@flowdular/sdk 0.2.4 → 0.3.0

package/modules/auth/src/services/auth-service.ts

@@ -1,5 +1,12 @@
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
-import { userActor, type Actor } from '@flowdular/sdk/kernel';
+import {
+	serviceActor,
+	userActor,
+	type Actor,
+	type ModuleSettingChange,
+	type UserActor,
+} from '@flowdular/sdk/kernel';
+import type { ErrorSink, ModuleMetrics } from '@flowdular/sdk/server';
 import { AUTH_SCOPES, MEMBER_SCOPES, OWNER_SCOPES } from '../acl/scopes.ts';
 import type {
 	ApiTokenRecord,
@@ -11,8 +18,10 @@ import type {
 	CreateApiTokenInput,
 	CreateRoleInput,
 	CreateTenantMemberInput,
+	CreateTenantMemberWithoutPasswordInput,
 	IssuedApiToken,
 	IssuedSession,
+	MembershipStatus,
 	SessionSummary,
 	SignInInput,
 	SignUpInput,
@@ -25,9 +34,20 @@ import {
 	DEFAULT_SESSION_TTL_HOURS,
 } from '../settings.ts';
 import { AuthServiceError } from './auth-service-error.ts';
+import {
+	IdentityProviderService,
+	PROVIDER_AUDIT_ACTIONS,
+	type OidcDiscoveryPort,
+} from './identity-provider-service.ts';
+import {
+	createProviderSecretVault,
+	type ProviderSecretVault,
+} from './provider-secrets.ts';
 import {
 	DEFAULT_PASSWORD_HASH_OPTIONS,
 	hashPassword,
+	passwordIsSet,
+	UNUSABLE_PASSWORD_HASH,
 	verifyPassword,
 	type PasswordHashOptions,
 } from './password.ts';
@@ -38,20 +58,26 @@ import {
 	type AccountCredential,
 	type AuditActorEvent,
 	type AuthRepository,
+	type ExternalIdentityPage,
 	type TenantMember,
+	type TenantMemberKeyset,
+	type TenantMemberPage,
+	type TenantMemberSort,
+	type TenantMemberSortedPage,
 	type TenantSummary,
 } from './repository.ts';
 import type { AuthMailDelivery } from './mail-delivery.ts';
 import {
+	createMfaSecretVault,
 	createTotpSecret,
-	decryptMfaSecret,
-	encryptMfaSecret,
 	verifyTotp,
+	type MfaSecretVault,
 } from './totp.ts';
 import {
 	assertPasswordPolicy,
 	normalizeEmail,
 	validateCreateTenantMember,
+	validateCreateTenantMemberWithoutPassword,
 	validateDisplayName,
 	validateEmailAddress,
 	validateRoleDescription,
@@ -84,10 +110,37 @@ export interface AuthServiceOptions {
 	readonly now?: () => number;
 	/** AES-256-GCM key used only to protect enrolled TOTP secrets at rest. */
 	readonly mfaEncryptionKey?: string;
+	/**
+	 * Keys a rotation has not finished retiring. They open stored factors that
+	 * were sealed before the rotation, and nothing is ever written with them.
+	 */
+	readonly mfaPreviousEncryptionKeys?: readonly string[];
+	/**
+	 * Verifies an issuer through its discovery document when a workspace saves
+	 * a provider. The server layer installs the HTTP adapter; without one, a
+	 * save is refused instead of trusting an unverified issuer.
+	 */
+	readonly oidcDiscovery?: OidcDiscoveryPort;
+	/**
+	 * Drops the ID token verifier's cached key set for a provider whose row
+	 * changed. The server layer installs the verifier it serves with; a
+	 * composition without one caches nothing to invalidate.
+	 */
+	readonly forgetProviderKeys?: (providerId: string) => void;
 	/** Deployment-owned delivery adapter. auth.core never selects an email vendor. */
 	readonly mailDelivery?: AuthMailDelivery;
+	/**
+	 * The locale a workspace's messages are worded in. The server resolves it
+	 * from the workspace's defaultLocale setting; without one every message is
+	 * English.
+	 */
+	readonly mailLocale?: (tenantId: string) => Promise<string> | string;
 	/** Public origin used to form opaque, one-time delivery links. */
 	readonly publicBaseUrl?: string;
+	/** Counts the audit writes that failed; a failed write never fails its operation. */
+	readonly metrics?: ModuleMetrics;
+	/** Receives a failed audit write as a name and a module, never as the driver's words. */
+	readonly errorSink?: ErrorSink;
 }
 
 export interface MfaChallenge extends IssuedSession {
@@ -199,6 +252,34 @@ export interface SignInContext {
 	readonly address?: string | null;
 }
 
+/** What a sign-in through a tenant-owned provider needs about the workspace. */
+export interface TenantProviderSignIn {
+	readonly tenantId: string;
+	readonly jitEnabled: boolean;
+	readonly allowedDomains: readonly string[];
+	readonly jitRole: string;
+}
+
+/* A workspace saving a provider verifies its issuer through discovery, which is
+   an outbound request the server layer owns. Without that adapter the save is
+   refused rather than trusting the issuer a request supplied. */
+function discoveryUnavailable(): AuthServiceError {
+	return new AuthServiceError(
+		'PROVIDER_DISCOVERY_UNAVAILABLE',
+		'Issuer discovery is not available in this composition.',
+		503,
+	);
+}
+
+/* A provisioned account has only the address the provider verified. The local
+   part is the readable half of it and is what the member sees until they
+   change it. */
+function displayNameFromEmail(email: string): string {
+	const local = email.slice(0, email.lastIndexOf('@'));
+	const candidate = local.length >= 2 ? local : email;
+	return candidate.slice(0, 80);
+}
+
 export function hashSessionToken(token: string): string {
 	return createHash('sha256').update(token, 'utf8').digest('base64url');
 }
@@ -221,6 +302,50 @@ const OPERATOR_SETUP_TTL_MS = 24 * 60 * 60 * 1000;
 const MFA_CHALLENGE_TTL_MS = 5 * 60 * 1000;
 const RECOVERY_CODE_COUNT = 10;
 
+/**
+ * Addresses one `findTenantMembersByEmail` call may name. A bulk caller splits
+ * a larger batch, so the statement never carries an unbounded list and a
+ * workspace of unknown size is never listed to answer a handful of addresses.
+ */
+export const TENANT_MEMBER_LOOKUP_LIMIT = 500;
+
+/** Members one `searchTenantMembers` call may answer. */
+export const TENANT_MEMBER_SEARCH_LIMIT = 500;
+
+/** Members one paged `listTenantMembers` call may answer. */
+export const TENANT_MEMBER_PAGE_LIMIT = 500;
+
+/** Sort keys `listTenantMembersSorted` accepts. */
+export const TENANT_MEMBER_SORTS: readonly TenantMemberSort[] = [
+	'displayName',
+	'email',
+];
+
+/** Characters a sorted page's keyset value may carry; a display name or an address is shorter. */
+const TENANT_MEMBER_KEYSET_LENGTH = 512;
+
+export interface TenantMemberSortedInput {
+	readonly sort: TenantMemberSort;
+	readonly direction: 'asc' | 'desc';
+	readonly limit: number;
+	/** A prefix of the display name or the address, folded like a search term; empty narrows nothing. */
+	readonly query?: string | null;
+	readonly membershipStatus?: MembershipStatus | null;
+	readonly after?: TenantMemberKeyset | null;
+}
+
+/** Bindings one `listExternalIdentities` call may answer. */
+export const EXTERNAL_IDENTITY_PAGE_LIMIT = 500;
+
+/** Characters a search term may carry; a longer one matches nothing useful. */
+export const TENANT_MEMBER_SEARCH_TERM_LENGTH = 200;
+
+/* The LIKE wildcards, so a term a person typed is matched literally. The
+   statements that use it declare ESCAPE '\'. */
+function escapeLikeTerm(term: string): string {
+	return term.replace(/[\\%_]/g, (character) => `\\${character}`);
+}
+
 export const AUDIT_ACTIONS = Object.freeze({
 	signInSucceeded: 'auth.sign-in.succeeded',
 	signInFailed: 'auth.sign-in.failed',
@@ -237,11 +362,20 @@ export const AUDIT_ACTIONS = Object.freeze({
 	mfaEnrolled: 'auth.mfa.enrolled',
 	mfaConfirmed: 'auth.mfa.confirmed',
 	mfaChallengeSucceeded: 'auth.mfa.challenge-succeeded',
+	mfaReset: 'auth.mfa.reset',
 	tenantRenamed: 'auth.tenant.renamed',
 	workspaceProvisioned: 'auth.workspace.provisioned',
 	memberCreated: 'users.member.created',
 	memberUpdated: 'users.member.updated',
 	memberStatus: 'users.member.status',
+	memberProvisioned: 'auth.member.provisioned',
+	jitRefused: 'auth.jit.refused',
+	membershipStatus: 'auth.membership.status',
+	providerCreated: PROVIDER_AUDIT_ACTIONS.created,
+	providerUpdated: PROVIDER_AUDIT_ACTIONS.updated,
+	providerStatusChanged: PROVIDER_AUDIT_ACTIONS.status,
+	providerSecretRotated: PROVIDER_AUDIT_ACTIONS.secretRotated,
+	providerDeleted: PROVIDER_AUDIT_ACTIONS.deleted,
 	memberRemoved: 'users.member.removed',
 	memberPasswordReset: 'users.member.password-reset',
 	memberScopes: 'users.member.scopes',
@@ -250,16 +384,44 @@ export const AUDIT_ACTIONS = Object.freeze({
 	roleUpdated: 'auth.role.updated',
 	roleDeleted: 'auth.role.deleted',
 	settingsUpdated: 'settings.updated',
+	settingsFlagChanged: 'settings.flag.changed',
 });
 
 export const AUDIT_ACTION_LIST = Object.freeze(Object.values(AUDIT_ACTIONS));
 
+/* The actor an audit row records. A kernel service actor always names its
+   configuring user; a provider row stores none, so the trail admits a service
+   actor whose configuring user is unknown and persists it as null. */
+interface ServiceAuditActor {
+	readonly kind: 'service';
+	readonly id: string;
+	readonly label: string;
+	readonly configuredBy: UserActor | null;
+}
+
+type AuditActor = Actor | ServiceAuditActor;
+
 /* An operator command runs from a deployment shell and belongs to no account.
-   The audit actor_kind column accepts only 'user' or 'agent', so the operator
-   is recorded as a user whose identifier carries the cli: prefix the label
-   filter can search for. */
+   The shell is the service and the person at it, whose identifier carries the
+   cli: prefix the label filter can search for, is who configured it. */
 function operatorActor(operator: string): Actor {
-	return { kind: 'user', id: operator, label: operator };
+	return serviceActor({
+		serviceId: operator,
+		label: operator,
+		configuredBy: { kind: 'user', id: operator, label: operator },
+	});
+}
+
+/* A refused just-in-time sign-in belongs to no account of this workspace, so
+   the provider that asserted the identity is the actor and the address it
+   reported never reaches the trail. */
+function providerActor(provider: string): ServiceAuditActor {
+	return {
+		kind: 'service',
+		id: `oidc:${provider}`,
+		label: `oidc:${provider}`,
+		configuredBy: null,
+	};
 }
 
 function member(account: AccountCredential, createdAt: number): TenantMember {
@@ -270,6 +432,7 @@ function member(account: AccountCredential, createdAt: number): TenantMember {
 		role: account.role,
 		roleId: account.roleId,
 		status: account.status,
+		membershipStatus: account.membershipStatus,
 		scopes: account.scopes,
 		passwordChangeRequired: account.passwordChangeRequired,
 		createdAt,
@@ -282,8 +445,17 @@ export class AuthService {
 	readonly #passwordHash: PasswordHashOptions;
 	readonly #now: () => number;
 	readonly #mfaEncryptionKey: string | undefined;
+	readonly #mfaPreviousEncryptionKeys: readonly string[];
+	#mfaVault: MfaSecretVault | undefined;
+	#providerSecretVault: ProviderSecretVault | undefined;
+	#identityProviders: IdentityProviderService | undefined;
+	readonly #oidcDiscovery: OidcDiscoveryPort;
+	readonly #forgetProviderKeys: (providerId: string) => void;
 	readonly #mailDelivery: AuthMailDelivery | undefined;
+	readonly #mailLocale: (tenantId: string) => Promise<string> | string;
 	readonly #publicBaseUrl: string;
+	readonly #metrics: ModuleMetrics | undefined;
+	readonly #errorSink: ErrorSink | undefined;
 
 	constructor(repository: AuthRepository, options: AuthServiceOptions = {}) {
 		this.#repository = repository;
@@ -297,11 +469,18 @@ export class AuthService {
 		this.#passwordHash = options.passwordHash ?? DEFAULT_PASSWORD_HASH_OPTIONS;
 		this.#now = options.now ?? Date.now;
 		this.#mfaEncryptionKey = options.mfaEncryptionKey;
+		this.#mfaPreviousEncryptionKeys = options.mfaPreviousEncryptionKeys ?? [];
+		this.#oidcDiscovery =
+			options.oidcDiscovery ?? (() => Promise.reject(discoveryUnavailable()));
+		this.#forgetProviderKeys = options.forgetProviderKeys ?? (() => undefined);
 		this.#mailDelivery = options.mailDelivery;
+		this.#mailLocale = options.mailLocale ?? (() => 'en');
 		this.#publicBaseUrl = (options.publicBaseUrl ?? 'http://localhost').replace(
 			/\/$/,
 			'',
 		);
+		this.#metrics = options.metrics;
+		this.#errorSink = options.errorSink;
 	}
 
 	get policy(): AuthPolicy {
@@ -312,7 +491,7 @@ export class AuthService {
 	   describe; a failing write is reported and swallowed. */
 	async #audit(
 		tenantId: string,
-		actor: Actor,
+		actor: AuditActor,
 		action: string,
 		subjectType: string,
 		subjectId: string,
@@ -325,6 +504,7 @@ export class AuthService {
 				actorLabel: actor.label,
 				actorKind: actor.kind,
 				actorRunId: actor.kind === 'agent' ? actor.runId : null,
+				configuredBy: actor.kind === 'service' ? actor.configuredBy : null,
 				action,
 				subjectType,
 				subjectId,
@@ -336,6 +516,13 @@ export class AuthService {
 			   bound values from the operation being audited. */
 			void error;
 			console.error('[auth.core] audit write failed');
+			this.#metrics?.counter('audit_write_failures_total', { action });
+			this.#errorSink?.report({
+				at: this.#now(),
+				name: 'AuditWriteFailed',
+				module: 'auth.core',
+				message: `Audit write failed for ${action}.`,
+			});
 		}
 	}
 
@@ -463,12 +650,22 @@ export class AuthService {
 				423,
 			);
 		}
-		const account = await this.#repository.findAccountByEmail(input.email);
+		const account = await this.#signInAccount(input);
 		if (!account) {
 			await hashPassword(input.password, this.#passwordHash);
 			await this.#recordFailure(input.email, null, context);
 			throw this.#invalidCredentials();
 		}
+		/* An account created without a password answers exactly as an unknown
+		   address does, down to burning the same derivation: a distinct code here
+		   would tell an attacker which addresses are registered and not yet
+		   activated, which is the set most worth attacking. PASSWORD_NOT_SET is
+		   reported where the caller is already authenticated as the account. */
+		if (!passwordIsSet(account.passwordHash)) {
+			await hashPassword(input.password, this.#passwordHash);
+			await this.#recordFailure(input.email, account, context);
+			throw this.#invalidCredentials();
+		}
 		const valid = await verifyPassword(input.password, account.passwordHash);
 		if (!valid || account.status !== 'active') {
 			await this.#recordFailure(input.email, account, context);
@@ -490,6 +687,26 @@ export class AuthService {
 		return issued;
 	}
 
+	/* The workspace the sign-in screen names is the one the session opens in:
+	   the membership has to exist there and be active. An unknown workspace and
+	   a membership the account does not hold answer as a wrong password does,
+	   so the form never reports which workspaces hold an address. Without a
+	   named workspace the oldest membership answers, exactly as before. */
+	async #signInAccount(input: SignInInput): Promise<AccountCredential | null> {
+		if (input.workspace === undefined) {
+			return this.#repository.findAccountByEmail(input.email);
+		}
+		const tenant = await this.findTenant(input.workspace);
+		if (!tenant) return null;
+		const identity = await this.#repository.findAccountIdentity(input.email);
+		if (!identity) return null;
+		const membership = await this.#repository.findAccountMembership(
+			identity.accountId,
+			tenant.tenantId,
+		);
+		return membership?.membershipStatus === 'active' ? membership : null;
+	}
+
 	async #issueMfaChallenge(
 		account: AccountCredential,
 		now = this.#now(),
@@ -557,8 +774,232 @@ export class AuthService {
 		);
 	}
 
-	async listTenantMembers(tenantId: string): Promise<readonly TenantMember[]> {
-		return this.#repository.listTenantMembers(tenantId);
+	listTenantMembers(tenantId: string): Promise<readonly TenantMember[]>;
+	listTenantMembers(
+		tenantId: string,
+		page: { readonly cursor?: string | null; readonly limit: number },
+	): Promise<TenantMemberPage>;
+	/**
+	 * The members of one workspace. The unbounded call answers the whole roll
+	 * ordered by display name and stays what every caller holding a workspace of
+	 * known size already reads. The paged call walks the same members by account
+	 * id, one bounded page and the cursor of the next, for a caller that must
+	 * not read a workspace of unknown size in one statement.
+	 */
+	async listTenantMembers(
+		tenantId: string,
+		page?: { readonly cursor?: string | null; readonly limit: number },
+	): Promise<readonly TenantMember[] | TenantMemberPage> {
+		if (page === undefined) return this.#repository.listTenantMembers(tenantId);
+		const limit = this.#pageLimit(page.limit, TENANT_MEMBER_PAGE_LIMIT);
+		const members = await this.#repository.listTenantMembersPage(
+			this.#identifier(tenantId, 'tenantId'),
+			page.cursor ?? '',
+			limit + 1,
+		);
+		const answered = members.slice(0, limit);
+		const last = answered[answered.length - 1];
+		return {
+			members: answered,
+			nextCursor: members.length > limit && last ? last.accountId : null,
+		};
+	}
+
+	/**
+	 * One page of the workspace's members in the order a screen shows them,
+	 * by display name or by address, ascending or descending, narrowed by a
+	 * prefix the way the search narrows and by membership status, all in SQL.
+	 * The page answers the keyset of its last member when it is full; the
+	 * caller carries that keyset back as `after` to continue. The paged walk
+	 * by account id stays for the callers that must not lose a member to a
+	 * rename mid-walk; this read is for a screen, which shows one page at a time.
+	 */
+	async listTenantMembersSorted(
+		tenantId: string,
+		input: TenantMemberSortedInput,
+	): Promise<TenantMemberSortedPage> {
+		if (!TENANT_MEMBER_SORTS.includes(input.sort)) {
+			throw new AuthServiceError(
+				'INVALID_INPUT',
+				`Sort must be one of ${TENANT_MEMBER_SORTS.join(', ')}.`,
+				400,
+			);
+		}
+		if (input.direction !== 'asc' && input.direction !== 'desc') {
+			throw new AuthServiceError(
+				'INVALID_INPUT',
+				'Direction must be asc or desc.',
+				400,
+			);
+		}
+		const status = input.membershipStatus ?? null;
+		if (status !== null && status !== 'active' && status !== 'disabled') {
+			throw new AuthServiceError(
+				'INVALID_INPUT',
+				'Membership status must be active or disabled.',
+				400,
+			);
+		}
+		const term = normalizeEmail(input.query ?? '');
+		if (term.length > TENANT_MEMBER_SEARCH_TERM_LENGTH) {
+			throw new AuthServiceError(
+				'INVALID_INPUT',
+				`Search term must contain at most ${TENANT_MEMBER_SEARCH_TERM_LENGTH} characters.`,
+				400,
+			);
+		}
+		const after = input.after ?? null;
+		if (
+			after !== null &&
+			(typeof after.sortValue !== 'string' ||
+				after.sortValue.length > TENANT_MEMBER_KEYSET_LENGTH)
+		) {
+			throw new AuthServiceError(
+				'INVALID_INPUT',
+				'The page keyset is not valid.',
+				400,
+			);
+		}
+		return this.#repository.listTenantMembersSorted(
+			this.#identifier(tenantId, 'tenantId'),
+			{
+				sort: input.sort,
+				direction: input.direction,
+				limit: this.#pageLimit(input.limit, TENANT_MEMBER_PAGE_LIMIT),
+				term: term.length === 0 ? null : escapeLikeTerm(term),
+				membershipStatus: status,
+				after:
+					after === null
+						? null
+						: {
+								sortValue: after.sortValue,
+								accountId: this.#identifier(after.accountId, 'accountId'),
+							},
+			},
+		);
+	}
+
+	/** How many members the workspace holds; the count is an index range, so a screen may show it. */
+	countTenantMembers(tenantId: string): Promise<number> {
+		return this.#repository.countTenantMembers(
+			this.#identifier(tenantId, 'tenantId'),
+		);
+	}
+
+	/**
+	 * The identity bindings this workspace's own providers assert about its
+	 * members, one bounded page per call. A binding names the account, the
+	 * provider key, the subject the provider keeps stable and when it was first
+	 * recorded; no token, secret, ciphertext or fingerprint is part of one, and
+	 * neither is the address the provider reported. A binding a platform
+	 * provider made carries no workspace and is not answered here. The
+	 * permission a reader needs is the calling module's to enforce; this is
+	 * scoped to the workspace it is given and nothing wider.
+	 */
+	async listExternalIdentities(
+		tenantId: string,
+		page: { readonly cursor?: string | null; readonly limit: number },
+	): Promise<ExternalIdentityPage> {
+		const limit = this.#pageLimit(page.limit, EXTERNAL_IDENTITY_PAGE_LIMIT);
+		/* A provider key carries no colon, so the first one separates the pair; a
+		   cursor that is not one starts the walk over rather than half-reading a
+		   position, the way a malformed audit cursor narrows nothing. */
+		const separator = page.cursor?.indexOf(':') ?? -1;
+		const after =
+			page.cursor && separator > 0
+				? {
+						provider: page.cursor.slice(0, separator),
+						subject: page.cursor.slice(separator + 1),
+					}
+				: { provider: '', subject: '' };
+		const identities = await this.#repository.listExternalIdentitiesPage(
+			this.#identifier(tenantId, 'tenantId'),
+			after,
+			limit + 1,
+		);
+		const answered = identities.slice(0, limit);
+		const last = answered[answered.length - 1];
+		return {
+			identities: answered,
+			nextCursor:
+				identities.length > limit && last
+					? `${last.provider}:${last.subject}`
+					: null,
+		};
+	}
+
+	/**
+	 * The members of one workspace holding any of these addresses. The natural
+	 * key a bulk caller resolves per batch, answered by the database rather than
+	 * by listing the workspace and matching in memory. Addresses are folded the
+	 * way auth.core folds a stored address, so the caller passes what a person
+	 * typed. An address the workspace does not hold is simply absent from the
+	 * answer, and an account that exists in another workspace stays invisible
+	 * here.
+	 */
+	async findTenantMembersByEmail(
+		tenantId: string,
+		emails: readonly string[],
+	): Promise<readonly TenantMember[]> {
+		if (emails.length > TENANT_MEMBER_LOOKUP_LIMIT) {
+			throw new AuthServiceError(
+				'INVALID_INPUT',
+				`At most ${TENANT_MEMBER_LOOKUP_LIMIT} addresses can be looked up at once.`,
+				400,
+			);
+		}
+		const normalized = [
+			...new Set(emails.map(normalizeEmail).filter((email) => email !== '')),
+		];
+		return this.#repository.findTenantMembersByEmail(
+			this.#identifier(tenantId, 'tenantId'),
+			normalized,
+		);
+	}
+
+	/**
+	 * Members of one workspace whose display name or address starts with the
+	 * term, cut to `limit` in the database. The caller ranks what comes back;
+	 * this only bounds what a search reads.
+	 */
+	async searchTenantMembers(
+		tenantId: string,
+		input: { readonly query: string; readonly limit: number },
+	): Promise<readonly TenantMember[]> {
+		const term = normalizeEmail(input.query);
+		if (term.length === 0 || term.length > TENANT_MEMBER_SEARCH_TERM_LENGTH) {
+			throw new AuthServiceError(
+				'INVALID_INPUT',
+				`Search term must contain 1 to ${TENANT_MEMBER_SEARCH_TERM_LENGTH} characters.`,
+				400,
+			);
+		}
+		if (
+			!Number.isSafeInteger(input.limit) ||
+			input.limit < 1 ||
+			input.limit > TENANT_MEMBER_SEARCH_LIMIT
+		) {
+			throw new AuthServiceError(
+				'INVALID_INPUT',
+				`Limit must be 1 to ${TENANT_MEMBER_SEARCH_LIMIT}.`,
+				400,
+			);
+		}
+		return this.#repository.searchTenantMembers(
+			this.#identifier(tenantId, 'tenantId'),
+			escapeLikeTerm(term),
+			input.limit,
+		);
+	}
+
+	/* A dependent module that needs the role and scopes of one account asks for
+	   that account: reading the whole workspace to find it costs the roll on
+	   every decision a member takes. */
+	async findTenantMember(
+		tenantId: string,
+		accountId: string,
+	): Promise<TenantMember | null> {
+		return this.#repository.findTenantMember(tenantId, accountId);
 	}
 
 	/* Scopes are authorization metadata, not credentials. Dependent modules read
@@ -605,6 +1046,16 @@ export class AuthService {
 				404,
 			);
 		}
+		/* The caller is already authenticated as this account, so naming the cause
+		   reveals nothing it does not already know, and "the current password is
+		   incorrect" would be a dead end for a member who never had one. */
+		if (!passwordIsSet(account.passwordHash)) {
+			throw new AuthServiceError(
+				'PASSWORD_NOT_SET',
+				'This account has no password yet. Use the password reset link to set the first one.',
+				409,
+			);
+		}
 		const valid = await verifyPassword(
 			input.currentPassword,
 			account.passwordHash,
@@ -616,7 +1067,11 @@ export class AuthService {
 				401,
 			);
 		}
-		assertPasswordPolicy(input.newPassword, this.#policy().passwordMinLength);
+		assertPasswordPolicy(
+			input.newPassword,
+			this.#policy().passwordMinLength,
+			account.email,
+		);
 		if (input.newPassword === input.currentPassword) {
 			throw new AuthServiceError(
 				'PASSWORD_UNCHANGED',
@@ -800,6 +1255,37 @@ export class AuthService {
 			raw,
 			this.#policy().passwordMinLength,
 		);
+		return this.#createTenantMember(
+			input,
+			actor,
+			await hashPassword(input.password, this.#passwordHash),
+		);
+	}
+
+	/**
+	 * A member who holds no password at all. The account stores the unusable
+	 * credential marker rather than a secret nobody keeps: no password can match
+	 * it, so a sign-in by password is refused, and the member reaches the
+	 * workspace through the reset flow, an administrative temporary password or
+	 * an external identity. A bulk creator calls this instead of drawing a random
+	 * secret it immediately throws away.
+	 */
+	async createTenantMemberWithoutPassword(
+		raw: CreateTenantMemberWithoutPasswordInput,
+		actor: AuthActor | null = null,
+	): Promise<TenantMember> {
+		return this.#createTenantMember(
+			validateCreateTenantMemberWithoutPassword(raw),
+			actor,
+			UNUSABLE_PASSWORD_HASH,
+		);
+	}
+
+	async #createTenantMember(
+		input: CreateTenantMemberWithoutPasswordInput,
+		actor: AuthActor | null,
+		passwordHash: string,
+	): Promise<TenantMember> {
 		if (actor && actor.tenantId !== input.tenantId) {
 			throw new AuthServiceError(
 				'TENANT_ACCESS_DENIED',
@@ -815,7 +1301,6 @@ export class AuthService {
 			: input.role === 'owner'
 				? OWNER_SCOPES
 				: MEMBER_SCOPES;
-		const passwordHash = await hashPassword(input.password, this.#passwordHash);
 		try {
 			const createdAt = this.#now();
 			const account = await this.#repository.createAccountInTenant({
@@ -837,7 +1322,12 @@ export class AuthService {
 					AUDIT_ACTIONS.memberCreated,
 					'account',
 					account.accountId,
-					{ email: account.email, role: input.role },
+					/* Only the credential-less creation is named, so the trail of an
+					   ordinary one keeps the shape it had and carries no word about
+					   a secret at all. */
+					passwordHash === UNUSABLE_PASSWORD_HASH
+						? { email: account.email, role: input.role, credential: 'none' }
+						: { email: account.email, role: input.role },
 				);
 			}
 			return member(account, createdAt);
@@ -882,13 +1372,20 @@ export class AuthService {
 		return target;
 	}
 
+	/* `counted` says whether the target is one of the active owners
+	   countActiveOwners still counts, which is what makes `<= 1` mean "the last
+	   one". A caller that changes the membership alone must not read the account
+	   block as the membership's own state, or disabling an owner whose
+	   membership is already disabled would answer LAST_OWNER instead of doing
+	   nothing. */
 	async #assertOwnerRemains(
 		tenantId: string,
 		target: AccountCredential,
+		counted = target.status === 'active',
 	): Promise<void> {
 		if (
 			target.role === 'owner' &&
-			target.status === 'active' &&
+			counted &&
 			(await this.#repository.countActiveOwners(tenantId)) <= 1
 		) {
 			throw new AuthServiceError(
@@ -989,7 +1486,11 @@ export class AuthService {
 		const target = await this.#targetMember(actor, accountId, {
 			allowSelf: false,
 		});
-		assertPasswordPolicy(temporaryPassword, this.#policy().passwordMinLength);
+		assertPasswordPolicy(
+			temporaryPassword,
+			this.#policy().passwordMinLength,
+			target.email,
+		);
 		await this.#repository.updatePasswordHash(
 			target.accountId,
 			await hashPassword(temporaryPassword, this.#passwordHash),
@@ -1245,6 +1746,20 @@ export class AuthService {
 				409,
 			);
 		}
+		/* A provider provisions into a role by key, and the key is all the row
+		   holds. Deleting the role behind it would leave every just-in-time
+		   sign-in through that provider refusing silently, so the provider is
+		   pointed elsewhere first. */
+		const named = (
+			await this.#repository.listIdentityProviders(actor.tenantId)
+		).find((provider) => provider.jitRole === role.key);
+		if (named) {
+			throw new AuthServiceError(
+				'ROLE_NAMED_BY_PROVIDER',
+				`The identity provider ${named.key} provisions members into this role. Point it at another role first.`,
+				409,
+			);
+		}
 		await this.#repository.deleteRole(actor.tenantId, role.id);
 		await this.#audit(
 			actor.tenantId,
@@ -1320,17 +1835,25 @@ export class AuthService {
 		const normalized = normalizeEmail(email);
 		if (normalized.length > 254) return;
 		const account = await this.#repository.findAccountByEmail(normalized);
-		if (!account || !this.#mailDelivery) return;
+		if (!account) return;
+		if (!this.#mailDelivery) {
+			/* The client still gets the non-enumerating success, so the deployment
+			   log is the only place this dead end is visible. The address stays out
+			   of it. */
+			console.warn(
+				'[auth.core] mail transport is none; password reset for an existing account was not delivered',
+			);
+			return;
+		}
 		const reset = await this.#mintPasswordResetToken(
 			account.accountId,
 			PASSWORD_RESET_TTL_MS,
 		);
 		try {
-			await this.#mailDelivery.send({
-				to: account.email,
-				kind: 'password-reset',
-				url: reset.url,
-			});
+			await this.#mailDelivery.send(
+				{ to: account.email, kind: 'password-reset', url: reset.url },
+				await this.#mailLocale(account.tenantId),
+			);
 			await this.#audit(
 				account.tenantId,
 				{ kind: 'user', id: account.accountId, label: account.email },
@@ -1352,20 +1875,36 @@ export class AuthService {
 				400,
 			);
 		}
-		assertPasswordPolicy(password, this.#policy().passwordMinLength);
-		const accountId = await this.#repository.consumePasswordResetToken(
-			hashSessionToken(token),
+		const tokenHash = hashSessionToken(token);
+		const named = await this.#repository.findPasswordResetTokenAccount(
+			tokenHash,
 			this.#now(),
 		);
-		if (!accountId) {
+		const account = named
+			? await this.#repository.findAccountCredentialById(named)
+			: null;
+		if (!account || account.status !== 'active') {
 			throw new AuthServiceError(
 				'RESET_TOKEN_INVALID',
 				'This password reset link is invalid or has expired.',
 				400,
 			);
 		}
-		const account = await this.#repository.findAccountCredentialById(accountId);
-		if (!account || account.status !== 'active') {
+		/* The whole policy, including the address rule, runs on the account the
+		   link names before anything spends it: a refused password leaves the
+		   link usable instead of stranding the visitor with a dead one. */
+		assertPasswordPolicy(
+			password,
+			this.#policy().passwordMinLength,
+			account.email,
+		);
+		/* Claiming the token is still one statement, so two submissions of the
+		   same link cannot both change the password. */
+		const accountId = await this.#repository.consumePasswordResetToken(
+			tokenHash,
+			this.#now(),
+		);
+		if (!accountId) {
 			throw new AuthServiceError(
 				'RESET_TOKEN_INVALID',
 				'This password reset link is invalid or has expired.',
@@ -1420,11 +1959,10 @@ export class AuthService {
 			createdBy: actor.accountId,
 		});
 		try {
-			await this.#mailDelivery.send({
-				to: normalized,
-				kind: 'tenant-invitation',
-				url: invitation.url,
-			});
+			await this.#mailDelivery.send(
+				{ to: normalized, kind: 'tenant-invitation', url: invitation.url },
+				await this.#mailLocale(actor.tenantId),
+			);
 		} catch {
 			throw new AuthServiceError(
 				'MAIL_DELIVERY_FAILED',
@@ -1534,7 +2072,11 @@ export class AuthService {
 		const displayName = validateDisplayName(input.ownerDisplayName);
 		const email = validateEmailAddress(input.ownerEmail);
 		if (input.password !== undefined) {
-			assertPasswordPolicy(input.password, this.#policy().passwordMinLength);
+			assertPasswordPolicy(
+				input.password,
+				this.#policy().passwordMinLength,
+				email,
+			);
 		}
 		if (await this.#repository.isTenantSlugTaken(slug)) {
 			throw new AuthServiceError(
@@ -1786,6 +2328,45 @@ export class AuthService {
 		};
 	}
 
+	/* Built on first use, so a deployment that configures no MFA key still
+	   constructs the service and an unusable key is refused where a factor is
+	   actually sealed or opened, with MFA_NOT_CONFIGURED. */
+	#vault(): MfaSecretVault {
+		return (this.#mfaVault ??= createMfaSecretVault(
+			this.#mfaEncryptionKey,
+			this.#mfaPreviousEncryptionKeys,
+		));
+	}
+
+	/* The same deployment keys under a provider-specific context, refused with
+	   PROVIDER_KEY_REQUIRED where a provider secret is actually sealed. */
+	#providerVault(): ProviderSecretVault {
+		return (this.#providerSecretVault ??= createProviderSecretVault(
+			this.#mfaEncryptionKey,
+			this.#mfaPreviousEncryptionKeys,
+		));
+	}
+
+	/** Tenant-owned identity providers of the workspaces this service serves. */
+	get identityProviders(): IdentityProviderService {
+		return (this.#identityProviders ??= new IdentityProviderService({
+			repository: this.#repository,
+			vault: () => this.#providerVault(),
+			now: this.#now,
+			discover: this.#oidcDiscovery,
+			forgetKeys: (providerId) => this.#forgetProviderKeys(providerId),
+			audit: (tenantId, actor, action, subjectType, subjectId, metadata) =>
+				this.#audit(
+					tenantId,
+					actor,
+					action,
+					subjectType,
+					subjectId,
+					metadata ?? {},
+				),
+		}));
+	}
+
 	async enrollTotp(
 		accountId: string,
 		issuer = 'Flowdular',
@@ -1820,7 +2401,7 @@ export class AuthService {
 		const now = this.#now();
 		await this.#repository.upsertMfaTotp(
 			account.accountId,
-			encryptMfaSecret(secret, this.#mfaEncryptionKey),
+			this.#vault().seal(secret),
 			now,
 		);
 		await this.#repository.replaceMfaRecoveryCodes(
@@ -1860,6 +2441,31 @@ export class AuthService {
 		};
 	}
 
+	/** Whether the account holds a confirmed second factor; one indexed read. */
+	async hasConfirmedMfa(accountId: string): Promise<boolean> {
+		return this.#repository.hasConfirmedMfaTotp(
+			this.#identifier(accountId, 'accountId'),
+		);
+	}
+
+	/* An administrator clears a lost factor. The target is resolved inside the
+	   acting workspace, so an account that belongs only to another workspace
+	   answers exactly as an unknown one does. */
+	async resetMemberMfa(actor: AuthActor, accountId: string): Promise<void> {
+		const target = await this.#targetMember(actor, accountId, {
+			allowSelf: false,
+		});
+		await this.#repository.deleteMfaEnrolment(target.accountId);
+		await this.#audit(
+			actor.tenantId,
+			this.#actorOf(actor),
+			AUDIT_ACTIONS.mfaReset,
+			'account',
+			target.accountId,
+			{ email: target.email },
+		);
+	}
+
 	async confirmTotp(accountId: string, code: string): Promise<void> {
 		const account = await this.#repository.findAccountCredentialById(
 			this.#identifier(accountId, 'accountId'),
@@ -1871,7 +2477,7 @@ export class AuthService {
 			!account ||
 			!record ||
 			!verifyTotp(
-				decryptMfaSecret(record.secretCiphertext, this.#mfaEncryptionKey),
+				this.#vault().open(record.secretCiphertext, record.keyId),
 				code,
 				this.#now(),
 			)
@@ -1926,7 +2532,7 @@ export class AuthService {
 			record !== null &&
 			((typeof code === 'string' &&
 				verifyTotp(
-					decryptMfaSecret(record.secretCiphertext, this.#mfaEncryptionKey),
+					this.#vault().open(record.secretCiphertext, record.keyId),
 					code,
 					this.#now(),
 				)) ||
@@ -1955,14 +2561,54 @@ export class AuthService {
 		return issued;
 	}
 
-	async signInVerifiedExternalEmail(
-		email: string,
-	): Promise<IssuedSession | MfaChallenge> {
-		const account = await this.#repository.findAccountByEmail(
-			normalizeEmail(email),
+	/* The provider subject is the identity; the address it reports only
+	   bootstraps the first link. Resolving by subject afterwards is what keeps a
+	   reassigned address at the provider from reaching another account here. */
+	async signInExternalIdentity(input: {
+		readonly provider: string;
+		readonly subject: string;
+		readonly email: string;
+		/**
+		 * Present when a tenant-owned provider asserted the identity: the binding
+		 * lives in that workspace, the session opens in that workspace, and
+		 * nothing the provider says reaches another one.
+		 */
+		readonly workspace?: TenantProviderSignIn;
+	}): Promise<IssuedSession | MfaChallenge> {
+		const provider = this.#identifier(input.provider, 'provider');
+		const subject = this.#identifier(input.subject, 'subject');
+		const workspace = input.workspace ?? null;
+		const tenantId = workspace?.tenantId ?? null;
+		const linkedAccountId = await this.#repository.findExternalIdentity(
+			provider,
+			subject,
+			tenantId,
 		);
+		const account = linkedAccountId
+			? await this.#resolveLinkedAccount(linkedAccountId, tenantId)
+			: await this.#resolveExternalAccount(input.email, provider, workspace);
 		if (!account || account.status !== 'active')
 			throw this.#invalidCredentials();
+		if (
+			!linkedAccountId &&
+			(await this.#repository.findExternalIdentitySubject(
+				provider,
+				account.accountId,
+				tenantId,
+			)) !== null
+		) {
+			/* The account already answers to another subject at this provider. An
+			   address the provider reports never re-binds it, which is what a
+			   reused or transferred address would otherwise do. */
+			throw this.#invalidCredentials();
+		}
+		await this.#repository.linkExternalIdentity({
+			provider,
+			subject,
+			accountId: account.accountId,
+			tenantId,
+			now: this.#now(),
+		});
 		if (
 			(await this.#repository.findMfaTotp(account.accountId))?.confirmedAt !=
 			null
@@ -1980,6 +2626,193 @@ export class AuthService {
 		return issued;
 	}
 
+	/* A binding already made resolves the membership it was made in. A platform
+	   binding names no workspace and keeps resolving the account's own. */
+	async #resolveLinkedAccount(
+		accountId: string,
+		tenantId: string | null,
+	): Promise<AccountCredential | null> {
+		if (!tenantId) {
+			return this.#repository.findAccountCredentialById(accountId);
+		}
+		const membership = await this.#repository.findAccountMembership(
+			accountId,
+			tenantId,
+		);
+		return membership?.membershipStatus === 'active' ? membership : null;
+	}
+
+	/**
+	 * The first sign-in through a provider, before any binding exists. The
+	 * verified address only bootstraps the link: for a platform provider it
+	 * resolves the account exactly as before, and for a workspace provider it
+	 * resolves the membership of that workspace, provisioning one when the
+	 * provider is configured to and the address is inside its domains.
+	 */
+	async #resolveExternalAccount(
+		email: string,
+		provider: string,
+		workspace: TenantProviderSignIn | null,
+	): Promise<AccountCredential | null> {
+		const normalized = normalizeEmail(email);
+		if (!workspace) return this.#repository.findAccountByEmail(normalized);
+		const identity = await this.#repository.findAccountIdentity(normalized);
+		if (identity && identity.status !== 'active') return null;
+		if (identity) {
+			const membership = await this.#repository.findAccountMembership(
+				identity.accountId,
+				workspace.tenantId,
+			);
+			if (membership) {
+				return membership.membershipStatus === 'active' ? membership : null;
+			}
+		}
+		return this.#provisionExternalMember(
+			normalized,
+			identity?.accountId ?? null,
+			provider,
+			workspace,
+		);
+	}
+
+	/* Just-in-time provisioning. Every refusal happens before the first write,
+	   so a provider that is not allowed to create members creates nothing. */
+	async #provisionExternalMember(
+		normalizedEmail: string,
+		accountId: string | null,
+		provider: string,
+		workspace: TenantProviderSignIn,
+	): Promise<AccountCredential | null> {
+		if (!workspace.jitEnabled) return null;
+		const domain = normalizedEmail.slice(normalizedEmail.lastIndexOf('@') + 1);
+		if (!domain || !workspace.allowedDomains.includes(domain)) return null;
+		/* A tenant-owned provider may not absorb an account other workspaces
+		   rely on. Reuse is limited to an account no workspace holds; anyone
+		   else is invited by this workspace instead. */
+		if (accountId && (await this.#repository.countMemberships(accountId)) > 0) {
+			await this.#audit(
+				workspace.tenantId,
+				providerActor(provider),
+				AUDIT_ACTIONS.jitRefused,
+				'sign-in',
+				provider,
+				{ provider, reason: 'account-has-other-membership' },
+			);
+			throw new AuthServiceError(
+				'JIT_ACCOUNT_EXISTS',
+				'The account already belongs to another workspace.',
+				401,
+			);
+		}
+		const role = await this.#repository.findRoleByKey(
+			workspace.tenantId,
+			workspace.jitRole,
+		);
+		/* Saving a provider proves the role exists and deleting that role is
+		   refused, so reaching this means the row and the roles drifted apart.
+		   The refusal is recorded under its own reason rather than looking like
+		   a domain or account refusal. */
+		if (!role) {
+			await this.#audit(
+				workspace.tenantId,
+				providerActor(provider),
+				AUDIT_ACTIONS.jitRefused,
+				'sign-in',
+				provider,
+				{ provider, reason: 'role-missing', role: workspace.jitRole },
+			);
+			return null;
+		}
+		const createdAt = this.#now();
+		const member = accountId
+			? await this.#repository.createMembershipInTenant({
+					accountId,
+					tenantId: workspace.tenantId,
+					role: role.key,
+					roleId: role.id,
+					scopes: role.scopes,
+					createdAt,
+				})
+			: await this.#repository.createAccountInTenant({
+					accountId: randomUUID(),
+					tenantId: workspace.tenantId,
+					email: normalizedEmail,
+					normalizedEmail,
+					/* The account signs in through the provider. A random hash nobody
+					   holds keeps the password path closed until a reset sets one. */
+					passwordHash: await hashPassword(
+						randomBytes(32).toString('base64url'),
+						this.#passwordHash,
+					),
+					displayName: displayNameFromEmail(normalizedEmail),
+					role: role.key,
+					roleId: role.id,
+					scopes: role.scopes,
+					createdAt,
+				});
+		await this.#audit(
+			workspace.tenantId,
+			{ kind: 'user', id: member.accountId, label: member.email },
+			AUDIT_ACTIONS.memberProvisioned,
+			'account',
+			member.accountId,
+			{ provider, role: role.key },
+		);
+		return member;
+	}
+
+	/**
+	 * The workspace's own status for one member. Disabling revokes that
+	 * membership's sessions and API tokens and refuses its sign-in; the other
+	 * workspaces of the same account are untouched, and the account status stays
+	 * the deployment operator's platform-level block.
+	 */
+	async setMembershipStatus(
+		actor: AuthActor,
+		accountId: string,
+		status: MembershipStatus,
+	): Promise<{
+		readonly accountId: string;
+		readonly status: MembershipStatus;
+	}> {
+		const target = await this.#targetMember(actor, accountId, {
+			allowSelf: false,
+		});
+		if (status === 'disabled') {
+			await this.#assertOwnerRemains(
+				actor.tenantId,
+				target,
+				target.status === 'active' && target.membershipStatus === 'active',
+			);
+		}
+		await this.#repository.setMembershipStatus(
+			target.accountId,
+			actor.tenantId,
+			status,
+		);
+		if (status === 'disabled') {
+			await this.#repository.deleteMembershipSessions(
+				target.accountId,
+				actor.tenantId,
+			);
+			await this.#repository.revokeMembershipApiTokens(
+				actor.tenantId,
+				target.accountId,
+				this.#now(),
+				actor.accountId,
+			);
+		}
+		await this.#audit(
+			actor.tenantId,
+			this.#actorOf(actor),
+			AUDIT_ACTIONS.membershipStatus,
+			'account',
+			target.accountId,
+			{ status },
+		);
+		return { accountId: target.accountId, status };
+	}
+
 	async resolveSession(token: string | null): Promise<AuthSession | null> {
 		if (!token) return null;
 		return this.#repository.findSession(
@@ -2051,19 +2884,31 @@ export class AuthService {
 		return this.#repository.deleteExpiredSessions(this.#now());
 	}
 
+	/**
+	 * The one audit row a committed settings change owes. A flag is recorded
+	 * under its own action with the values around the change, because an
+	 * operator reviewing a flag needs to see what it was turned to; every other
+	 * setting keeps the plain record, so no declared value ever reaches the
+	 * trail by the side door.
+	 */
 	async recordSettingsUpdate(
 		actor: AuthActor,
-		moduleId: string,
-		key: string,
-		cleared: boolean,
+		change: ModuleSettingChange,
 	): Promise<void> {
+		const flag = change.kind === 'flag';
 		await this.#audit(
 			actor.tenantId,
 			this.#actorOf(actor),
-			AUDIT_ACTIONS.settingsUpdated,
+			flag ? AUDIT_ACTIONS.settingsFlagChanged : AUDIT_ACTIONS.settingsUpdated,
 			'setting',
-			`${moduleId}.${key}`,
-			{ cleared },
+			`${change.moduleId}.${change.key}`,
+			flag
+				? {
+						cleared: change.cleared,
+						previous: change.previous,
+						next: change.next,
+					}
+				: { cleared: change.cleared },
 		);
 	}
 
@@ -2072,9 +2917,22 @@ export class AuthService {
 			Math.max(1, Math.trunc(query.limit)),
 			MAX_AUDIT_PAGE,
 		);
+		const from = this.#auditBound(query.from, 'from');
+		const to = this.#auditBound(query.to, 'to');
+		/* A window that ends before it starts would answer an empty page, which a
+		   caller cannot tell from a workspace with no events in the window. */
+		if (from !== null && to !== null && from > to) {
+			throw new AuthServiceError(
+				'INVALID_INPUT',
+				'from must not be later than to.',
+				400,
+			);
+		}
 		const events = await this.#repository.queryAudit({
 			...query,
 			tenantId: this.#identifier(query.tenantId, 'tenantId'),
+			from,
+			to,
 			limit: limit + 1,
 		});
 		const page = events.slice(0, limit);
@@ -2106,7 +2964,9 @@ export class AuthService {
 			current.principal.accountId,
 			tenantId,
 		);
-		if (!account) {
+		/* A membership the workspace disabled is not a workspace this account may
+		   enter, and it answers exactly as one it never held. */
+		if (!account || account.membershipStatus !== 'active') {
 			throw new AuthServiceError(
 				'TENANT_ACCESS_DENIED',
 				'The requested tenant is not available.',
@@ -2137,7 +2997,11 @@ export class AuthService {
 			accountId,
 			tenantId,
 		);
-		if (!membership || membership.status !== 'active') {
+		if (
+			!membership ||
+			membership.status !== 'active' ||
+			membership.membershipStatus !== 'active'
+		) {
 			throw new AuthServiceError(
 				'ACCOUNT_NOT_FOUND',
 				'The account is not an active member of this workspace.',
@@ -2256,7 +3120,12 @@ export class AuthService {
 			record.accountId,
 			record.tenantId,
 		);
-		if (!membership || membership.status !== 'active') return null;
+		if (
+			!membership ||
+			membership.status !== 'active' ||
+			membership.membershipStatus !== 'active'
+		)
+			return null;
 		const held = new Set(membership.scopes);
 		const scopes = record.scopes.filter((scope) => held.has(scope));
 		if (scopes.length === 0) return null;
@@ -2277,6 +3146,34 @@ export class AuthService {
 		};
 	}
 
+	/* One end of the audit window. An absent end is open; a bound that is not an
+	   epoch millisecond is a caller defect rather than an open end, because
+	   silently dropping it would answer a wider trail than was asked for. */
+	#auditBound(value: number | null | undefined, field: string): number | null {
+		if (value === null || value === undefined) return null;
+		if (!Number.isSafeInteger(value)) {
+			throw new AuthServiceError(
+				'INVALID_INPUT',
+				`${field} must be an epoch millisecond timestamp.`,
+				400,
+			);
+		}
+		return value;
+	}
+
+	/* The bound a paged read surface carries into SQL, so no caller of one can
+	   ask a workspace of unknown size for all of it. */
+	#pageLimit(limit: number, max: number): number {
+		if (!Number.isSafeInteger(limit) || limit < 1 || limit > max) {
+			throw new AuthServiceError(
+				'INVALID_INPUT',
+				`Limit must be 1 to ${max}.`,
+				400,
+			);
+		}
+		return limit;
+	}
+
 	#identifier(value: string, field: string): string {
 		const normalized = value.trim();
 		if (normalized.length < 1 || normalized.length > 128) {