@k2b/cloud 0.22.0 → 0.23.0

package/src/services/session/index.ts

@@ -3,26 +3,40 @@ import type { Context } from "hono";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
 import { env } from "../../config/env";
+import { PWA_AUTH_PATH, PWA_COOKIES } from "../../contracts/pwa";
 import type { User } from "../../contracts/shared";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import { isAccountExpired } from "../account-model";
 import { audit } from "../audit";
 import { IDENTITY_CLOCK_TOLERANCE_SECONDS, IDENTITY_ROLLOUT_MARGIN_MS } from "../identity/constants";
-import { invalidateIdentitySignerCache, prepareIdentitySigner } from "../identity/key-ring";
+import { invalidateIdentitySignerCache, type PreparedIdentitySigner, prepareIdentitySigner } from "../identity/key-ring";
 import { getIdentityRuntimeConfig } from "../identity/runtime-config";
 import { type CloudSessionClaims, isSessionJwtCandidate, signSessionToken, verifySessionToken } from "../identity/session-token";
 import * as settings from "../settings";
-import { loadJwtSessionIdentity, loadJwtSessionUser } from "./user";
+import { loadJwtSession, loadJwtSessionIdentity } from "./user";
+
+export type SessionKind = "web" | "app";
 
 export type SessionData = {
   userId: string;
   sid: string;
   authEpoch: number;
   expiresAt: string;
+  /** `"app"` for a session of a paired phone in the mobile app; derived from the family, never from the cookie. */
+  kind: SessionKind;
+  /** The paired phone of an app session. */
+  deviceId?: string;
 };
 
 export type AuthenticatedSession = { data: SessionData; user: User };
 
+/** Every request below `/pwa/` except Core's `/pwa/_auth` belongs to the mobile app. */
+export const isAppPagePath = (path: string): boolean =>
+  (path === "/pwa" || path.startsWith("/pwa/")) && path !== PWA_AUTH_PATH && !path.startsWith(`${PWA_AUTH_PATH}/`);
+
+/** Documents, iframes and form posts. Only the web session navigates outside the app. */
+export const isNavigationRequest = (c: Context): boolean => c.req.header("Sec-Fetch-Mode") === "navigate";
+
 const parseBearer = (header: string | undefined): string | null => {
   if (!header) return null;
   const match = header.match(/^Bearer\s+(\S+)$/i);
@@ -73,13 +87,14 @@ const endSessions = async (db: SQL, userId: string): Promise<void> => {
 
 const authenticateVerified = async (credential: CloudSessionClaims): Promise<AuthenticatedSession | null> => {
   const { groupsAdmin } = await getIdentityRuntimeConfig();
-  const user = await loadJwtSessionUser({
+  const loaded = await loadJwtSession({
     userId: credential.sub,
     sid: credential.sid,
     authEpoch: credential.auth_epoch,
     groupsAdmin,
   });
-  if (!user) return null;
+  if (!loaded) return null;
+  const { user, pwaDeviceId } = loaded;
   if (isAccountExpired(user.accountExpires)) {
     await endSessions(sql, user.id);
     return null;
@@ -91,6 +106,8 @@ const authenticateVerified = async (credential: CloudSessionClaims): Promise<Aut
       sid: credential.sid,
       authEpoch: credential.auth_epoch,
       expiresAt: new Date(credential.exp * 1_000).toISOString(),
+      kind: pwaDeviceId ? "app" : "web",
+      ...(pwaDeviceId ? { deviceId: pwaDeviceId } : {}),
     },
   };
 };
@@ -127,59 +144,84 @@ const revokeToken = async (token: string, requestId?: string | null): Promise<vo
   }
 };
 
-const issueJwtSession = async (c: Context, userId: string, ttlSeconds: number, attempt = 0): Promise<string> => {
+export type SessionIssueOptions = {
+  ttlSeconds: number;
+  /** Pre-chosen family id, for callers that record it in the same transaction. */
+  sid?: string;
+  /** Binds the family to a paired phone of the mobile app; the device must be active. */
+  pwaDeviceId?: string | null;
+  /** Web sign-ins update `last_login_local`; app renewals track use per device instead. */
+  recordLogin?: boolean;
+};
+
+type PreparedFamily = {
+  userId: string;
+  sid: string;
+  authEpoch: number;
+  issuedAt: Date;
+  expiresAt: Date;
+  signer: PreparedIdentitySigner;
+  options: SessionIssueOptions;
+};
+
+const SIGNER_INACTIVE = "Prepared Cloud session signer is no longer active";
+const isSignerInactive = (error: unknown) => error instanceof Error && error.message === SIGNER_INACTIVE;
+
+/** Inserts one family in `tx`. Locks the user row first, like every caller that locks more rows. */
+const insertFamily = async (
+  tx: SQL,
+  c: Context,
+  userId: string,
+  signer: PreparedIdentitySigner,
+  options: SessionIssueOptions,
+): Promise<PreparedFamily> => {
   const issuedAt = new Date();
-  const expiresAt = new Date(issuedAt.getTime() + ttlSeconds * 1_000);
-  const sid = crypto.randomUUID();
-  const signer = await prepareIdentitySigner("session");
+  const expiresAt = new Date(issuedAt.getTime() + options.ttlSeconds * 1_000);
+  const sid = options.sid ?? crypto.randomUUID();
   const requestId = c.req.header("x-request-id")?.slice(0, 64) ?? null;
   const userAgent = c.req.header("user-agent")?.slice(0, 256) ?? null;
-
-  let authEpoch: number;
-  try {
-    authEpoch = await sql.begin(async (tx) => {
-      const [user] = await tx<Array<{ auth_epoch: string | number | bigint; provider: "local" | "ipa"; profile: "guest" | "user" }>>`
-        SELECT auth_epoch, provider, profile FROM auth.users WHERE id = ${userId}::uuid FOR UPDATE
-      `;
-      if (!user) throw new Error("Cannot create a session for an unknown user");
-      if (!(await isAccountCategoryAllowed(user, tx)))
-        throw new HTTPException(403, { message: "This account category is disabled. Contact an administrator." });
-      const epoch = Number(user.auth_epoch);
-      if (!Number.isSafeInteger(epoch) || epoch < 0) throw new Error("User auth_epoch is invalid");
-      const [activeKey] = await tx<Array<{ kid: string }>>`
-        UPDATE auth.signing_keys
-        SET verify_until = GREATEST(verify_until, ${new Date(
-          expiresAt.getTime() + IDENTITY_CLOCK_TOLERANCE_SECONDS * 1_000 + IDENTITY_ROLLOUT_MARGIN_MS,
-        )})
-        WHERE kid = ${signer.kid} AND purpose = 'session' AND state = 'active' AND sign_until > now()
-        RETURNING kid
-      `;
-      if (!activeKey) throw new Error("Prepared Cloud session signer is no longer active");
-      await tx`
-        INSERT INTO auth.session_families (
-          sid, user_id, auth_epoch, signing_kid, issued_at, expires_at, created_request_id, created_user_agent, legal_pending
-        ) VALUES (${sid}, ${userId}, ${epoch}, ${signer.kid}, ${issuedAt}, ${expiresAt}, ${requestId}, ${userAgent},
-          NOT EXISTS (SELECT 1 FROM auth.legal_acceptances WHERE user_id = ${userId}::uuid))
-      `;
-      await tx`UPDATE auth.users SET last_login_local = ${issuedAt} WHERE id = ${userId}::uuid`;
-      return epoch;
-    });
-  } catch (error) {
-    if (attempt === 0 && error instanceof Error && error.message === "Prepared Cloud session signer is no longer active") {
-      invalidateIdentitySignerCache("session", signer.kid);
-      return issueJwtSession(c, userId, ttlSeconds, 1);
-    }
-    throw error;
+  const [user] = await tx<Array<{ auth_epoch: string | number | bigint; provider: "local" | "ipa"; profile: "guest" | "user" }>>`
+    SELECT auth_epoch, provider, profile FROM auth.users WHERE id = ${userId}::uuid FOR UPDATE
+  `;
+  if (!user) throw new Error("Cannot create a session for an unknown user");
+  if (!(await isAccountCategoryAllowed(user, tx)))
+    throw new HTTPException(403, { message: "This account category is disabled. Contact an administrator." });
+  const epoch = Number(user.auth_epoch);
+  if (!Number.isSafeInteger(epoch) || epoch < 0) throw new Error("User auth_epoch is invalid");
+  if (options.pwaDeviceId) {
+    // Device revocation locks the same user row first, so a revoked device never gets a new family.
+    const [device] = await tx`
+      SELECT id FROM auth.pwa_devices WHERE id = ${options.pwaDeviceId}::uuid AND user_id = ${userId}::uuid AND revoked_at IS NULL FOR UPDATE
+    `;
+    if (!device) throw new Error("Cannot create an app session for an inactive device");
   }
+  const [activeKey] = await tx<Array<{ kid: string }>>`
+    UPDATE auth.signing_keys
+    SET verify_until = GREATEST(verify_until, ${new Date(expiresAt.getTime() + IDENTITY_CLOCK_TOLERANCE_SECONDS * 1_000 + IDENTITY_ROLLOUT_MARGIN_MS)})
+    WHERE kid = ${signer.kid} AND purpose = 'session' AND state = 'active' AND sign_until > now()
+    RETURNING kid
+  `;
+  if (!activeKey) throw new Error(SIGNER_INACTIVE);
+  await tx`
+    INSERT INTO auth.session_families (
+      sid, user_id, auth_epoch, signing_kid, issued_at, expires_at, created_request_id, created_user_agent, legal_pending, pwa_device_id
+    ) VALUES (${sid}, ${userId}, ${epoch}, ${signer.kid}, ${issuedAt}, ${expiresAt}, ${requestId}, ${userAgent},
+      NOT EXISTS (SELECT 1 FROM auth.legal_acceptances WHERE user_id = ${userId}::uuid), ${options.pwaDeviceId ?? null})
+  `;
+  if (options.recordLogin !== false) await tx`UPDATE auth.users SET last_login_local = ${issuedAt} WHERE id = ${userId}::uuid`;
+  return { userId, sid, authEpoch: epoch, issuedAt, expiresAt, signer, options };
+};
 
+/** Signs a committed family. Null when the signer was revoked meanwhile; the family is revoked then. */
+const signFamily = async (family: PreparedFamily): Promise<string | null> => {
   let token: string;
   try {
-    token = (await signSessionToken({ userId, sid, authEpoch, issuedAt, expiresAt, signer })).token;
+    token = (await signSessionToken(family)).token;
   } catch (error) {
     await sql`
       UPDATE auth.session_families
       SET revoked_at = now(), revocation_reason = 'issuance_failed'
-      WHERE sid = ${sid}::uuid AND revoked_at IS NULL
+      WHERE sid = ${family.sid}::uuid AND revoked_at IS NULL
     `;
     throw error;
   }
@@ -187,7 +229,7 @@ const issueJwtSession = async (c: Context, userId: string, ttlSeconds: number, a
   const [stillActive] = await sql<Array<{ active: boolean }>>`
     SELECT EXISTS(
       SELECT 1 FROM auth.signing_keys
-      WHERE kid = ${signer.kid} AND purpose = 'session' AND state = 'active'
+      WHERE kid = ${family.signer.kid} AND purpose = 'session' AND state = 'active'
     ) AS active
   `;
   if (stillActive?.active) return token;
@@ -195,28 +237,123 @@ const issueJwtSession = async (c: Context, userId: string, ttlSeconds: number, a
   await sql`
     UPDATE auth.session_families
     SET revoked_at = now(), revocation_reason = 'signer_revoked_during_issuance'
-    WHERE sid = ${sid}::uuid AND revoked_at IS NULL
+    WHERE sid = ${family.sid}::uuid AND revoked_at IS NULL
   `;
-  invalidateIdentitySignerCache("session", signer.kid);
-  if (attempt === 0) return issueJwtSession(c, userId, ttlSeconds, 1);
+  invalidateIdentitySignerCache("session", family.signer.kid);
+  return null;
+};
+
+/** One issuance attempt is retried once when the signing key changes underneath it. */
+const issueJwtSession = async (c: Context, userId: string, options: SessionIssueOptions, attempt = 0): Promise<string> => {
+  const signer = await prepareIdentitySigner("session");
+  let family: PreparedFamily;
+  try {
+    family = await sql.begin((tx) => insertFamily(tx, c, userId, signer, options));
+  } catch (error) {
+    if (attempt === 0 && isSignerInactive(error)) {
+      invalidateIdentitySignerCache("session", signer.kid);
+      return issueJwtSession(c, userId, options, 1);
+    }
+    throw error;
+  }
+  const token = await signFamily(family);
+  if (token) return token;
+  if (attempt === 0) return issueJwtSession(c, userId, { ...options, sid: undefined }, 1);
   throw new Error("Cloud session signer changed repeatedly during issuance");
 };
 
+/**
+ * Runs `work` in one transaction in which `issue` may insert a single session family next to
+ * the caller's own rows, then signs that family after the commit. `work` must lock the user
+ * row before any pairing or device row (`issue` locks it too). The transaction is retried
+ * once when the signing key changed before the commit; a signer revoked after the commit
+ * gets a replacement family in its own transaction.
+ */
+const issueInTransaction = async <T>(
+  c: Context,
+  work: (tx: SQL, issue: (userId: string, options: SessionIssueOptions) => Promise<string>) => Promise<T>,
+): Promise<{ value: T; token: string | null }> => {
+  for (let attempt = 0; ; attempt += 1) {
+    const signer = await prepareIdentitySigner("session");
+    let family: PreparedFamily | undefined;
+    let value: T;
+    try {
+      value = await sql.begin((tx) =>
+        work(tx, async (userId, options) => {
+          if (family) throw new Error("Only one session family per transaction");
+          family = await insertFamily(tx, c, userId, signer, options);
+          return family.sid;
+        }),
+      );
+    } catch (error) {
+      if (attempt === 0 && isSignerInactive(error)) {
+        invalidateIdentitySignerCache("session", signer.kid);
+        continue;
+      }
+      throw error;
+    }
+    if (!family) return { value, token: null };
+    const token = await signFamily(family);
+    return { value, token: token ?? (await issueJwtSession(c, family.userId, { ...family.options, sid: undefined }, 1)) };
+  }
+};
+
+/** Today's web credential: an explicit non-API bearer, otherwise the `session_token` cookie. */
+const getWebOrBearerToken = (c: Context): string | null => {
+  const authorization = c.req.header("Authorization");
+  const bearer = parseBearer(authorization);
+  if (/^Bearer(?:\s|$)/i.test(authorization ?? "")) return isCloudApiToken(bearer) ? null : bearer;
+  return getCookie(c, "session_token") ?? null;
+};
+
 export const session = {
+  /**
+   * The credential of this request. Below `/pwa/` (except `/pwa/_auth`) only the app session
+   * counts. Navigations elsewhere use the web session only. Other requests prefer the web
+   * session and fall back to the app session.
+   */
   getToken: (c: Context): string | null => {
-    const authorization = c.req.header("Authorization");
-    const bearer = parseBearer(authorization);
-    if (/^Bearer(?:\s|$)/i.test(authorization ?? "")) return isCloudApiToken(bearer) ? null : bearer;
-    return getCookie(c, "session_token") ?? null;
+    if (isAppPagePath(c.req.path)) return session.getAppToken(c);
+    const token = getWebOrBearerToken(c);
+    if (token || c.req.header("Authorization") || isNavigationRequest(c)) return token;
+    return session.getAppToken(c);
+  },
+
+  /**
+   * The app session to try when `token` (from `getToken`) did not authenticate: only for the web
+   * cookie of a fetch outside `/pwa/` without an `Authorization` header. A copied, expired or revoked
+   * web cookie must not hide a valid app session of the mobile app.
+   */
+  appSessionFallback: (c: Context, token: string | null): string | null => {
+    const appToken = session.getAppToken(c);
+    if (!appToken || !token || token === appToken || isAppPagePath(c.req.path)) return null;
+    if (token !== session.getWebToken(c) || c.req.header("Authorization") || isNavigationRequest(c)) return null;
+    return appToken;
   },
 
+  /**
+   * `getToken` with the validity fallback of the auth middleware, for handlers that authenticate
+   * the token themselves (WebSockets, streams). Costs one extra check only while the request also
+   * carries an app session.
+   */
+  resolveToken: async (c: Context): Promise<string | null> => {
+    const token = session.getToken(c);
+    const fallback = session.appSessionFallback(c, token);
+    if (!token || !fallback) return token;
+    return (await session.authenticateRequest(c, token)) ? token : fallback;
+  },
+
+  getWebToken: (c: Context): string | null => getCookie(c, "session_token") ?? null,
+
+  getAppToken: (c: Context): string | null => getCookie(c, PWA_COOKIES.session) ?? null,
+
   getBearerToken: (c: Context): string | null => parseBearer(c.req.header("Authorization")),
 
   create: async (c: Context, userId: string): Promise<string> => {
     const expiryHours = await settings.get<number>("user.session.expiry_hours");
     if (!Number.isFinite(expiryHours) || expiryHours < 1) throw new Error("user.session.expiry_hours must be a positive number");
     const ttlSeconds = Math.floor(expiryHours * 60 * 60);
-    const clientToken = await issueJwtSession(c, userId, ttlSeconds);
+    const clientToken = await issueJwtSession(c, userId, { ttlSeconds });
 
     setCookie(c, "session_token", clientToken, {
       httpOnly: true,
@@ -230,16 +367,34 @@ export const session = {
 
   revoke: revokeToken,
 
+  /** Signs out the web session (or an explicit bearer session). The mobile app's session is unaffected. */
   delete: async (c: Context): Promise<void> => {
-    const token = session.getToken(c);
+    const token = getWebOrBearerToken(c);
     if (token) await revokeToken(token, c.req.header("x-request-id"));
     deleteCookie(c, "session_token", { path: "/" });
   },
 
-  /** Signs the account out everywhere: every session and every paired sign-in device, audited per device. */
+  issueInTransaction,
+
+  /** Signs the account out everywhere: every session, every paired sign-in device and every paired phone, audited per device. */
   revokeAllForUser: async (userId: string): Promise<void> => {
     await sql.begin(async (tx) => {
       await endSessions(tx, userId);
+      // The epoch change already ends the phones; revoking them keeps lists and the audit log truthful.
+      const phones = await tx<Array<{ id: string }>>`
+        UPDATE auth.pwa_devices SET revoked_at = now(), revocation_reason = 'sign_out_everywhere'
+        WHERE user_id = ${userId}::uuid AND revoked_at IS NULL RETURNING id
+      `;
+      for (const phone of phones)
+        await audit.record(
+          {
+            action: "auth.pwa.device.revoke",
+            outcome: "allowed",
+            target: { type: "pwa_device", id: phone.id },
+            metadata: { targetUserId: userId, provenance: "system", reason: "sign_out_everywhere" },
+          },
+          tx,
+        );
       // A paired device approves new sign-ins on its own, so a lost one would outlive the epoch change.
       const devices = await tx<Array<{ id: string }>>`
         UPDATE auth.app_devices SET revoked_at = now() WHERE user_id = ${userId}::uuid AND revoked_at IS NULL RETURNING id

package/src/services/session/recent.ts

@@ -0,0 +1,42 @@
+import type { SQL } from "bun";
+import { isAccountCategoryAllowed } from "../account-category-policy";
+
+export type EligibleAccount = {
+  id: string;
+  uid: string;
+  display_name: string | null;
+  provider: "local" | "ipa";
+  profile: "guest" | "user";
+  auth_epoch: string;
+  account_expires: Date | null;
+};
+
+type Reject = (code: "REAUTHENTICATE" | "FORBIDDEN") => never;
+
+/** The account exists, has not expired and its category is enabled. */
+export const requireEligibleAccount = async (tx: SQL, userId: string, reject: Reject): Promise<EligibleAccount> => {
+  const [row] = await tx<EligibleAccount[]>`
+    SELECT id, uid, display_name, provider, profile, auth_epoch, account_expires FROM auth.users WHERE id = ${userId}::uuid
+  `;
+  if (!row || (row.account_expires && new Date(row.account_expires).getTime() <= Date.now()) || !(await isAccountCategoryAllowed(row, tx)))
+    return reject("FORBIDDEN");
+  return row;
+};
+
+/**
+ * The web session family `sid` is valid and was issued within `seconds`. App sessions of the
+ * mobile app never count: they are renewed daily without a sign-in.
+ */
+export const requireRecentWebSession = async (
+  tx: SQL,
+  actor: { userId: string; sid: string },
+  seconds: number,
+  reject: Reject,
+): Promise<EligibleAccount> => {
+  const [row] = await tx`SELECT sid FROM auth.session_families f JOIN auth.users u ON u.id = f.user_id
+    WHERE f.sid = ${actor.sid}::uuid AND f.user_id = ${actor.userId}::uuid AND f.revoked_at IS NULL
+      AND f.auth_epoch = u.auth_epoch AND f.expires_at > now() AND f.pwa_device_id IS NULL
+      AND f.issued_at > now() - ${seconds} * interval '1 second'`;
+  if (!row) return reject("REAUTHENTICATE");
+  return requireEligibleAccount(tx, actor.userId, reject);
+};

package/src/services/session/user.ts

@@ -46,6 +46,9 @@ const stringArray = (value: unknown): string[] => {
   return [];
 };
 
+/** The user as the mobile app's session sees it: never an installation administrator. */
+export const withoutAdminRole = (user: User): User => ({ ...user, roles: user.roles.filter((role) => role !== "admin") });
+
 export const buildProjectedUser = (row: DbRow): User => {
   const { provider, profile } = resolveProviderProfile(row);
   const mail = (row.mail as string | null | undefined) ?? null;
@@ -57,7 +60,8 @@ export const buildProjectedUser = (row: DbRow): User => {
   const common = {
     id: row.id as string,
     uid: row.uid as string,
-    roles: buildRoles({ provider, profile, memberofGroup, manages, admin: Boolean(row.effective_admin) }),
+    // An app session of the mobile app never acts as an installation administrator.
+    roles: buildRoles({ provider, profile, memberofGroup, manages, admin: Boolean(row.effective_admin) && !row.pwa_device_id }),
     profile,
     givenname: (row.given_name as string | null | undefined) ?? "",
     sn: (row.sn as string | null | undefined) ?? "",
@@ -123,7 +127,7 @@ type SessionUserParams = {
 // Both projections use the same live validity checks. Neither caches authorization.
 const loadSessionRow = async (params: SessionUserParams, projection: SQLQuery, join: SQLQuery, query: typeof sql) => {
   const [row] = await query<DbRow[]>`
-    SELECT ${projection}, (
+    SELECT ${projection}, sf.pwa_device_id AS pwa_device_id, (
       SELECT value FROM settings.entries WHERE key = 'user.category.' ||
         CASE WHEN u.provider = 'ipa' THEN 'freeipa' WHEN u.profile = 'guest' THEN 'guest' ELSE 'login' END || '.enabled'
     ) AS category_enabled
@@ -144,14 +148,20 @@ const loadSessionRow = async (params: SessionUserParams, projection: SQLQuery, j
   return row && (await decodeAccountCategoryEnabled(row.category_enabled)) ? row : null;
 };
 
-export const loadJwtSessionUser = async (
+/** The user of a valid session family and, for an app session of the mobile app, its device. */
+export const loadJwtSession = async (
   params: SessionUserParams & { groupsAdmin: string[] },
   query: typeof sql = sql,
-): Promise<User | null> => {
+): Promise<{ user: User; pwaDeviceId: string | null } | null> => {
   const row = await loadSessionRow(params, userProjectionSql(params.groupsAdmin), userProjectionJoin(), query);
-  return row ? buildProjectedUser(row) : null;
+  return row ? { user: buildProjectedUser(row), pwaDeviceId: row.pwa_device_id ? String(row.pwa_device_id) : null } : null;
 };
 
+export const loadJwtSessionUser = async (
+  params: SessionUserParams & { groupsAdmin: string[] },
+  query: typeof sql = sql,
+): Promise<User | null> => (await loadJwtSession(params, query))?.user ?? null;
+
 /** Identity-only consumers must not pay for group, IPA, role and rail projections. */
 export const loadJwtSessionIdentity = async (params: SessionUserParams, query: typeof sql = sql) => {
   const row = await loadSessionRow(params, sql`u.id, u.account_expires`, sql``, query);

package/src/shared/index.ts

@@ -36,6 +36,7 @@ export * from "./help";
 export type * from "./icons";
 export { icons } from "./icons";
 export * from "./locale";
+export * from "./locale-preference";
 export * from "./login-method";
 export { markdown } from "./markdown";
 export type { ErrorCode, EvalContext, EvalError, EvalResult, EvalValue, ProgressValue } from "./markdown/formula";

package/src/{browser → shared}/locale-preference.ts

@@ -1,5 +1,5 @@
 import { cookies } from "@k2b/stdlib/browser";
-import { canonicalLocale, LOCALE_COOKIE } from "../shared/locale";
+import { canonicalLocale, LOCALE_COOKIE } from "./locale";
 
 export const PROFILE_PREFERENCE_LOCALES = ["en", "de"] as const;
 export type ProfilePreferenceLocale = (typeof PROFILE_PREFERENCE_LOCALES)[number];

package/src/shared/markdown/extensions/info-blocks.ts

@@ -12,38 +12,25 @@
  *
  * Supported types: note, info, success, warning, danger
  *
- * `notices: "minimal"` renders only the tone colour: no icon and no automatic
- * label. The type name stays available to screen readers, and an explicit
- * title is still shown.
+ * Every block renders as the calm NoticeCard: the tone tints the surface, the
+ * text stays neutral, and there is no icon. An explicit title is the visible
+ * heading and names the block, as on a NoticeCard; without one the type name
+ * is announced to screen readers only. Email drops the visually hidden class,
+ * so a titled block must not carry the type name as well.
  */
 
-import { NOTICE_CARD_CLASSES, NOTICE_CARD_ICONS, type NoticeTone } from "@k2b/ui";
+import { NOTICE_CARD_CLASSES, type NoticeTone } from "@k2b/ui";
 import type { MarkedExtension, Tokens } from "marked";
 import { escapeHtml } from "../shared";
 
 type BlockType = "note" | "info" | "success" | "warning" | "danger";
 
 const blockConfig: Record<BlockType, { label: string; tone: NoticeTone }> = {
-  note: {
-    label: "Note",
-    tone: "neutral",
-  },
-  info: {
-    label: "Info",
-    tone: "info",
-  },
-  success: {
-    label: "Success",
-    tone: "success",
-  },
-  warning: {
-    label: "Warning",
-    tone: "warning",
-  },
-  danger: {
-    label: "Danger",
-    tone: "danger",
-  },
+  note: { label: "Note", tone: "neutral" },
+  info: { label: "Info", tone: "info" },
+  success: { label: "Success", tone: "success" },
+  warning: { label: "Warning", tone: "warning" },
+  danger: { label: "Danger", tone: "danger" },
 };
 
 const renderInlineContent = (content: string): string => {
@@ -54,9 +41,7 @@ const renderInlineContent = (content: string): string => {
     .replace(/\n/g, "<br>");
 };
 
-export type NoticeStyle = "card" | "minimal";
-
-export function infoBlocksExtension(notices: NoticeStyle = "card"): MarkedExtension {
+export function infoBlocksExtension(): MarkedExtension {
   return {
     extensions: [
       {
@@ -81,26 +66,12 @@ export function infoBlocksExtension(notices: NoticeStyle = "card"): MarkedExtens
           };
         },
         renderer(token: Tokens.Generic) {
-          const blockType = token.blockType as BlockType;
-          const config = blockConfig[blockType];
-          const content = escapeHtml(token.content as string);
-          const renderedContent = renderInlineContent(content);
-
-          if (notices === "minimal") {
-            const title = token.title ? `<p class="${NOTICE_CARD_CLASSES.title}">${escapeHtml(token.title as string)}</p>` : "";
-            return `<aside class="${NOTICE_CARD_CLASSES.root}" data-tone="${config.tone}" role="note"><span class="sr-only">${config.label}: </span>${title}<div class="${NOTICE_CARD_CLASSES.body}">${renderedContent}</div></aside>`;
-          }
-
-          const title = escapeHtml((token.title as string | undefined) ?? config.label);
-          return `<aside class="${NOTICE_CARD_CLASSES.root}" data-tone="${config.tone}">
-  <div class="${NOTICE_CARD_CLASSES.inner}">
-    <i class="${NOTICE_CARD_ICONS[config.tone]} ${NOTICE_CARD_CLASSES.icon}" aria-hidden="true"></i>
-    <div class="${NOTICE_CARD_CLASSES.content}">
-      <p class="${NOTICE_CARD_CLASSES.title}">${title}</p>
-      <div class="${NOTICE_CARD_CLASSES.body}">${renderedContent}</div>
-    </div>
-  </div>
-</aside>`;
+          const config = blockConfig[token.blockType as BlockType];
+          const body = renderInlineContent(escapeHtml(token.content as string));
+          const name = token.title
+            ? `<p class="${NOTICE_CARD_CLASSES.title}">${escapeHtml(token.title as string)}</p>`
+            : `<span class="sr-only">${config.label}: </span>`;
+          return `<aside class="${NOTICE_CARD_CLASSES.root}" data-tone="${config.tone}" role="note">${name}<div class="${NOTICE_CARD_CLASSES.body}">${body}</div></aside>`;
         },
       },
     ],

package/src/shared/markdown/index.ts

@@ -11,7 +11,7 @@ import { markdownClient } from "./client";
 import { codeExtension } from "./extensions/code";
 import { guidedHelpExtension } from "./extensions/guided-help";
 import { imagesExtension } from "./extensions/images";
-import { infoBlocksExtension, type NoticeStyle } from "./extensions/info-blocks";
+import { infoBlocksExtension } from "./extensions/info-blocks";
 import { katexExtension } from "./extensions/katex";
 import { linksExtension } from "./extensions/links";
 import { markExtension } from "./extensions/mark";
@@ -23,7 +23,7 @@ import { taskListExtension } from "./extensions/task-list";
 type MarkdownProfile = "content" | "help";
 type LinkStyle = "widget" | "plain";
 
-const createMarked = (profile: MarkdownProfile = "content", notices: NoticeStyle = "card", links: LinkStyle = "widget") => {
+const createMarked = (profile: MarkdownProfile = "content", links: LinkStyle = "widget") => {
   const marked = new Marked();
 
   marked.use({
@@ -33,7 +33,7 @@ const createMarked = (profile: MarkdownProfile = "content", notices: NoticeStyle
 
   // Apply extensions in order
   // Note: katexExtension must come before codeExtension to handle ```math blocks
-  marked.use(infoBlocksExtension(notices));
+  marked.use(infoBlocksExtension());
   marked.use(taskListExtension());
   marked.use(tablesExtension());
   // Plain links keep marked's own renderer: an anchor around the link text.
@@ -51,23 +51,14 @@ const createMarked = (profile: MarkdownProfile = "content", notices: NoticeStyle
 
 const marked = createMarked();
 const helpMarked = createMarked("help");
-const contentMarked = new Map<`${NoticeStyle}:${LinkStyle}`, Marked>([["card:widget", marked]]);
+const plainLinksMarked = createMarked("content", "plain");
 
 export type MarkdownRenderOptions = {
-  /** `"minimal"` shows notices as tone colour only; the type name stays for screen readers. */
-  notices?: NoticeStyle;
   /** `"plain"` renders each link as an ordinary anchor around its text, for HTML read outside Cloud such as email. */
   links?: LinkStyle;
 };
 
-const markedFor = ({ notices = "card", links = "widget" }: MarkdownRenderOptions): Marked => {
-  const key = `${notices}:${links}` as const;
-  const cached = contentMarked.get(key);
-  if (cached) return cached;
-  const created = createMarked("content", notices, links);
-  contentMarked.set(key, created);
-  return created;
-};
+const markedFor = ({ links = "widget" }: MarkdownRenderOptions): Marked => (links === "plain" ? plainLinksMarked : marked);
 
 const sanitizeRenderedHtml = (html: string): string =>
   sanitizeHtml(html, {

package/src/ssr/AppLaunchpad.island.tsx

@@ -27,7 +27,14 @@ const readEmbeddedContext = (): AppLaunchpadContext | undefined => {
     if (!Array.isArray(parsed.apps)) return undefined;
     return {
       apps: parsed.apps,
-      profile: parsed.profile?.name && (parsed.profile.theme === "dark" || parsed.profile.theme === "light") ? parsed.profile : undefined,
+      profile:
+        parsed.profile?.name && (parsed.profile.theme === "dark" || parsed.profile.theme === "light")
+          ? {
+              name: parsed.profile.name,
+              theme: parsed.profile.theme,
+              ...(parsed.profile.appHref === "/me/app" ? { appHref: parsed.profile.appHref } : {}),
+            }
+          : undefined,
       legalLinks: Array.isArray(parsed.legalLinks) ? parsed.legalLinks : [],
     };
   } catch {