@k2b/cloud 0.11.1 → 0.13.0

package/src/browser/reload.ts

@@ -0,0 +1,34 @@
+/**
+ * Default window in which a second automatic reload for the same key is
+ * suppressed. A page load, hydration, and the first live subscription finish
+ * within a few seconds, so a condition that fails again right after a reload
+ * lands well inside it; a genuinely new change minutes later still reloads.
+ */
+export const AUTOMATIC_RELOAD_WINDOW_MS = 30_000;
+
+const storageKey = (key: string) => `cloud.reload.${key}`;
+
+/**
+ * Reloads the page for an automatic reason (a live event, a failed live
+ * subscription, a changed view) at most once per `key` and window in this tab.
+ *
+ * Returns `false` without reloading when the same key already reloaded within
+ * the window, or when `sessionStorage` is unavailable and a repeat therefore
+ * cannot be ruled out. The caller then keeps the page usable and offers a
+ * user-initiated reload instead. Reloads after an explicit user action do not
+ * need this guard.
+ */
+export const reloadOnce = (key: string, options: { windowMs?: number } = {}): boolean => {
+  const windowMs = options.windowMs ?? AUTOMATIC_RELOAD_WINDOW_MS;
+  const now = Date.now();
+  try {
+    const storage = window.sessionStorage;
+    const last = Number(storage.getItem(storageKey(key)));
+    if (last > 0 && now >= last && now - last < windowMs) return false;
+    storage.setItem(storageKey(key), String(now));
+  } catch {
+    return false;
+  }
+  window.location.reload();
+  return true;
+};

package/src/contracts/shared.ts

@@ -85,12 +85,22 @@ export type LocalUser = z.infer<typeof LocalUserSchema>;
 export const UserSchema = z.discriminatedUnion("provider", [IpaUserSchema, LocalUserSchema]);
 export type User = z.infer<typeof UserSchema>;
 
+/** The user whose personal Linux group (user private group) this is. */
+export const PersonalGroupOwnerSchema = z.object({
+  id: z.uuid(),
+  uid: z.string(),
+  displayName: z.string(),
+});
+export type PersonalGroupOwner = z.infer<typeof PersonalGroupOwnerSchema>;
+
 export const BaseGroupSchema = z.object({
   id: z.uuid(),
   provider: UserProviderSchema,
   name: z.string(),
   description: z.string().nullable(),
   gidnumber: z.number().nullable(),
+  /** Set when the group is a user's personal Linux group; `null` for ordinary groups. */
+  personalOwner: PersonalGroupOwnerSchema.nullable(),
 });
 export type BaseGroup = z.infer<typeof BaseGroupSchema>;
 

package/src/services/account-lifecycle/index.ts

@@ -831,7 +831,7 @@ export const accountLifecycle = {
           OR LOWER(COALESCE(display_name, '')) LIKE ${pattern} ESCAPE '\\'
           OR LOWER(COALESCE(mail, '')) LIKE ${pattern} ESCAPE '\\'
         )
-      ORDER BY deleted_at DESC
+      ORDER BY deleted_at DESC, id DESC
       LIMIT ${config.perPage}
       OFFSET ${offset}
     `;
@@ -905,7 +905,7 @@ export const accountLifecycle = {
           OR LOWER(COALESCE(r.mail, u.mail, '')) LIKE ${pattern} ESCAPE '\\'
           OR LOWER(COALESCE(r.display_name, u.display_name, '')) LIKE ${pattern} ESCAPE '\\'
         )
-      ORDER BY r.created_at DESC
+      ORDER BY r.created_at DESC, r.id DESC
       LIMIT ${config.perPage}
       OFFSET ${offset}
     `;

package/src/services/accounts/app.ts

@@ -909,7 +909,7 @@ export const accountsAppService = {
   group: {
     list: async (config: {
       pagination?: PageParams;
-      filter?: { search?: string };
+      filter?: { search?: string; includePersonal?: boolean };
       scope?: { userId?: string; ids?: string[]; provider?: UserProvider; mode?: "all" | "member" | "managed" };
     }): Promise<Paginated<BaseGroup>> => {
       const { page, perPage } = paginate(config.pagination);
@@ -921,6 +921,7 @@ export const accountsAppService = {
         scope: config.scope?.mode,
         ids: config.scope?.ids,
         provider: config.scope?.provider,
+        includePersonal: config.filter?.includePersonal,
       });
 
       return {
@@ -1202,6 +1203,7 @@ export const accountsAppService = {
       parentGroupId?: string;
       managedByUserId?: string;
       recursive?: boolean;
+      includePersonal?: boolean;
     }): Promise<Paginated<EntityListItem>> => {
       const canSearchDirectory = config.actor.roles.includes("user");
       const usesRelationFilter = Boolean(
@@ -1232,6 +1234,7 @@ export const accountsAppService = {
         parentGroupId: config.parentGroupId,
         managedByUserId: config.managedByUserId,
         recursive: config.recursive,
+        includePersonal: config.includePersonal,
         page,
         perPage,
       });
@@ -1261,7 +1264,7 @@ export const accountsAppService = {
         FROM auth.account_requests r
         JOIN auth.users u ON u.id = r.user_id
         WHERE ${where}
-        ORDER BY r.created_at DESC
+        ORDER BY r.created_at DESC, r.id DESC
         LIMIT ${perPage}
         OFFSET ${offset}
       `;

package/src/services/accounts/base-group.ts

@@ -1,11 +1,40 @@
+import { sql } from "bun";
 import type { BaseGroup, UserProvider } from "../../contracts/shared";
 
 type DbRow = Record<string, unknown>;
 
+/**
+ * Joins the owner of a personal Linux group (the group stored as a user's
+ * `auth.user_posix.primary_group_id`) onto `auth.groups g` as
+ * `personal_owner_id`, `personal_owner_uid`, and `personal_owner_display_name`.
+ * A function, so importing this module never binds Bun's default `sql` handle.
+ */
+export const personalOwnerJoin = () => sql`
+  LEFT JOIN LATERAL (
+    SELECT
+      owner.id AS personal_owner_id,
+      owner.uid AS personal_owner_uid,
+      COALESCE(NULLIF(owner.display_name, ''), NULLIF(owner.mail, ''), owner.uid) AS personal_owner_display_name
+    FROM auth.user_posix owner_posix
+    JOIN auth.users owner ON owner.id = owner_posix.user_id
+    WHERE owner_posix.primary_group_id = g.id
+    ORDER BY owner.id
+    LIMIT 1
+  ) personal_owner ON TRUE
+`;
+
 export const buildBaseGroup = (row: DbRow): BaseGroup => ({
   id: row.id as string,
   provider: row.provider as UserProvider,
   name: row.name as string,
   description: (row.description as string | null | undefined) ?? null,
   gidnumber: (row.gid_number as number | null | undefined) ?? null,
+  personalOwner:
+    typeof row.personal_owner_id === "string"
+      ? {
+          id: row.personal_owner_id,
+          uid: String(row.personal_owner_uid),
+          displayName: String(row.personal_owner_display_name),
+        }
+      : null,
 });

package/src/services/accounts/entities.ts

@@ -2,7 +2,7 @@ import { sql } from "bun";
 import type { EntityKind, EntityListItem, UserProfile, UserProvider } from "../../contracts/shared";
 import { getFreeIpaConfig } from "../freeipa-config";
 import { escapeLikePattern, toPgTextArray, toPgUuidArray } from "../postgres";
-import { buildBaseGroup } from "./base-group";
+import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 import { buildBaseUser } from "./base-user";
 import { buildManagedGroupScopeCondition, recursiveGroupIdsSubquery } from "./group-sql";
 
@@ -26,6 +26,11 @@ export type EntityListParams = {
   parentGroupId?: string;
   managedByUserId?: string;
   recursive?: boolean;
+  /**
+   * Personal Linux groups are left out of directory browsing and search by
+   * default. Exact `groupIds` lookups and relation filters always return them.
+   */
+  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 };
@@ -415,6 +420,11 @@ export const list = async (
   const groupsAdmin = (await getFreeIpaConfig()).groupsAdmin;
   const groupsAdminLiteral = toPgTextArray(groupsAdmin);
   const spec = buildQuerySpec(params);
+  const includePersonal =
+    params.includePersonal === true ||
+    params.groupIds !== undefined ||
+    Boolean(params.memberOfGroupId || params.managerOfGroupId || params.parentGroupId || params.managedByUserId);
+  const personalCondition = includePersonal ? sql`TRUE` : sql`(kind <> 'group' OR personal_owner_id IS NULL)`;
   const visibilityCondition =
     params.visibility.type === "directory"
       ? sql`TRUE`
@@ -465,6 +475,7 @@ export const list = async (
     AND ${excludeGroupCondition}
     AND ${excludeServiceAccountCondition}
     AND ${userMemberOfGroupCondition}
+    AND ${personalCondition}
     AND (
       ${pattern}::text IS NULL
       OR (
@@ -529,6 +540,9 @@ export const list = async (
           NULL::text AS resource_id,
           NULL::uuid AS created_by,
           NULL::timestamptz AS created_at,
+          NULL::uuid AS personal_owner_id,
+          NULL::text AS personal_owner_uid,
+          NULL::text AS personal_owner_display_name,
           LOWER(COALESCE(NULLIF(u.display_name, ''), NULLIF(u.mail, ''), u.uid)) AS sort_label
         ${spec.userFrom}
         WHERE ${spec.userWhere}
@@ -558,8 +572,12 @@ export const list = async (
           NULL::text AS resource_id,
           NULL::uuid AS created_by,
           NULL::timestamptz AS created_at,
+          personal_owner.personal_owner_id,
+          personal_owner.personal_owner_uid,
+          personal_owner.personal_owner_display_name,
           LOWER(g.name) AS sort_label
         ${spec.groupFrom}
+        ${personalOwnerJoin()}
         WHERE ${spec.groupWhere}
       ),
       service_account_rows AS (
@@ -590,6 +608,9 @@ export const list = async (
           sa.resource_id,
           sa.created_by,
           sa.created_at,
+          NULL::uuid AS personal_owner_id,
+          NULL::text AS personal_owner_uid,
+          NULL::text AS personal_owner_display_name,
           LOWER(sa.name) AS sort_label
         FROM auth.service_accounts sa
       ),

package/src/services/accounts/groups.ts

@@ -5,7 +5,7 @@ import { getServiceIpaSession } from "../ipa/service-account";
 import { toPgUuidArray } from "../postgres";
 import { providers } from "../providers";
 import type { AccountsActor } from "./authz";
-import { buildBaseGroup } from "./base-group";
+import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 import { buildManagedGroupScopeCondition, buildMemberGroupScopeCondition } from "./group-sql";
 import * as localGroups from "./local-groups";
 import { posix } from "./posix";
@@ -16,9 +16,10 @@ type GroupListScope = "all" | "member" | "managed";
 
 const getGroup = async (id: string): Promise<BaseGroup | null> => {
   const [row] = await sql<DbRow[]>`
-    SELECT id, provider, name, description, gid_number
-    FROM auth.groups
-    WHERE id = ${id}::uuid
+    SELECT g.id, g.provider, g.name, g.description, g.gid_number, personal_owner.*
+    FROM auth.groups g
+    ${personalOwnerJoin()}
+    WHERE g.id = ${id}::uuid
   `;
   if (!row) return null;
   return buildBaseGroup(row);
@@ -30,6 +31,8 @@ const listCanonical = async (params: {
   scope?: GroupListScope;
   search?: string;
   provider?: UserProvider;
+  /** Personal Linux groups are left out of browsing and search unless requested; an explicit `ids` lookup always returns them. */
+  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 }): Promise<{
@@ -45,6 +48,7 @@ const listCanonical = async (params: {
   const scope = params.scope ?? (params.userId ? "member" : "all");
   const scopeUserId = params.userId ?? "00000000-0000-0000-0000-000000000000";
   const idsCondition = ids.length === 0 ? sql`TRUE` : sql`g.id = ANY(${toPgUuidArray(ids)}::uuid[])`;
+  const includePersonal = params.includePersonal === true || params.ids !== undefined;
 
   if (params.ids && params.ids.length === 0) {
     return {
@@ -60,10 +64,12 @@ const listCanonical = async (params: {
   }
 
   const rows = await sql<DbRow[]>`
-    SELECT g.id, g.provider, g.name, g.description, g.gid_number, COUNT(*) OVER() AS total
+    SELECT g.id, g.provider, g.name, g.description, g.gid_number, personal_owner.*, COUNT(*) OVER() AS total
     FROM auth.groups g
+    ${personalOwnerJoin()}
     WHERE (${params.provider ?? null}::text IS NULL OR g.provider = ${params.provider ?? null})
       AND ${idsCondition}
+      AND (${includePersonal} = true OR personal_owner.personal_owner_id IS NULL)
       AND (
         ${scope === "all"} = true
         OR ${params.userId ?? null}::uuid IS NULL
@@ -99,6 +105,8 @@ export const list = async (params: {
   scope?: GroupListScope;
   search?: string;
   provider?: UserProvider;
+  /** Personal Linux groups are left out of browsing and search unless requested; an explicit `ids` lookup always returns them. */
+  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 }) => {

package/src/services/accounts/identities.ts

@@ -16,7 +16,8 @@ export type AccountIdentityUser = {
   profile: UserProfile;
   posix: { uidNumber: number; primaryGidNumber: number } | null;
 };
-export type AccountIdentityGroup = { id: string; provider: UserProvider; name: string; gidNumber: number | null };
+/** `personal` marks a user's personal Linux group (their stored primary group). */
+export type AccountIdentityGroup = { id: string; provider: UserProvider; name: string; gidNumber: number | null; personal: boolean };
 export type AccountIdentityPage<T> = { items: T[]; nextCursor: string | null };
 export type AccountIdentityAvailability = { localLinuxEnabled: boolean; freeipaEnabled: boolean };
 type InventoryFilter = { provider: UserProvider; after?: string; id?: string; name?: string };
@@ -119,8 +120,10 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
     return current;
   };
   const groupRows = async (filter: SQLQuery) => {
-    const rows = await db<{ id: string; provider: UserProvider; name: string; gid_number: number | null }[]>`
-      SELECT g.id, g.provider, g.name, g.gid_number FROM auth.groups g
+    const rows = await db<{ id: string; provider: UserProvider; name: string; gid_number: number | null; personal: boolean }[]>`
+      SELECT g.id, g.provider, g.name, g.gid_number,
+        EXISTS(SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id) AS personal
+      FROM auth.groups g
       WHERE ${filter} ORDER BY g.id LIMIT ${PAGE_SIZE + 1}
     `;
     return rows.map(
@@ -129,6 +132,7 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
         provider: row.provider,
         name: row.name,
         gidNumber: positiveId(row.gid_number) ? row.gid_number : null,
+        personal: row.personal,
       }),
     );
   };

package/src/services/accounts/local-groups.ts

@@ -1,6 +1,7 @@
 import { sql } from "bun";
 import type { BaseGroup, GroupMember, MutationResult, UserProvider } from "../../contracts/shared";
 import { escapeLikePattern, isUniqueViolation } from "../postgres";
+import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 
 type DbRow = Record<string, unknown>;
 
@@ -18,6 +19,7 @@ const toBaseGroup = (row: LocalGroupRow): BaseGroup => ({
   name: row.name,
   description: row.description,
   gidnumber: row.gidNumber,
+  personalOwner: null,
 });
 
 const getLocalGroupById = async (id: string): Promise<LocalGroupRow | null> => {
@@ -73,8 +75,13 @@ const wouldCreateLocalGroupCycle = async (params: { parentGroupId: string; child
 };
 
 export const get = async (params: { id: string }): Promise<BaseGroup | null> => {
-  const row = await getLocalGroupById(params.id);
-  return row ? toBaseGroup(row) : null;
+  const [row] = await sql<DbRow[]>`
+    SELECT g.id, g.provider, g.name, g.description, g.gid_number, personal_owner.*
+    FROM auth.groups g
+    ${personalOwnerJoin()}
+    WHERE g.id = ${params.id}::uuid AND g.provider = 'local'
+  `;
+  return row ? buildBaseGroup(row) : null;
 };
 
 export const create = async (params: { name: string; description?: string }, db: typeof sql = sql): Promise<MutationResult<BaseGroup>> => {
@@ -119,8 +126,9 @@ export const list = async (params: { page?: number; perPage?: number; search?: s
   `;
   const total = Number(countRow?.count ?? 0);
   const rows = await sql<DbRow[]>`
-    SELECT id, provider, name, description, gid_number
+    SELECT g.id, g.provider, g.name, g.description, g.gid_number, personal_owner.*
     FROM auth.groups g
+    ${personalOwnerJoin()}
     WHERE g.provider = 'local'
       AND (${pattern}::text IS NULL OR LOWER(g.name) LIKE ${pattern} ESCAPE '\\' OR LOWER(g.description) LIKE ${pattern} ESCAPE '\\')
     ORDER BY g.name
@@ -128,15 +136,7 @@ export const list = async (params: { page?: number; perPage?: number; search?: s
   `;
 
   return {
-    groups: rows.map((row) =>
-      toBaseGroup({
-        id: row.id as string,
-        provider: row.provider as "local",
-        name: row.name as string,
-        description: row.description as string | null,
-        gidNumber: row.gid_number as number | null,
-      }),
-    ),
+    groups: rows.map(buildBaseGroup),
     total,
     pagination: {
       page,

package/src/services/app-approval.ts

@@ -1,5 +1,6 @@
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { type SQL, sql } from "bun";
+import { lazySync } from "../_internal/process-sync";
 import { env } from "../config/env";
 import { type AccountCategory, accountCategory } from "../contracts/account-categories";
 import {
@@ -17,6 +18,7 @@ import {
 import { publicCloudOrigin } from "../shared/app-url";
 import { isAccountCategoryAllowed } from "./account-category-policy";
 import { audit } from "./audit";
+import { logger } from "./logging";
 import { CORE_SETTINGS } from "./settings/core-settings";
 import { decryptValue } from "./settings/crypto";
 
@@ -136,6 +138,33 @@ type LoginRow = {
 };
 export type AppApprovalActor = { userId: string; sid: string; admin: boolean };
 export type AppDeviceEnrollmentNotice = { deviceId: string; userId: string; name: string; assisted: boolean };
+/** Best-effort wake-ups for browsers waiting on a login decision. Postgres stays authoritative. */
+export type AppLoginDecisionHints = {
+  /** Call after the decision commits. Must not throw or delay the caller. */
+  publish(requestId: string): void;
+  /** Settles on the first hint for this request, or when `signal` aborts. */
+  wait(requestId: string, signal: AbortSignal): Promise<void>;
+};
+const log = logger("app-approval");
+const decisionTopic = lazySync((sync) =>
+  sync.topic<null>({
+    id: "cloud:app-login-decisions",
+    owner: "cloud",
+    retention: { maxAgeMs: 120_000, maxBytes: 1_048_576 },
+    maxPayloadBytes: 2000,
+  }),
+);
+/** Core NATS broadcast reaches the waiting browser on any replica. */
+export const syncLoginDecisionHints: AppLoginDecisionHints = {
+  publish: (requestId) => {
+    void Promise.resolve()
+      .then(() => decisionTopic().publish({ tenantId: requestId, data: null }))
+      .catch((error) => log.warn("App login decision hint failed", { error: String(error) }));
+  },
+  wait: async (requestId, signal) => {
+    for await (const _event of decisionTopic().live({ tenantId: requestId, signal })) return;
+  },
+};
 const view = (row: DeviceRow): AppDeviceView => ({
   id: row.id,
   name: row.name,
@@ -163,6 +192,7 @@ const verify = async (key: AppDevicePublicKey, message: string, signature: strin
 export const createAppApprovalService = (
   db: SQL = sql,
   configuration = (requireEnabled = true) => readAppApprovalConfig(db, requireEnabled),
+  hints: AppLoginDecisionHints = syncLoginDecisionHints,
 ) => {
   const config = async (requireEnabled = true) => {
     const value = await configuration(requireEnabled);
@@ -409,7 +439,7 @@ export const createAppApprovalService = (
       )
         return reject("FORBIDDEN", 403);
       await cleanup();
-      return db.begin(async (tx) => {
+      const outcome = await db.begin(async (tx) => {
         const device = await activeDevice(tx, proof.deviceId, cfg.issuer);
         if (!(await verify(AppDevicePublicKeySchema.parse(device.public_key), appDeviceProofMessage(proof), signature)))
           return reject("FORBIDDEN", 403);
@@ -460,12 +490,39 @@ export const createAppApprovalService = (
         await record(tx, `login.${command.decision}`, device.user_id, device.id, { requestId: row.id });
         return { state };
       });
+      // Only after commit: the waiting browser re-reads Postgres, so a hint never grants anything.
+      if (proof.command.operation === "decide") hints.publish(proof.command.requestId);
+      return outcome;
     },
-    browserStatus: async (id: string, token: string) => {
+    /** With `hold`, a pending request is answered on its decision, its expiry, or after `hold.ms`, whichever comes first. */
+    browserStatus: async (id: string, token: string, hold?: { ms: number; signal?: AbortSignal }) => {
       const cfg = await config();
-      const [row] = await db<LoginRow[]>`SELECT * FROM auth.app_logins WHERE id=${id}::uuid AND issuer=${cfg.issuer}`;
-      if (!row || !matches(token, row.browser_hash)) return reject("UNAVAILABLE", 404);
-      return { state: new Date(row.expires_at).getTime() <= Date.now() ? "expired" : row.state, pollAfterSeconds: limits.pollSeconds };
+      const read = async () => {
+        const [row] = await db<LoginRow[]>`SELECT * FROM auth.app_logins WHERE id=${id}::uuid AND issuer=${cfg.issuer}`;
+        if (!row || !matches(token, row.browser_hash)) return reject("UNAVAILABLE", 404);
+        const expiresIn = new Date(row.expires_at).getTime() - Date.now();
+        return { state: expiresIn <= 0 ? "expired" : row.state, expiresIn };
+      };
+      const result = (state: string) => ({ state, pollAfterSeconds: limits.pollSeconds });
+      if (!hold) return result((await read()).state);
+      // Listen before the first read so a decision committed in between still wakes this request.
+      const waiting = new AbortController();
+      const ended = new Promise((resolve) => waiting.signal.addEventListener("abort", resolve, { once: true }));
+      const stop = () => waiting.abort();
+      hold.signal?.addEventListener("abort", stop, { once: true });
+      if (hold.signal?.aborted) stop();
+      const hint = hints.wait(id, waiting.signal).catch(() => {});
+      try {
+        const first = await read();
+        if (first.state !== "pending") return result(first.state);
+        const timer = setTimeout(stop, Math.min(hold.ms, first.expiresIn));
+        await Promise.race([hint, ended]);
+        clearTimeout(timer);
+        return result((await read()).state);
+      } finally {
+        hold.signal?.removeEventListener("abort", stop);
+        stop();
+      }
     },
     consumeLogin: async (id: string, token: string) => {
       const cfg = await config();

package/src/services/ipa/groups.ts

@@ -22,6 +22,7 @@ const toBaseGroup = (row: IpaGroupRow): BaseGroup => ({
   name: row.name,
   description: row.description,
   gidnumber: row.gidNumber,
+  personalOwner: null,
 });
 
 const getIpaGroupById = async (id: string): Promise<IpaGroupRow | null> => {
@@ -142,6 +143,7 @@ export const list = async (params: {
       name: row.name as string,
       description: row.description as string | null,
       gidnumber: row.gid_number as number | null,
+      personalOwner: null,
     })),
     total,
     pagination: { page, perPage, totalPages, hasNext: page < totalPages },
@@ -377,6 +379,7 @@ export const add = async (params: {
       name: row.name as string,
       description: row.description as string | null,
       gidnumber: row.gid_number as number | null,
+      personalOwner: null,
     },
   };
 };

package/src/services/ipa/search.ts

@@ -147,6 +147,7 @@ export const search = async (query: string, options: SearchOptions): Promise<{ u
       name: row.name,
       description: row.description ?? null,
       gidnumber: row.gid_number ?? null,
+      personalOwner: null,
     }));
   }
 

package/src/services/logging/index.ts

@@ -205,7 +205,7 @@ const list = async (
         AND (${filterLevel}::text IS NULL OR level = ${filterLevel})
         AND (${filterSinceHours}::int IS NULL OR created_at >= now() - (${filterSinceHours}::int * INTERVAL '1 hour'))
         AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\\')
-      ORDER BY created_at DESC
+      ORDER BY created_at DESC, id DESC
       LIMIT ${perPage} OFFSET ${offset}
     `;
   } else if (hasSourceList) {
@@ -225,7 +225,7 @@ const list = async (
         AND (${filterLevel}::text IS NULL OR level = ${filterLevel})
         AND (${filterSinceHours}::int IS NULL OR created_at >= now() - (${filterSinceHours}::int * INTERVAL '1 hour'))
         AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\\')
-      ORDER BY created_at DESC
+      ORDER BY created_at DESC, id DESC
       LIMIT ${perPage} OFFSET ${offset}
     `;
   } else {
@@ -243,7 +243,7 @@ const list = async (
       WHERE (${filterLevel}::text IS NULL OR level = ${filterLevel})
         AND (${filterSinceHours}::int IS NULL OR created_at >= now() - (${filterSinceHours}::int * INTERVAL '1 hour'))
         AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\\')
-      ORDER BY created_at DESC
+      ORDER BY created_at DESC, id DESC
       LIMIT ${perPage} OFFSET ${offset}
     `;
   }

package/src/services/logging/trace.ts

@@ -789,7 +789,7 @@ const list = async (
         ) AS event_count
       FROM logging.trace_spans s
       WHERE ${where}
-      ORDER BY COALESCE(s.ended_at, s.updated_at, s.started_at) DESC
+      ORDER BY COALESCE(s.ended_at, s.updated_at, s.started_at) DESC, s.trace_id DESC, s.span_id DESC
       LIMIT ${perPage} OFFSET ${offset}
     `,
   ]);

package/src/services/notifications/batches.ts

@@ -460,7 +460,7 @@ export const list = async (params?: {
     SELECT *, COUNT(*) OVER() AS total
     FROM notifications.batches
     WHERE (${params?.status ?? null}::text IS NULL OR status = ${params?.status ?? null})
-    ORDER BY created_at DESC
+    ORDER BY created_at DESC, id DESC
     LIMIT ${perPage} OFFSET ${offset}
   `;
   return {

package/src/services/notifications/index.ts

@@ -235,7 +235,7 @@ export const list = async (
         WHERE
           (${statusFilter}::text IS NULL OR CASE WHEN m.sent_at IS NOT NULL THEN 'sent' WHEN m.error IS NOT NULL THEN 'error' ELSE 'pending' END = ${statusFilter})
           AND (m.subject ILIKE ${searchPattern} ESCAPE '\' OR m.content ILIKE ${searchPattern} ESCAPE '\' OR m.recipient ILIKE ${searchPattern} ESCAPE '\')
-        ORDER BY m.created_at DESC
+        ORDER BY m.created_at DESC, m.id DESC
         LIMIT ${perPage} OFFSET ${offset}
       `;
     } else {
@@ -251,7 +251,7 @@ export const list = async (
         FROM notifications.messages m
         LEFT JOIN auth.users u ON m.sent_by = u.id
         WHERE ${statusFilter}::text IS NULL OR CASE WHEN m.sent_at IS NOT NULL THEN 'sent' WHEN m.error IS NOT NULL THEN 'error' ELSE 'pending' END = ${statusFilter}
-        ORDER BY m.created_at DESC
+        ORDER BY m.created_at DESC, m.id DESC
         LIMIT ${perPage} OFFSET ${offset}
       `;
     }
@@ -276,7 +276,7 @@ export const list = async (
           m.sent_by = ${sentBy}
           AND (${statusFilter}::text IS NULL OR CASE WHEN m.sent_at IS NOT NULL THEN 'sent' WHEN m.error IS NOT NULL THEN 'error' ELSE 'pending' END = ${statusFilter})
           AND (m.subject ILIKE ${searchPattern} ESCAPE '\' OR m.content ILIKE ${searchPattern} ESCAPE '\' OR m.recipient ILIKE ${searchPattern} ESCAPE '\')
-        ORDER BY m.created_at DESC
+        ORDER BY m.created_at DESC, m.id DESC
         LIMIT ${perPage} OFFSET ${offset}
       `;
     } else {
@@ -296,7 +296,7 @@ export const list = async (
         WHERE
           m.sent_by = ${sentBy}
           AND (${statusFilter}::text IS NULL OR CASE WHEN m.sent_at IS NOT NULL THEN 'sent' WHEN m.error IS NOT NULL THEN 'error' ELSE 'pending' END = ${statusFilter})
-        ORDER BY m.created_at DESC
+        ORDER BY m.created_at DESC, m.id DESC
         LIMIT ${perPage} OFFSET ${offset}
       `;
     }

package/src/services/service-account-credentials.ts

@@ -553,7 +553,7 @@ export const listOverview = async (config?: {
         OR sa.resource_type ILIKE '%' || ${search} || '%'
         OR sa.resource_id ILIKE '%' || ${search} || '%'
       )
-    ORDER BY c.created_at DESC
+    ORDER BY c.created_at DESC, c.id DESC
     LIMIT ${perPage}
     OFFSET ${offset}
   `;

package/src/services/webauthn.ts

@@ -21,7 +21,7 @@ import { coreSettings } from "./settings/api";
 const CHALLENGE_TTL_SECONDS = 300;
 const REGISTRATION_CHALLENGE_PREFIX = "webauthn:registration:";
 const AUTHENTICATION_CHALLENGE_PREFIX = "webauthn:authentication:";
-const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{12}$/i;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const log = logger("auth:webauthn");
 
 type DbPasskeyRow = {

package/src/shared/account-display.ts

@@ -13,3 +13,17 @@ export const getAccountTypeLabel = (user: Pick<AccountLike, "profile">): string
 export const getManagementLabel = (user: Pick<AccountLike, "provider">): string => (user.provider === "ipa" ? "FreeIPA" : "Local");
 
 export const getSupplementalRoleLabel = (role: SupplementalRole): string => (role === "group-manager" ? "Group Manager" : "Admin");
+
+const isGerman = (locale: string | null | undefined): boolean => locale?.toLowerCase().split(/[-_]/)[0] === "de";
+
+/**
+ * Display form of a group name for people. In German, the first letter of each
+ * word separated by whitespace or a hyphen is capitalised (`buchhaltung` →
+ * `Buchhaltung`); other locales get the name unchanged. Use it only for rendered
+ * text: stored names, identifiers, URLs, search input, and API or JSON output
+ * keep the original name.
+ */
+export const groupDisplayName = (name: string, locale: string | null | undefined): string =>
+  isGerman(locale)
+    ? name.replace(/(^|[\s-])(\p{L})/gu, (_, separator: string, letter: string) => separator + letter.toLocaleUpperCase("de"))
+    : name;