@k2b/cloud 0.17.0 → 0.18.0

package/src/services/accounts/users.ts

@@ -34,7 +34,8 @@ type CreateUserData = {
   provider: UserProvider;
   profile: UserProfile;
   admin?: boolean;
-  email: string;
+  /** Optional only for local full accounts while `user.local_email_optional` is on. */
+  email?: string | null;
   givenname: string;
   sn: string;
   displayName?: string;
@@ -47,7 +48,8 @@ type UpdateUserData = {
   givenname?: string;
   sn?: string;
   displayName?: string;
-  mail?: string;
+  /** `null` removes the address of a local account when its policy allows that. */
+  mail?: string | null;
   ipa?: {
     phone?: string;
     address?: {
@@ -456,6 +458,8 @@ export const create = async (params: {
     return { ok: true, data: { user } };
   }
 
+  const email = params.data.email?.trim();
+  if (!email) return { ok: false, error: "FreeIPA accounts need an email address.", status: 400 };
   const serviceSession = await getServiceIpaSession();
   if (!serviceSession.ok) return serviceSession;
 
@@ -464,7 +468,7 @@ export const create = async (params: {
     profile: params.data.profile,
     accountExpires,
     data: {
-      email: params.data.email,
+      email,
       givenname: params.data.givenname,
       sn: params.data.sn,
       displayName: params.data.displayName,
@@ -489,12 +493,14 @@ export const update = async (params: { id: string; data: UpdateUserData }): Prom
   if (!user) return { ok: false, error: "User not found", status: 404 };
 
   if (user.provider === "ipa") {
+    const { mail, ...data } = params.data;
+    if (mail === null) return { ok: false, error: "FreeIPA accounts need an email address.", status: 400 };
     const serviceSession = await getServiceIpaSession();
     if (!serviceSession.ok) return serviceSession;
     return providers.ipa.users.update({
       ipaSession: serviceSession.data,
       id: params.id,
-      data: params.data,
+      data: mail === undefined ? data : { ...data, mail },
     });
   }
 
@@ -578,6 +584,16 @@ export const setExpiry = async (params: {
   });
 };
 
+/**
+ * Administrators never receive sign-in tokens for the shared emergency
+ * `admin` identity. Break-glass access uses `ADMIN_LOGIN_TOKEN`, so everyday
+ * actions stay attributed to the administrator who performs them.
+ */
+const emergencyAdminSignInError = (user: { uid: string }): MutationResult<never> | null =>
+  user.uid === providers.local.users.EMERGENCY_ADMIN_UID
+    ? { ok: false, error: "The emergency admin account has no login tokens or links. Use the admin login token instead.", status: 403 }
+    : null;
+
 export const sendLoginLink = async (params: {
   id: string;
   notificationSender: AccountsNotificationSender;
@@ -588,9 +604,11 @@ export const sendLoginLink = async (params: {
   if (user.provider !== "local") {
     return { ok: false, error: "Login links are only available for local accounts", status: 400 };
   }
+  const emergencyError = emergencyAdminSignInError(user);
+  if (emergencyError) return emergencyError;
   if (!user.mail) return { ok: false, error: "A local account requires an email address to receive a login link", status: 400 };
 
-  const token = await providers.local.auth.createMagicLinkToken({ email: user.mail, ttlSeconds: 300 });
+  const token = await providers.local.auth.createAccountLoginToken({ userId: user.id, ttlSeconds: 300 });
   const rawAppUrl = await settings.get<string>("app.url");
   const appUrl = rawAppUrl.startsWith("http") ? rawAppUrl : `https://${rawAppUrl}`;
   try {
@@ -615,15 +633,11 @@ export const createLoginToken = async (params: {
   if (user.provider !== "local") {
     return { ok: false, error: "Login tokens are only available for local accounts", status: 400 };
   }
-  if (!user.mail) {
-    return { ok: false, error: "A local account requires an email address before a login token can be created", status: 400 };
-  }
+  const emergencyError = emergencyAdminSignInError(user);
+  if (emergencyError) return emergencyError;
 
   const expiresInSeconds = 300;
-  const token = await providers.local.auth.createMagicLinkToken({
-    email: user.mail,
-    ttlSeconds: expiresInSeconds,
-  });
+  const token = await providers.local.auth.createAccountLoginToken({ userId: user.id, ttlSeconds: expiresInSeconds });
   const rawAppUrl = await settings.get<string>("app.url");
   const appUrl = rawAppUrl.startsWith("http") ? rawAppUrl : `https://${rawAppUrl}`;
 

package/src/services/app-approval.ts

@@ -115,6 +115,8 @@ type PairingRow = {
   initiated_by: string;
   initiator_sid: string;
   assisted: boolean;
+  /** The target account's epoch at start; a sign-out everywhere moves it and voids the pairing. */
+  auth_epoch: string | null;
   secret_hash: string;
   state: string;
   expires_at: Date;
@@ -137,6 +139,8 @@ type LoginRow = {
   expires_at: Date;
 };
 export type AppApprovalActor = { userId: string; sid: string; admin: boolean };
+/** Administration of another account's devices needs current admin authority, not a recent session. */
+export type AppDeviceAdministrator = Pick<AppApprovalActor, "userId" | "admin">;
 export type AppDeviceEnrollmentNotice = { deviceId: string; userId: string; name: string; assisted: boolean };
 /** Best-effort wake-ups for browsers waiting on a login decision. Postgres stays authoritative. */
 export type AppLoginDecisionHints = {
@@ -250,7 +254,7 @@ export const createAppApprovalService = (
       (pairing.assisted && (!actor.admin || !cfg.adminPairing))
     )
       return reject("FORBIDDEN", 403);
-    await eligible(tx, pairing.user_id);
+    return eligible(tx, pairing.user_id);
   };
   const activeDevice = async (tx: SQL, id: string, issuer: string): Promise<DeviceRow> => {
     const [device] = await tx<DeviceRow[]>`SELECT * FROM auth.app_devices WHERE id = ${id}::uuid AND issuer = ${issuer} FOR UPDATE`;
@@ -282,14 +286,17 @@ export const createAppApprovalService = (
     cleanup,
     maintain: async (notify: (notice: AppDeviceEnrollmentNotice) => Promise<unknown>, signal?: AbortSignal) => {
       await cleanup();
-      const rows = await db<
-        DeviceRow[]
-      >`SELECT * FROM auth.app_devices WHERE notified_at IS NULL ORDER BY created_at LIMIT ${limits.pageSize}`;
+      const rows = await db<(DeviceRow & { has_email: boolean })[]>`
+        SELECT d.*, COALESCE(btrim(u.mail), '') <> '' AS has_email
+        FROM auth.app_devices d JOIN auth.users u ON u.id = d.user_id
+        WHERE d.notified_at IS NULL ORDER BY d.created_at LIMIT ${limits.pageSize}`;
       for (const row of rows) {
         signal?.throwIfAborted();
         // The notification owner deduplicates by deviceId. A crash after send
         // but before this marker is safe; no external effect precedes enrollment.
-        await notify({ deviceId: row.id, userId: row.user_id, name: row.name, assisted: row.assisted });
+        // The notice is email-only, so an account without email relies on the
+        // enrollment audit entry instead of a delivery that can only fail.
+        if (row.has_email) await notify({ deviceId: row.id, userId: row.user_id, name: row.name, assisted: row.assisted });
         await db`UPDATE auth.app_devices SET notified_at=now() WHERE id=${row.id}::uuid AND notified_at IS NULL`;
       }
     },
@@ -314,13 +321,13 @@ export const createAppApprovalService = (
         await fresh(tx, actor);
         if (targetId !== actor.userId && (!actor.admin || !cfg.adminPairing)) return reject("FORBIDDEN", 403);
         await tx`SELECT id FROM auth.users WHERE id = ${targetId}::uuid FOR UPDATE`;
-        await eligible(tx, targetId);
+        const target = await eligible(tx, targetId);
         const [count] = await tx<
           { count: number }[]
         >`SELECT count(*)::int AS count FROM auth.app_pairings WHERE issuer = ${cfg.issuer} AND user_id = ${targetId}::uuid AND expires_at > now() AND state IN ('pending','claimed')`;
         if ((count?.count ?? 0) >= limits.pendingPerAccount) return reject("LIMIT_REACHED", 429);
-        await tx`INSERT INTO auth.app_pairings(id, issuer, user_id, initiated_by, initiator_sid, assisted, secret_hash, expires_at)
-          VALUES (${id}::uuid,${cfg.issuer},${targetId}::uuid,${actor.userId}::uuid,${actor.sid}::uuid,${targetId !== actor.userId},${hash(token)},${expiresAt})`;
+        await tx`INSERT INTO auth.app_pairings(id, issuer, user_id, initiated_by, initiator_sid, assisted, auth_epoch, secret_hash, expires_at)
+          VALUES (${id}::uuid,${cfg.issuer},${targetId}::uuid,${actor.userId}::uuid,${actor.sid}::uuid,${targetId !== actor.userId},${target.auth_epoch},${hash(token)},${expiresAt})`;
         await record(tx, "pairing.start", actor.userId, id, { targetUserId: targetId, assisted: targetId !== actor.userId });
         return { protocol: APP_APPROVAL_PROTOCOL, issuer: cfg.issuer, pairingId: id, secret: token, expiresAt: iso(expiresAt) };
       });
@@ -356,7 +363,8 @@ export const createAppApprovalService = (
       return db.begin(async (tx) => {
         const [p] = await tx<PairingRow[]>`SELECT * FROM auth.app_pairings WHERE id = ${id}::uuid AND issuer = ${cfg.issuer}`;
         if (!p || new Date(p.expires_at).getTime() <= Date.now()) return reject("UNAVAILABLE", 404);
-        await authorizePairing(tx, actor, p, cfg);
+        // A pairing from before the account was signed out everywhere reads as expired.
+        if ((await authorizePairing(tx, actor, p, cfg)).auth_epoch !== p.auth_epoch) return reject("UNAVAILABLE", 404);
         return { state: p.state, name: p.name, comparison: p.comparison, deviceId: p.device_id, userId: p.user_id };
       });
     },
@@ -373,8 +381,11 @@ export const createAppApprovalService = (
           !p.name
         )
           return reject("CONFLICT", 409);
-        await authorizePairing(tx, actor, p, cfg);
+        // Lock the account before checking the session and epoch: a concurrent sign-out
+        // everywhere either revokes this device after it exists, or fails these checks.
+        // The epoch also voids assisted pairings, whose administrator session outlives it.
         await tx`SELECT id FROM auth.users WHERE id = ${p.user_id}::uuid FOR UPDATE`;
+        if ((await authorizePairing(tx, actor, p, cfg)).auth_epoch !== p.auth_epoch) return reject("CONFLICT", 409);
         const [count] = await tx<
           { count: number }[]
         >`SELECT count(*)::int AS count FROM auth.app_devices WHERE issuer = ${cfg.issuer} AND user_id = ${p.user_id}::uuid AND revoked_at IS NULL`;
@@ -423,6 +434,31 @@ export const createAppApprovalService = (
         await record(tx, name === undefined ? "device.revoke" : "device.rename", actor.userId, id);
       });
     },
+    /** Active devices of any account, for administrators. Bounded by the active-device limit. */
+    listUserDevices: async (actor: AppDeviceAdministrator, userId: string): Promise<AppDeviceView[]> => {
+      if (!actor.admin) return reject("FORBIDDEN", 403);
+      const cfg = await config(false);
+      const rows = await db<
+        DeviceRow[]
+      >`SELECT * FROM auth.app_devices WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND revoked_at IS NULL ORDER BY created_at, id LIMIT ${limits.devicesPerAccount}`;
+      return rows.map(view);
+    },
+    /** Idempotent: `revoked` is true only for the call that revoked the device. Works while the account is
+     * expired or app sign-in is disabled, because revocation only removes access. */
+    revokeUserDevice: async (actor: AppDeviceAdministrator, userId: string, id: string) => {
+      if (!actor.admin) return reject("FORBIDDEN", 403);
+      const cfg = await config(false);
+      return db.begin(async (tx) => {
+        const [device] = await tx<
+          DeviceRow[]
+        >`SELECT * FROM auth.app_devices WHERE id=${id}::uuid AND issuer=${cfg.issuer} AND user_id=${userId}::uuid FOR UPDATE`;
+        if (!device) return reject("UNAVAILABLE", 404);
+        if (device.revoked_at) return { device: view(device), revoked: false };
+        const [row] = await tx<DeviceRow[]>`UPDATE auth.app_devices SET revoked_at=now() WHERE id=${id}::uuid RETURNING *`;
+        await record(tx, "device.revoke", actor.userId, id, { targetUserId: userId });
+        return { device: view(row!), revoked: true };
+      });
+    },
     startLogin: async (identifier: string, category: AccountCategory) => {
       const cfg = await config();
       await cleanup();
@@ -488,6 +524,17 @@ export const createAppApprovalService = (
           await tx`UPDATE auth.app_devices SET push_token=${command.token} WHERE id=${device.id}::uuid`;
           return { state: "updated" as const };
         }
+        if (command.operation === "account") {
+          // Only the account this device signs in; activeDevice already checked it exists and may use app approval.
+          const [user] = await tx<
+            { uid: string; display_name: string; mail: string | null }[]
+          >`SELECT uid, display_name, mail FROM auth.users WHERE id=${device.user_id}::uuid`;
+          if (!user) return reject("FORBIDDEN", 403);
+          return {
+            account: { uid: user.uid, displayName: user.display_name, mail: user.mail || null },
+            device: { name: device.name, createdAt: iso(device.created_at) },
+          };
+        }
         if (command.operation === "revoke") {
           await tx`UPDATE auth.app_devices SET revoked_at=now() WHERE id=${device.id}::uuid`;
           await record(tx, "device.revoke", device.user_id, device.id);

package/src/services/auth-flows/deferred.ts

@@ -0,0 +1,41 @@
+import { logger } from "../logging";
+
+const log = logger("auth:deferred");
+
+/**
+ * Enumeration-safe requests answer before their lookup and delivery run. That
+ * work takes a few Postgres and Valkey round trips, so the backlog stays near
+ * zero; it reaches this limit only while a backend stalls. Further requests
+ * are then dropped until the backlog shrinks. Their answer is the same either
+ * way, so dropping reveals nothing.
+ */
+export const MAX_DEFERRED_REQUESTS = 100;
+
+const running = new Set<Promise<void>>();
+let dropped = 0;
+
+/**
+ * Starts `work` without holding up the caller's answer. The returned promise
+ * settles when the work has finished or was dropped; it never rejects.
+ */
+export const run = (label: string, work: () => Promise<void>): Promise<void> => {
+  if (running.size >= MAX_DEFERRED_REQUESTS) {
+    // One entry per overload episode; a log row per dropped request would add load.
+    if (dropped++ === 0) log.warn("Dropping sign-in requests while the backlog is full", { limit: MAX_DEFERRED_REQUESTS });
+    return Promise.resolve();
+  }
+  if (dropped > 0) {
+    log.warn("Accepting sign-in requests again", { dropped });
+    dropped = 0;
+  }
+  const task: Promise<void> = work()
+    .catch((error) => log.error(`${label} failed`, { error: error instanceof Error ? error.message : String(error) }))
+    .finally(() => running.delete(task));
+  running.add(task);
+  return task;
+};
+
+/** Waits for accepted work so a graceful shutdown does not lose it. */
+export const drain = async (): Promise<void> => {
+  await Promise.all(running);
+};

package/src/services/auth-flows/magic-link.ts

@@ -7,6 +7,7 @@ import { accounts } from "../accounts";
 import { logger } from "../logging";
 import { providers } from "../providers";
 import * as settings from "../settings";
+import * as deferred from "./deferred";
 import type { AuthNotificationSender } from "./notification-sender";
 
 const log = logger("auth:magic-link");
@@ -60,13 +61,24 @@ const resolveEmailForUsername = async (username: string): Promise<string | null>
   return mail ? normalizeEmail(mail) : null;
 };
 
-export const request = async (
-  params: { email: string; redirectTo?: string; locale?: string; category?: "guest" | "login" },
-  notificationSender: AuthNotificationSender,
-): Promise<{ ok: true } | { ok: false; status: 400; message: string }> => {
+type SignInLinkRequest = { email: string; redirectTo?: string; locale?: string; category?: "guest" | "login" };
+
+/**
+ * Accepts a sign-in link request without revealing whether an account exists.
+ * The lookup and delivery run after this returns, so existing, unknown and
+ * mail-less accounts get the same response in the same time. `settled`
+ * resolves when that bounded background work has finished or was dropped
+ * under overload; it never rejects.
+ */
+export const request = (params: SignInLinkRequest, notificationSender: AuthNotificationSender): { ok: true; settled: Promise<void> } => ({
+  ok: true,
+  settled: deferred.run("Sign-in link request", () => deliverSignInLink(params, notificationSender)),
+});
+
+const deliverSignInLink = async (params: SignInLinkRequest, notificationSender: AuthNotificationSender): Promise<void> => {
   const identifier = params.email.trim();
   const email = identifier.includes("@") ? normalizeEmail(identifier) : await resolveEmailForUsername(identifier);
-  if (!email) return { ok: true };
+  if (!email) return;
   const hasIpaUser = await hasIpaAccountForEmail(email);
   const userRows = hasIpaUser
     ? []
@@ -77,25 +89,25 @@ export const request = async (
   const allowSelfRegistration = await settings.get<boolean>("user.allow_self_registration");
 
   if (hasIpaUser) {
-    if (!(await isAccountCategoryAllowed({ provider: "ipa", profile: "user" }))) return { ok: true };
+    if (!(await isAccountCategoryAllowed({ provider: "ipa", profile: "user" }))) return;
     if (await claimIpaHintCooldown(email)) {
-      void sendIpaEmailLoginHint({ email, redirectTo: params.redirectTo, locale: params.locale }, notificationSender).catch((error) => {
+      await sendIpaEmailLoginHint({ email, redirectTo: params.redirectTo, locale: params.locale }, notificationSender).catch((error) => {
         log.warn("Failed to send FreeIPA email-login hint", {
           email,
           error: error instanceof Error ? error.message : String(error),
         });
       });
     }
-    return { ok: true };
+    return;
   }
 
   if (localUser && ((params.category && accountCategory(localUser) !== params.category) || !(await isAccountCategoryAllowed(localUser))))
-    return { ok: true };
+    return;
   if (
     !localUser &&
     (!allowSelfRegistration || params.category === "login" || !(await isAccountCategoryAllowed({ provider: "local", profile: "guest" })))
   ) {
-    return { ok: true };
+    return;
   }
 
   const token = await providers.local.auth.createMagicLinkToken({ email, category: params.category, ttlSeconds: 300 });
@@ -106,27 +118,51 @@ export const request = async (
     const result = await notificationSender.sendMagicLink({ email, token, magicLink, locale: params.locale });
     if (result.status === "error") log.error("Magic link delivery failed", { notificationId: result.id });
   } catch (error) {
-    // Keep the response generic to prevent account enumeration. The durable
-    // sender records accepted delivery failures; pre-persistence failures land here.
+    // The durable sender records accepted delivery failures; pre-persistence failures land here.
     log.error("Magic link notification could not be accepted", {
       error: error instanceof Error ? error.message : String(error),
     });
   }
-
-  return { ok: true };
 };
 
-export const verify = async (params: {
-  token: string;
-}): Promise<
-  | { ok: true; userId: string; user: User; email: string; createdGuest: boolean }
+type VerifyResult =
+  | { ok: true; userId: string; user: User; email: string | null; createdGuest: boolean }
   | { ok: false; status: 401; message: string }
-  | { ok: false; status: number; message: string }
-> => {
+  | { ok: false; status: number; message: string };
+
+const signIn = async (params: {
+  userId: string;
+  email?: string;
+  createdGuest?: boolean;
+  category?: "guest" | "login";
+}): Promise<VerifyResult> => {
+  const user = await accounts.users.get({ id: params.userId });
+  if (!user) {
+    return { ok: false, status: 401, message: "User not found" };
+  }
+  if (!(await isAccountCategoryAllowed(user)) || (params.category && accountCategory(user) !== params.category))
+    return { ok: false, status: 403, message: "This account cannot sign in through this category. Contact an administrator." };
+  return { ok: true, userId: params.userId, user, email: params.email ?? user.mail, createdGuest: params.createdGuest ?? false };
+};
+
+/** Administrator-issued tokens name the account itself, so they work without an email address. */
+const verifyAccountToken = async (userId: string): Promise<VerifyResult> => {
+  const [row] = await sql<{ expired: boolean }[]>`
+    SELECT account_expires IS NOT NULL AND account_expires <= now() AS expired
+    FROM auth.users
+    WHERE id = ${userId}::uuid AND provider = 'local'
+  `;
+  if (!row) return { ok: false, status: 401, message: "Invalid or expired token" };
+  if (row.expired) return { ok: false, status: 403, message: "Your account has expired. Contact an administrator." };
+  return signIn({ userId });
+};
+
+export const verify = async (params: { token: string }): Promise<VerifyResult> => {
   const payload = await providers.local.auth.consumeMagicLinkToken(params.token);
   if (!payload) {
     return { ok: false, status: 401, message: "Invalid or expired token" };
   }
+  if ("userId" in payload) return verifyAccountToken(payload.userId);
 
   const { email, category } = payload;
   const normalizedEmail = normalizeEmail(email);
@@ -186,12 +222,5 @@ export const verify = async (params: {
     createdGuest = true;
   }
 
-  const user = await accounts.users.get({ id: userId });
-  if (!user) {
-    return { ok: false, status: 401, message: "User not found" };
-  }
-  if (!(await isAccountCategoryAllowed(user)) || (category && accountCategory(user) !== category))
-    return { ok: false, status: 403, message: "This account cannot sign in through this category. Contact an administrator." };
-
-  return { ok: true, userId, user, email, createdGuest };
+  return signIn({ userId, email, createdGuest, category });
 };

package/src/services/auth-flows/password-reset.ts

@@ -8,6 +8,7 @@ import { logger } from "../logging";
 import { providers } from "../providers";
 import { session } from "../session";
 import * as settings from "../settings";
+import * as deferred from "./deferred";
 import * as ipaFlow from "./ipa";
 import type { AuthNotificationDeliveryResult, AuthNotificationSender } from "./notification-sender";
 
@@ -15,7 +16,8 @@ const log = logger("auth:password-reset");
 
 const REQUEST_TTL_SECONDS = 900;
 const REQUEST_COOLDOWN_SECONDS = 60;
-const GENERIC_MESSAGE = "If this account can reset a password, a reset link has been sent.";
+const GENERIC_MESSAGE =
+  "If this account can reset a password, a reset link has been sent. If no message arrives, contact an administrator.";
 
 type ResetTarget = {
   userId: string;
@@ -161,27 +163,42 @@ const changeTemporaryPassword = async (params: {
   };
 };
 
-export const request = async (
-  params: { email: string; redirectTo?: string; locale?: string },
+type ResetRequest = { email: string; redirectTo?: string; locale?: string };
+
+/**
+ * Accepts a reset request without revealing whether an eligible account
+ * exists. The lookup and delivery run after this returns, so every address
+ * gets the same message in the same time. `settled` resolves when that
+ * bounded background work has finished or was dropped under overload; it
+ * never rejects.
+ */
+export const request = (
+  params: ResetRequest,
   notificationSender: AuthNotificationSender,
-): Promise<{ ok: true; message: string }> => {
-  if (!(await isAccountCategoryAllowed({ provider: "ipa", profile: "user" }))) return { ok: true, message: GENERIC_MESSAGE };
+): { ok: true; message: string; settled: Promise<void> } => ({
+  ok: true,
+  message: GENERIC_MESSAGE,
+  settled: deferred.run("Password reset request", () => deliverResetLink(params, notificationSender)),
+});
+
+const deliverResetLink = async (params: ResetRequest, notificationSender: AuthNotificationSender): Promise<void> => {
+  if (!(await isAccountCategoryAllowed({ provider: "ipa", profile: "user" }))) return;
   const email = normalizeEmail(params.email);
   if (await isInCooldown(email)) {
     log.info("Password reset request ignored during cooldown");
-    return { ok: true, message: GENERIC_MESSAGE };
+    return;
   }
 
   const freeIpaConfig = await getFreeIpaConfig();
   if (!freeIpaConfig.enabled || !freeIpaConfig.configured) {
     log.info("Password reset request accepted while FreeIPA is unavailable");
-    return { ok: true, message: GENERIC_MESSAGE };
+    return;
   }
 
   const target = await resolveResetTarget(email);
   if (!target) {
     log.info("Password reset request accepted without eligible target");
-    return { ok: true, message: GENERIC_MESSAGE };
+    return;
   }
 
   try {
@@ -194,7 +211,6 @@ export const request = async (
       error: error instanceof Error ? error.message : String(error),
     });
   }
-  return { ok: true, message: GENERIC_MESSAGE };
 };
 
 export const complete = async (params: { token?: string; newPassword: string }): Promise<ResetAttemptSuccess | ResetAttemptFailure> => {

package/src/services/index.ts

@@ -194,7 +194,7 @@ export type {
 
 export { latestTopicCursor } from "./topic-cursor";
 export { readAccountCategoryPolicy, isAccountCategoryAllowed } from "./account-category-policy";
-export { appApproval, type AppDeviceEnrollmentNotice } from "./app-approval";
+export { AppApprovalError, appApproval, type AppDeviceAdministrator, type AppDeviceEnrollmentNotice } from "./app-approval";
 export { legalConsent } from "./legal-consent";
 
 /** Core-owned app bar administration; service methods enforce administrator access. */

package/src/services/pdf/gotenberg.ts

@@ -1,4 +1,5 @@
 import * as settings from "../settings";
+import { offlineHtml } from "./offline-html";
 
 export type GotenbergRenderErrorCode =
   | "bad_input"
@@ -131,9 +132,9 @@ function htmlForm(input: RenderHtmlToPdfInput, config: GotenbergConfig): FormDat
     (input.assets ?? []).reduce((sum, asset) => sum + asset.data.size, 0);
   if (total > config.maxHtmlBytes) throw new GotenbergRenderError("html_too_large", "HTML and assets exceed the configured input budget.");
   const form = new FormData();
-  form.append("files", new Blob([input.html], { type: "text/html" }), "index.html");
-  if (input.headerHtml?.trim()) form.append("files", new Blob([input.headerHtml], { type: "text/html" }), "header.html");
-  if (input.footerHtml?.trim()) form.append("files", new Blob([input.footerHtml], { type: "text/html" }), "footer.html");
+  form.append("files", new Blob([offlineHtml(input.html)], { type: "text/html" }), "index.html");
+  if (input.headerHtml?.trim()) form.append("files", new Blob([offlineHtml(input.headerHtml)], { type: "text/html" }), "header.html");
+  if (input.footerHtml?.trim()) form.append("files", new Blob([offlineHtml(input.footerHtml)], { type: "text/html" }), "footer.html");
   const names = new Set(["index.html", "header.html", "footer.html", "factur-x.xml"]);
   for (const asset of input.assets ?? []) {
     const name = fileName(asset.name);

package/src/services/pdf/offline-html.ts

@@ -0,0 +1,74 @@
+/**
+ * Offline mode for every HTML document Cloud sends to Gotenberg.
+ *
+ * Chromium in Gotenberg would otherwise run scripts and load every URL the
+ * HTML names. The prepended policy allows only inline styles plus local files
+ * and data URLs for styles, images, and fonts. Local files are the request's
+ * named assets; Gotenberg's default deny list keeps file access inside its
+ * working directory under `/tmp`. Removing elements that run code, navigate,
+ * embed documents, or open connections is a second layer that does not rely
+ * on the policy, which matters for header and footer templates that Chromium
+ * renders apart from the document.
+ *
+ * MathML (`math`) and the SVG elements that hold HTML (`foreignObject`,
+ * `desc`) go as well; they have no print use in Cloud documents. SVG shapes,
+ * images, `title`, and links stay, so graphics still render.
+ */
+const POLICY =
+  "default-src 'none'; style-src 'unsafe-inline' file: data:; img-src file: data:; font-src file: data:; base-uri 'none'; form-action 'none'";
+const OFFLINE_META = `<meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="${POLICY}">`;
+
+/**
+ * The caller's doctype when it leads the document after whitespace, comments,
+ * and an XML declaration. Repeating it ahead of the policy keeps the caller's
+ * rendering mode: HTML without a doctype still renders in quirks mode. Comments
+ * end where HTML ends them, including `<!-->` and `<!--->`; `<?…>` ends at the
+ * first `>`. A single forward scan keeps the time linear in the input size.
+ */
+const leadingDoctype = (html: string): string => {
+  let at = 0;
+  for (;;) {
+    while (/\s/.test(html.charAt(at))) at += 1;
+    if (html.startsWith("<!--", at)) {
+      if (html.startsWith(">", at + 4)) at += 5;
+      else if (html.startsWith("->", at + 4)) at += 6;
+      else {
+        const dashes = html.indexOf("-->", at + 4);
+        const bang = html.indexOf("--!>", at + 4);
+        if (dashes < 0 && bang < 0) return "";
+        at = dashes >= 0 && (bang < 0 || dashes < bang) ? dashes + 3 : bang + 4;
+      }
+    } else if (html.startsWith("<?", at)) {
+      const end = html.indexOf(">", at + 2);
+      if (end < 0) return "";
+      at = end + 1;
+    } else {
+      if (html.slice(at, at + 9).toLowerCase() !== "<!doctype") return "";
+      const end = html.indexOf(">", at + 9);
+      return end < 0 ? "" : html.slice(at, end + 1);
+    }
+  }
+};
+
+/** An empty comment stands in for a removed element, so the text on either side stays separate. */
+const REMOVED = "<!---->";
+
+export const offlineHtml = (html: string): string =>
+  leadingDoctype(html) +
+  OFFLINE_META +
+  new HTMLRewriter()
+    // Chromium parses noscript content as markup when JavaScript is disabled.
+    // math, foreignObject, and desc: see the module comment.
+    .on("script, noscript, meta, base, iframe, frame, frameset, object, embed, math, foreignObject, desc", {
+      element(element) {
+        element.replace(REMOVED, { html: true });
+      },
+    })
+    .on("link", {
+      element(element) {
+        // The policy limits a stylesheet to named assets and data URLs. Other
+        // link types can preload, prefetch, or connect outside of it.
+        if (element.getAttribute("rel")?.trim().toLowerCase() !== "stylesheet") element.replace(REMOVED, { html: true });
+      },
+    })
+    .transform(html);

package/src/services/providers/local/auth.ts

@@ -1,24 +1,33 @@
 import { redis } from "bun";
 
+/** Requested by email or username on the login page; resolves the account through its email at use. */
+export type EmailLoginTokenPayload = { email: string; category?: "guest" | "login" };
+/** Issued by an administrator for one account; works without an email address. */
+export type AccountLoginTokenPayload = { userId: string };
+
+const loginTokenKey = (token: string) => `email-login:${token}`;
+
 export const createMagicLinkToken = async (params: {
   email: string;
   category?: "guest" | "login";
   ttlSeconds?: number;
 }): Promise<string> => {
   const token = crypto.randomUUID();
-  await redis.set(
-    `email-login:${token}`,
-    JSON.stringify({ email: params.email, category: params.category }),
-    "EX",
-    params.ttlSeconds ?? 300,
-  );
+  await redis.set(loginTokenKey(token), JSON.stringify({ email: params.email, category: params.category }), "EX", params.ttlSeconds ?? 300);
+  return token;
+};
+
+/** Shares the email-link key space, so both token kinds use the same link and verify endpoint. */
+export const createAccountLoginToken = async (params: { userId: string; ttlSeconds?: number }): Promise<string> => {
+  const token = crypto.randomUUID();
+  await redis.set(loginTokenKey(token), JSON.stringify({ userId: params.userId }), "EX", params.ttlSeconds ?? 300);
   return token;
 };
 
-export const consumeMagicLinkToken = async (token: string): Promise<{ email: string; category?: "guest" | "login" } | null> => {
-  const raw = await redis.getdel(`email-login:${token}`);
+export const consumeMagicLinkToken = async (token: string): Promise<EmailLoginTokenPayload | AccountLoginTokenPayload | null> => {
+  const raw = await redis.getdel(loginTokenKey(token));
   if (!raw) return null;
-  return JSON.parse(raw) as { email: string; category?: "guest" | "login" };
+  return JSON.parse(raw) as EmailLoginTokenPayload | AccountLoginTokenPayload;
 };
 
 type PasswordResetPayload = {