userRows[0]?.["id"]).toBe(sid);
+    expect(userRows[0]?.["revokedAt"]).toBeNull();
   });
 
   test("authenticated request passes while session is live, 401s once revoked", async () => {
@@ -130,8 +150,9 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     expect(logoutRes.status).toBe(200);
 
     const rows = await selectMany(stack.db, userSessionTable);
-    expect(rows[0]?.["id"]).toBe(sid);
-    expect(rows[0]?.["revokedAt"]).not.toBeNull();
+    const row = rows.find((r) => r["id"] === sid);
+    expect(row?.["id"]).toBe(sid);
+    expect(row?.["revokedAt"]).not.toBeNull();
 
     const next = await h.authedPost("/api/query", token, {
       type: "user:query:user:me",
@@ -178,6 +199,69 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     expect(preservedRevokedAt?.epochMilliseconds).toBe(originalRevokedAt?.epochMilliseconds);
   });
 
+  // #1559 — store_user_sessions stays a direct-write store (no CRUD
+  // lifecycle events, see feature.ts), but a successful revoke must still
+  // append a lightweight session-revoked event so a cross-instance
+  // consumer (#1560) can react. Asserted directly against kumiko_events —
+  // the response body carries no trace of it.
+  test("revoke appends a session-revoked event carrying the userId + sid", async () => {
+    const { userId } = await h.seedUser("event1@example.com", "pw-long-enough");
+    const { token, sid } = await h.login("event1@example.com", "pw-long-enough");
+
+    const res = await h.authedPost("/api/write", token, {
+      type: SessionHandlers.revoke,
+      payload: { id: sid },
+    });
+    expect(res.status).toBe(200);
+
+    const events = await selectMany(stack.db, eventsTable, { type: SESSION_REVOKED_EVENT_QN });
+    expect(events).toHaveLength(1);
+    const payload = events[0]?.["payload"] as SessionRevokedPayload;
+    expect(payload.userId).toBe(userId);
+    expect(payload.sessionIds).toEqual([sid]);
+  });
+
+  // Negative case: an already-revoked sid must NOT emit a second event —
+  // a spurious invalidation is the failure mode #1559 guards against.
+  test("revoking an already-revoked sid emits no additional event", async () => {
+    await h.seedUser("event2@example.com", "pw-long-enough");
+    const first = await h.login("event2@example.com", "pw-long-enough");
+
+    await h.authedPost("/api/write", first.token, {
+      type: SessionHandlers.revoke,
+      payload: { id: first.sid },
+    });
+
+    const second = await h.login("event2@example.com", "pw-long-enough");
+    const retry = await h.authedPost("/api/write", second.token, {
+      type: SessionHandlers.revoke,
+      payload: { id: first.sid },
+    });
+    expect(retry.status).toBe(422);
+
+    const events = await selectMany(stack.db, eventsTable, { type: SESSION_REVOKED_EVENT_QN });
+    expect(events).toHaveLength(1); // only the first, successful revoke
+  });
+
+  test("revoke-all-others appends one event listing every revoked sid", async () => {
+    const { userId } = await h.seedUser("event3@example.com", "pw-long-enough");
+    const a = await h.login("event3@example.com", "pw-long-enough");
+    const b = await h.login("event3@example.com", "pw-long-enough");
+    const c = await h.login("event3@example.com", "pw-long-enough");
+
+    const res = await h.authedPost("/api/write", b.token, {
+      type: SessionHandlers.revokeAllOthers,
+      payload: {},
+    });
+    expect(res.status).toBe(200);
+
+    const events = await selectMany(stack.db, eventsTable, { type: SESSION_REVOKED_EVENT_QN });
+    expect(events).toHaveLength(1);
+    const payload = events[0]?.["payload"] as SessionRevokedPayload;
+    expect(payload.userId).toBe(userId);
+    expect(new Set(payload.sessionIds)).toEqual(new Set([a.sid, c.sid]));
+  });
+
   test("session:mine only returns live sessions, marks the current one", async () => {
     await h.seedUser("mine@example.com", "pw-long-enough");
     // Three logins = three sessions (think: browser, mobile app, tablet)
@@ -286,12 +370,13 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     expect(body.error?.details?.reason).toBe("ownership_denied");
   });
 
-  test("revoke-all-others on a sidless JWT refuses loudly (session_required)", async () => {
+  test("revoke-all-others on a sidless JWT is rejected by the middleware (no_sid)", async () => {
     const { userId } = await h.seedUser("sidless@example.com", "pw-long-enough");
 
-    // Hand-sign a JWT without jti — simulates a stateless-JWT deployment
-    // or a rolling-deploy gap. "sign out everywhere else" is ill-defined
-    // without knowing which session is "current", so refuse.
+    // Hand-sign a JWT without jti. Once a sessionChecker is wired there is
+    // no relaxed mode (see session-strict-mode.integration.test.ts) — the
+    // middleware rejects it with no_sid before the handler's own
+    // session_required guard is ever reached.
     const tokenNoSid = await stack.jwt.sign({ id: userId, tenantId: TENANT, roles: ["User"] });
 
     const res = await stack.http.raw(
@@ -300,9 +385,9 @@ describe("sessions feature — login → check → revoke → rejected", () => {
       { type: SessionHandlers.revokeAllOthers, payload: {} },
       { Authorization: `Bearer ${tokenNoSid}` },
     );
-    expect(res.status).toBe(422);
+    expect(res.status).toBe(401);
     const body = (await res.json()) as { error?: { details?: { reason?: string } } };
-    expect(body.error?.details?.reason).toBe("session_required");
+    expect(body.error?.details?.reason).toBe("no_sid");
   });
 
   test("N concurrent revoke+logout requests on the same sid converge safely", async () => {
@@ -383,6 +468,41 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     expect(body.error?.details?.reason).toBe("missing");
   });
 
+  // Cross-user check: a valid JWT for Alice paired with Bob's live sid must
+  // look identical to a forged/missing sid — otherwise the checker would be
+  // an existence oracle on other users' sessions.
+  test("sid belonging to another user → 401 reason=missing (no existence oracle)", async () => {
+    const alice = await h.seedUser("alice-xuser@example.com", "pw-long-enough");
+    const bob = await h.seedUser("bob-xuser@example.com", "pw-long-enough");
+    const bobLogin = await h.login("bob-xuser@example.com", "pw-long-enough");
+
+    // Direct invariant: Bob's sid + Alice's userId → missing (not live/revoked).
+    expect(await callbacks.get().sessionChecker(bobLogin.sid, alice.userId)).toBe("missing");
+    expect(await callbacks.get().sessionChecker(bobLogin.sid, bob.userId)).toBe("live");
+
+    // HTTP path: mint Alice's identity onto Bob's sid (stolen-sid scenario).
+    const forged = await stack.jwt.sign({
+      id: alice.userId,
+      tenantId: TENANT,
+      roles: ["User"],
+      sid: bobLogin.sid,
+    });
+    const res = await h.authedPost("/api/query", forged, {
+      type: "user:query:user:me",
+      payload: {},
+    });
+    expect(res.status).toBe(401);
+    const body = (await res.json()) as { error?: { details?: { reason?: string } } };
+    expect(body.error?.details?.reason).toBe("missing");
+
+    // Control: Bob's own JWT still authenticates — the sid itself is fine.
+    const bobOk = await h.authedPost("/api/query", bobLogin.token, {
+      type: "user:query:user:me",
+      payload: {},
+    });
+    expect(bobOk.status).toBe(200);
+  });
+
   test("expired session row → 401 with reason=expired", async () => {
     await h.seedUser("stale@example.com", "pw-long-enough");
     const { token, sid } = await h.login("stale@example.com", "pw-long-enough");
@@ -448,10 +568,13 @@ describe("sessions feature — login → check → revoke → rejected", () => {
         revokedAt: string | null;
       }>;
     };
-    // Three rows total: Alice's pre-promotion session, Alice's post-promotion
-    // session, Bob's session. Two distinct users.
-    expect(body.data).toHaveLength(3);
-    const userIds = new Set(body.data.map((r) => r.userId));
+    // Three rows total for the two test users: Alice's pre-promotion session,
+    // Alice's post-promotion session, Bob's session. seedUser's bootstrap
+    // actor (systemAdmin) also holds live sessions in this tenant — exclude
+    // them, they aren't part of what this test pins.
+    const nonSystemRows = body.data.filter((r) => r.userId !== TestUsers.systemAdmin.id);
+    expect(nonSystemRows).toHaveLength(3);
+    const userIds = new Set(nonSystemRows.map((r) => r.userId));
     expect(userIds.size).toBe(2);
 
     // Order: most-recently-created first. aliceAsAdmin's session was the
@@ -459,6 +582,94 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     // silent orderBy removal.
     expect(body.data[0]?.id).toBe(aliceAsAdmin.sid);
   });
+
+  // Single-row inspector backing the session-detail screen (kumiko-framework#255).
+  // Same access-gate as session:list (admin-or-higher); verifies field-shape,
+  // decryption of ip/userAgent, and the "unknown id" not-found path.
+  test("session:detail returns one decrypted row for admins, null for an unknown id", async () => {
+    const { userId: aliceId } = await h.seedUser("alice3@example.com", "pw-long-enough");
+
+    await updateRows(
+      stack.db,
+      tenantMembershipsTable,
+      { roles: JSON.stringify(["Admin"]) },
+      { userId: aliceId, tenantId: TENANT },
+    );
+    const aliceAsAdmin = await h.login("alice3@example.com", "pw-long-enough");
+
+    const res = await h.authedPost("/api/query", aliceAsAdmin.token, {
+      type: SessionQueries.detail,
+      payload: { id: aliceAsAdmin.sid },
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      data: { id: string; userId: string; revokedAt: string | null } | null;
+    };
+    expect(body.data?.id).toBe(aliceAsAdmin.sid);
+    expect(body.data?.userId).toBe(aliceId);
+    expect(body.data?.revokedAt).toBeNull();
+
+    const missing = await h.authedPost("/api/query", aliceAsAdmin.token, {
+      type: SessionQueries.detail,
+      payload: { id: "00000000-0000-4000-8000-0000deadbeef" },
+    });
+    expect(missing.status).toBe(200);
+    const missingBody = (await missing.json()) as { data: unknown };
+    expect(missingBody.data).toBeNull();
+
+    // Plain User gets the same 403 as session:list — same access-gate.
+    await h.seedUser("bob3@example.com", "pw-long-enough");
+    const bob = await h.login("bob3@example.com", "pw-long-enough");
+    const asUser = await h.authedPost("/api/query", bob.token, {
+      type: SessionQueries.detail,
+      payload: { id: aliceAsAdmin.sid },
+    });
+    expect(asUser.status).toBe(403);
+  });
+
+  // IDOR guard: session:detail/session:list are scoped by ctx.db (TenantDb)
+  // alone, no explicit tenant predicate in the handler — an admin from a
+  // different tenant must not be able to read another tenant's session rows.
+  test("session:detail and session:list never leak sessions across tenants", async () => {
+    const TENANT_2 = testTenantId(2);
+    const h2 = makeSessionHelpers(stack, TENANT_2, (user, meta) =>
+      callbacks.get().sessionCreator(user, meta),
+    );
+
+    const { userId: carolId } = await h.seedUser("carol4@example.com", "pw-long-enough");
+    await updateRows(
+      stack.db,
+      tenantMembershipsTable,
+      { roles: JSON.stringify(["Admin"]) },
+      { userId: carolId, tenantId: TENANT },
+    );
+    const carolAsAdmin = await h.login("carol4@example.com", "pw-long-enough");
+
+    const { userId: daveId } = await h2.seedUser("dave4@example.com", "pw-long-enough");
+    await updateRows(
+      stack.db,
+      tenantMembershipsTable,
+      { roles: JSON.stringify(["Admin"]) },
+      { userId: daveId, tenantId: TENANT_2 },
+    );
+    const daveAsAdmin = await h2.login("dave4@example.com", "pw-long-enough");
+
+    const detailRes = await h2.authedPost("/api/query", daveAsAdmin.token, {
+      type: SessionQueries.detail,
+      payload: { id: carolAsAdmin.sid },
+    });
+    expect(detailRes.status).toBe(200);
+    const detailBody = (await detailRes.json()) as { data: unknown };
+    expect(detailBody.data).toBeNull();
+
+    const listRes = await h2.authedPost("/api/query", daveAsAdmin.token, {
+      type: SessionQueries.list,
+      payload: {},
+    });
+    expect(listRes.status).toBe(200);
+    const listBody = (await listRes.json()) as { data: Array<{ id: string }> };
+    expect(listBody.data.map((r) => r.id)).not.toContain(carolAsAdmin.sid);
+  });
 });
 
 // Defense-in-depth: the sessionChecker refuses a live sid once the user it
@@ -538,3 +749,44 @@ describe("sessions feature — locked accounts blocked on a live session", () =>
     expect(res.status).toBe(200);
   });
 });
+
+describe("sessions with active KMS (#820): ip/userAgent are userOwned PII", () => {
+  test("sessionCreator stores ciphertext at rest, mine returns plaintext", async () => {
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+    configureBlindIndexKey(Buffer.alloc(32, 7).toString("base64"));
+    try {
+      const { userId } = await h.seedUser("kms-session@example.com", "pw-long-enough");
+      const cbs = createSessionCallbacks({ db: stack.db });
+      const sid = await cbs.sessionCreator(
+        { id: userId, tenantId: TENANT, roles: ["User"] },
+        { ip: "203.0.113.7", userAgent: "TestBrowser/1.0" },
+      );
+
+      const stored = await selectMany<{ ip: string | null; userAgent: string | null }>(
+        stack.db,
+        userSessionTable,
+        { id: sid },
+      );
+      expect(isPiiCiphertext(stored[0]?.ip)).toBe(true);
+      expect(isPiiCiphertext(stored[0]?.userAgent)).toBe(true);
+
+      // Login (bidx-Lookup auf verschluesselter user.email) + mine ueber HTTP:
+      // die manuell erzeugte Session kommt mit Klartext-ip/userAgent zurueck.
+      const login = await h.login("kms-session@example.com", "pw-long-enough");
+      const res = await h.authedPost("/api/query", login.token, {
+        type: SessionQueries.mine,
+        payload: {},
+      });
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as {
+        data: Array<{ id: string; ip: string | null; userAgent: string | null }>;
+      };
+      const manual = body.data.find((s) => s.id === sid);
+      expect(manual?.ip).toBe("203.0.113.7");
+      expect(manual?.userAgent).toBe("TestBrowser/1.0");
+    } finally {
+      resetPiiSubjectKmsForTests();
+      resetBlindIndexKeyForTests();
+    }
+  });
+});

package/src/sessions/__tests__/test-helpers.ts

@@ -9,12 +9,14 @@
 //   const res = await h.authedPost("/api/query", token, { type, payload });
 
 import { expect } from "bun:test";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type TestStack, TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import * as jose from "jose";
-import { hashPassword } from "../../auth-email-password/password-hashing";
+import { hashPassword } from "../../shared";
 import { seedTenantMembership } from "../../tenant/seeding";
 import { UserHandlers } from "../../user";
+import { withMintedSession } from "../testing";
 
 export type LoginResult = {
   readonly token: string;
@@ -25,7 +27,15 @@ export type LoginResult = {
 // `ReturnType<typeof makeSessionHelpers>` — no separate type export to
 // keep in sync with the implementation. Params are typed inline on each
 // method so the inference is sharp.
-export function makeSessionHelpers(stack: TestStack, tenantId: TenantId) {
+// `sessionCreator` is only needed when the suite wires a real sessionChecker
+// (auth-middleware then rejects the sidless systemAdmin bootstrap actor
+// used by seedUser). Suites without a sessionChecker (e.g. PAT tests) can
+// omit it.
+export function makeSessionHelpers(
+  stack: TestStack,
+  tenantId: TenantId,
+  sessionCreator?: SessionCreator,
+) {
   return {
     async seedUser(
       email: string,
@@ -33,10 +43,13 @@ export function makeSessionHelpers(stack: TestStack, tenantId: TenantId) {
       opts?: { roles?: readonly string[] },
     ): Promise<{ userId: string }> {
       const hash = await hashPassword(password);
+      const actor = sessionCreator
+        ? await withMintedSession(sessionCreator, TestUsers.systemAdmin)
+        : TestUsers.systemAdmin;
       const created = await stack.http.writeOk<{ id: string }>(
         UserHandlers.create,
         { email, passwordHash: hash, displayName: email.split("@")[0] ?? "u" },
-        TestUsers.systemAdmin,
+        actor,
       );
       await seedTenantMembership(stack.db, {
         userId: created.id,

package/src/sessions/constants.ts

@@ -17,6 +17,8 @@ export const SessionQueries = {
   // Admin-scoped: all sessions in the caller's tenant (live + revoked).
   // Tenant isolation comes from ctx.db; access-gate is admin-or-higher.
   list: "sessions:query:user-session:list",
+  // Admin-scoped single-session inspector, backs the session-detail screen.
+  detail: "sessions:query:user-session:detail",
 } as const;
 
 export const SessionErrors = {
@@ -45,3 +47,6 @@ export const DEFAULT_SESSION_CACHE_TTL_MS = 60_000;
 // longer so refresh can rotate the token without requiring a new password).
 // MVP ships a single window; per-app overrides can come later.
 export const DEFAULT_SESSION_EXPIRY_MS = 30 * 24 * 60 * 60 * 1000;
+
+export const SESSION_LIST_SCREEN_ID = "session-list" as const;
+export const SESSION_DETAIL_SCREEN_ID = "session-detail" as const;

package/src/sessions/db/queries/cleanup.ts

@@ -7,9 +7,9 @@ export async function deleteStaleSessionsBatch(
   batchSize: number,
 ): Promise<number> {
   const rows = (await asRawClient(db).unsafe(
-    `DELETE FROM "read_user_sessions"
+    `DELETE FROM "store_user_sessions"
      WHERE "id" IN (
-       SELECT "id" FROM "read_user_sessions"
+       SELECT "id" FROM "store_user_sessions"
        WHERE "expires_at" < now() - ($1::int * interval '1 day')
           OR "revoked_at" < now() - ($1::int * interval '1 day')
        LIMIT $2