@k2b/cloud 0.39.0 → 0.41.0

package/src/services/approvals/device.ts

@@ -1,3 +1,6 @@
+import { listApps } from "../../_internal/registry";
+import type { ActionCard } from "../../ai/chat/action-card";
+import { type ActionQuestionText, actionCardText, actionNoteLabel } from "../../ai/chat/action-text";
 import {
   APP_APPROVAL_LIMITS,
   type AppActionSummary,
@@ -5,9 +8,12 @@ import {
   appActionDigest,
   APP_ACTION_LIMITS as limits,
 } from "../../contracts/app-approval";
-import { CapabilityActionReviewSchema } from "../../contracts/capabilities";
 import { DEFAULT_LOCALE } from "../../server/locale";
+import { resolveAppIdentityPresentation } from "../../shared/app-presentation";
+import { get } from ".";
 import type { PendingApprovalRow } from "./list";
+import { listPending } from "./list";
+import { type ApprovalActionPolicy, loadApprovalActionPolicies, pendingApprovalCard } from "./question";
 
 const plain = (value: string): string =>
   value
@@ -21,12 +27,26 @@ const cut = (value: string, limit: number): string => {
   return points.length > limit ? `${points.slice(0, limit - 1).join("")}…` : value;
 };
 
+export { pendingApprovalCard };
+
 export const appApprovalText = (value: string, limit: number): string => cut(plain(value), limit);
 
+/**
+ * Incomplete sends must be decided with the complete review in the browser. Without the declared policy Cloud cannot
+ * rule out `sends`, so an incomplete question then stays in the browser too.
+ */
+export const appActionOffered = (view: AppActionView, question: ActionCard | ActionQuestionText, policy?: ApprovalActionPolicy): boolean =>
+  !(
+    view.truncated &&
+    (policy === null ||
+      ("reasonCode" in question ? question.reasonCode : question.reason.code) === "sends" ||
+      (policy && "ask" in policy && policy.ask === "sends"))
+  );
+
 /** A deterministic, plain-text snapshot; the digest binds the device's choice to everything it shows. */
 export const appActionView = async (
   row: PendingApprovalRow,
-  options: { issuer: string; appName: (appId: string, locale: string) => string },
+  options: { issuer: string; appName: (appId: string, locale: string) => string; policy?: ApprovalActionPolicy },
 ): Promise<AppActionView> => {
   let truncated = false;
   const text = (value: string, limit: number) => {
@@ -43,40 +63,20 @@ export const appActionView = async (
     // The snapshot, so renaming the chat does not change what the device signs.
     title: text(row.requesterTitle ?? "", limits.titleChars) || null,
   };
-  const lines = row.sentence.split(/\r?\n/).map(plain).filter(Boolean);
-  const first = lines[0] ?? plain(row.action);
-  const prefix = `${appName}: `;
-  const sentence = first.startsWith(prefix) && first.length > prefix.length ? first.slice(prefix.length) : first;
-  const review = CapabilityActionReviewSchema.safeParse(row.details);
-  let message: string | null;
+  const question = actionCardText(pendingApprovalCard(row, options.appName, options.policy));
+  truncated ||= question.incomplete;
   const details: AppActionView["details"] = [];
-  const detail = (label: string, value: string, format?: "date" | "date-time") => {
+  for (const field of question.rows) {
     if (details.length >= limits.details) {
       truncated = true;
-      return;
+      break;
     }
-    const cleanedLabel = text(label, limits.labelChars);
-    if (!cleanedLabel) return;
-    details.push({ label: cleanedLabel, value: text(value, limits.valueChars), ...(format ? { format } : {}) });
-  };
-  const messages: string[] = [];
-  const reviewLines = new Set<string>();
-  if (review.success) {
-    const cleaned = plain(review.data.message);
-    if (cleaned !== sentence) messages.push(cleaned);
-    reviewLines.add(cleaned);
-    for (const line of review.data.message.split(/\r?\n/)) reviewLines.add(plain(line));
-    for (const field of review.data.details ?? [])
-      detail(field.label, field.value, field.format === "date" || field.format === "date-time" ? field.format : undefined);
-  }
-  for (const line of lines.slice(1)) {
-    if (reviewLines.has(line)) continue;
-    const match = /^([^:]{1,40}):\s+(.+)$/.exec(line);
-    if (match) detail(match[1]!, match[2]!);
-    else messages.push(line);
+    // The device protocol requires labels; a line an old review left unlabelled is shown as a note, not dropped.
+    const label = text(field.label, limits.labelChars) || text(actionNoteLabel(question.locale), limits.labelChars);
+    details.push({ label, value: text(field.value, limits.valueChars), ...(field.format ? { format: field.format } : {}) });
   }
-  message = text(messages.join(" "), limits.messageChars) || null;
-  const boundedSentence = text(sentence, limits.sentenceChars);
+  const message = text(question.reason, limits.messageChars) || null;
+  const boundedSentence = text(question.question, limits.sentenceChars);
   const view: AppActionView = {
     actionId: row.id,
     app,
@@ -112,3 +112,21 @@ export const appActionSummary = (view: AppActionView): AppActionSummary => ({
   createdAt: view.createdAt,
   expiresAt: view.expiresAt,
 });
+
+/** Whether a pending approval can wake a device under the same mapping used by its inbox and detail view. */
+export const deviceOffersApproval = async (approvalId: string): Promise<boolean> => {
+  const request = await get(approvalId);
+  if (!request) return false;
+  const { items } = await listPending({ approverUserId: request.approverUserId, id: approvalId, limit: 1 });
+  const row = items[0];
+  if (!row) return false;
+  const apps = await listApps();
+  const appName = (id: string, locale: string) => {
+    const app = apps.find((entry) => entry.id === id);
+    return app ? resolveAppIdentityPresentation(app, locale).name : id;
+  };
+  const policy = (await loadApprovalActionPolicies([row]))(row);
+  // Offering does not sign a decision; the issuer has no effect on truncation or eligibility.
+  const view = await appActionView(row, { issuer: "", appName, policy });
+  return appActionOffered(view, pendingApprovalCard(row, appName, policy), policy);
+};

package/src/services/approvals/index.ts

@@ -1,7 +1,7 @@
 import { type SQL, sql } from "bun";
 import { capabilityRequestHash } from "../../capabilities/claims";
 import { APPROVAL_ACP_CLIENT } from "../../contracts/approvals";
-import type { CapabilityActionReview } from "../../contracts/capabilities";
+import type { CapabilityActionReviewData } from "../../contracts/capabilities";
 import { isAppSessionActor } from "../../server/actor";
 import type { RequestActor, RequestCredentialKind } from "../../server/middleware/auth";
 import { audit } from "../audit";
@@ -9,6 +9,7 @@ import { toPgTextArray } from "../postgres";
 
 export { countPending, listPending, presentPendingApproval } from "./list";
 export { migrateApprovals } from "./migrate";
+export { type ApprovalActionPolicy, loadApprovalActionPolicies, pendingApprovalCard } from "./question";
 
 // Derived from chat's AI_ACTION_BUDGET_MS and Studio's one-day abandonment of pending calls.
 export const APPROVAL_MAX_WAIT_MS = 24 * 60 * 60_000;
@@ -23,7 +24,8 @@ export type ApprovalAssurance = "standard" | "confirm";
  */
 export const approvalAssurance = (rememberable: boolean): ApprovalAssurance => (rememberable ? "standard" : "confirm");
 export const approvalArgsDigest = (input: unknown): string => capabilityRequestHash(input);
-export const approvalReviewDigest = (review: CapabilityActionReview | null | undefined): string => capabilityRequestHash(review ?? null);
+export const approvalReviewDigest = (review: CapabilityActionReviewData | null | undefined): string =>
+  capabilityRequestHash(review ?? null);
 export const approvalDecisionChannel = (input: {
   credentialKind?: RequestCredentialKind;
   actor?: RequestActor;
@@ -50,7 +52,7 @@ export type ApprovalRequestInput = {
   approverUserId: string;
   assurance: ApprovalAssurance;
   sentence: string;
-  review?: CapabilityActionReview | null;
+  review?: CapabilityActionReviewData | null;
   input: unknown;
   expiresInMs: number;
 };
@@ -67,7 +69,7 @@ export type ApprovalRequest = {
   approverUserId: string;
   assurance: ApprovalAssurance;
   sentence: string;
-  details: CapabilityActionReview | null;
+  details: CapabilityActionReviewData | null;
   argsDigest: string;
   reviewDigest: string;
   status: ApprovalStatus;
@@ -211,7 +213,7 @@ export type ApprovalConsumeResult =
   | { ok: false; code: "NOT_FOUND" | "NOT_APPROVED" | "ALREADY_CONSUMED" | "INPUT_CHANGED" | "REVIEW_CHANGED" | "REVOKED" };
 export const consume = async (
   id: string,
-  input: { input: unknown; review: CapabilityActionReview | null; requester: { kind: ApprovalRequesterKind; ref: string } },
+  input: { input: unknown; review: CapabilityActionReviewData | null; requester: { kind: ApprovalRequesterKind; ref: string } },
   db?: SQL,
 ): Promise<ApprovalConsumeResult> => {
   const argsDigest = approvalArgsDigest(input.input),

package/src/services/approvals/list.ts

@@ -1,9 +1,10 @@
 import { sql } from "bun";
+import { type AiStoredActionReview, storedActionReview } from "../../ai/action-review";
 import { AI_WEBSITE_APPROVAL_TOOL, aiTurnAllowsRememberedApprovals } from "../../ai/approvals";
 import type { AiTurnRunConfig } from "../../ai/types";
 import type { RuntimeAppMeta } from "../../contracts/app";
 import { APPROVALS_PAGE_SIZE, type ApprovalCounts, type PendingApproval } from "../../contracts/approvals";
-import { CapabilityActionReviewSchema } from "../../contracts/capabilities";
+import { type CapabilityActionPolicy, CapabilityActionReviewDataSchema } from "../../contracts/capabilities";
 import type { ApprovalAssurance } from ".";
 import { decodeApprovalCursor, encodeApprovalCursor } from "./cursor";
 
@@ -18,6 +19,7 @@ export type PendingApprovalRow = {
   assurance: ApprovalAssurance;
   sentence: string;
   details: unknown;
+  storedReview: AiStoredActionReview | null;
   createdAt: Date;
   expiresAt: Date;
   cursorCreatedAt: string;
@@ -31,7 +33,7 @@ export type PendingApprovalRow = {
 };
 
 // Start with this person's indexed pending rows; a Studio page alone cannot continue a chat.
-const openRequests = (approverUserId: string, id?: string) => sql`SELECT r.* FROM approvals.requests r
+export const openRequests = (approverUserId: string, id?: string) => sql`SELECT r.* FROM approvals.requests r
   WHERE r.approver_user_id=${approverUserId}::uuid AND r.status='pending' AND r.expires_at > now()
     AND r.approver_auth_epoch=(SELECT auth_epoch FROM auth.users WHERE id=${approverUserId}::uuid)
     AND (${id ?? null}::uuid IS NULL OR r.id=${id ?? null}::uuid)
@@ -61,10 +63,21 @@ export const listPending = async (input: {
       to_char(r.created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') AS "cursorCreatedAt",
       question.short_id AS "conversationShortId", question.title AS "conversationTitle",
       question.allow_chat AS "allowChat", question.allow_always AS "allowAlways",
-      question.remember_tool_name AS "rememberToolName", question.tool_name AS "toolName", question.run_config AS "runConfig"
+      question.remember_tool_name AS "rememberToolName", question.tool_name AS "toolName", question.run_config AS "runConfig",
+      question.stored_review AS "storedReview"
     FROM open r JOIN LATERAL (
-      SELECT c.short_id, c.title, p.allow_chat, p.allow_always, p.remember_tool_name, p.tool_name, t.run_config
+      SELECT c.short_id, c.title, p.allow_chat, p.allow_always, p.remember_tool_name, p.tool_name, t.run_config,
+        (SELECT m.meta->'toolReviews'->review.call_id FROM (
+          SELECT meta, conversation_id, loop_id, role, seq FROM ai.messages
+          UNION ALL
+          SELECT meta, conversation_id, loop_id, role, seq FROM ai.task_messages
+        ) m WHERE m.conversation_id=p.conversation_id AND m.loop_id=p.turn_id::text AND m.role='assistant'
+          AND m.meta->'toolReviews'->review.call_id IS NOT NULL
+        ORDER BY m.seq DESC LIMIT 1) AS stored_review
       FROM ai.pending_actions p JOIN ai.conversations c ON c.id=p.conversation_id JOIN ai.turns t ON t.id=p.turn_id
+        -- A capability's own approval waits as "<call>-approval-<n>"; its review is stored under the call itself.
+        CROSS JOIN LATERAL (SELECT CASE WHEN p.kind = 'custom_approval'
+          THEN COALESCE(substring(p.call_id FROM '^(.*)-approval-[0-9]+$'), p.call_id) ELSE p.call_id END AS call_id) review
       WHERE p.approval_id=r.id AND p.status='pending' ORDER BY p.created_at DESC, p.id DESC LIMIT 1
     ) question ON true
     WHERE ${matches(input.appId, input.link)}
@@ -93,9 +106,17 @@ export const countPending = async (input: { approverUserId: string }): Promise<A
 export const presentPendingApproval = (
   row: PendingApprovalRow,
   apps: readonly Pick<RuntimeAppMeta, "id" | "name" | "icon">[],
+  policy?: CapabilityActionPolicy,
 ): PendingApproval => {
   const app = apps.find((entry) => entry.id === row.appId);
-  const review = CapabilityActionReviewSchema.nullable().safeParse(row.details);
+  const review = CapabilityActionReviewDataSchema.nullable().safeParse(row.details);
+  const originalReview = review.success ? review.data : null;
+  const displayReview =
+    originalReview && "sentence" in originalReview
+      ? row.storedReview && "sentence" in row.storedReview
+        ? row.storedReview
+        : storedActionReview(originalReview, policy)
+      : originalReview;
   const remember = row.assurance === "standard" && aiTurnAllowsRememberedApprovals(row.runConfig);
   return {
     id: row.id,
@@ -103,7 +124,7 @@ export const presentPendingApproval = (
     action: row.action,
     assurance: row.assurance,
     sentence: row.sentence,
-    review: review.success ? review.data : null,
+    review: displayReview && "legacy" in displayReview ? originalReview : displayReview,
     requester: {
       kind: "chat",
       appId: row.requesterAppId,

package/src/services/approvals/question.ts

@@ -0,0 +1,68 @@
+import { listCapabilities } from "../../_internal/registry";
+import { type AiStoredActionReview, storedActionReview } from "../../ai/action-review";
+import type { ActionCard } from "../../ai/chat/action-card";
+import { approvalCard } from "../../approvals/approval-card";
+import {
+  CapabilityActionCallReviewSchema,
+  type CapabilityActionPolicy,
+  CapabilityActionReviewDataSchema,
+  capabilityActionPolicy,
+} from "../../contracts/capabilities";
+import { DEFAULT_LOCALE } from "../../server/locale";
+import type { PendingApprovalRow } from "./list";
+
+/**
+ * One open approval as the question card words it, for places outside the browser: Cloud Login and notifications.
+ * The approvals page builds the same card from the same rows.
+ */
+
+/**
+ * The declared policy of a row's Action, needed for new-shape reviews' device eligibility and fallback reason:
+ * `undefined` when none is needed or declared, `null` when the registry could not say.
+ */
+export type ApprovalActionPolicy = CapabilityActionPolicy | null | undefined;
+const needsPolicy = (row: PendingApprovalRow): boolean => {
+  if (row.storedReview && "sentence" in row.storedReview) return true;
+  const review = CapabilityActionCallReviewSchema.safeParse(row.details);
+  return review.success;
+};
+/** Reads the registry once for the rows that need their Action's declared policy, as the approvals page does. */
+export const loadApprovalActionPolicies = async (
+  rows: readonly PendingApprovalRow[],
+): Promise<(row: PendingApprovalRow) => ApprovalActionPolicy> => {
+  if (!rows.some(needsPolicy)) return () => undefined;
+  const capabilities = await listCapabilities().catch(() => null);
+  return (row) => {
+    if (!needsPolicy(row)) return undefined;
+    if (capabilities === null) return null;
+    // An app that is not registered right now cannot say why its Action asks either.
+    const manifest = capabilities.find((entry) => entry.appId === row.appId)?.manifest;
+    return manifest ? capabilityActionPolicy(manifest, row.action) : null;
+  };
+};
+
+/** Prefer the turn's snapshot, then the linked request's review. */
+export const pendingApprovalReview = (
+  row: Pick<PendingApprovalRow, "storedReview" | "details">,
+  policy?: ApprovalActionPolicy,
+): AiStoredActionReview | null => {
+  const parsed = CapabilityActionReviewDataSchema.safeParse(row.details);
+  return row.storedReview ?? (parsed.success ? storedActionReview(parsed.data, policy ?? undefined) : null);
+};
+
+/** Resolve the recorded question in the language and time zone of its originating turn. */
+export const pendingApprovalCard = (
+  row: PendingApprovalRow,
+  appName: (appId: string, locale: string) => string,
+  policy?: ApprovalActionPolicy,
+  fallbackLocale = DEFAULT_LOCALE,
+): ActionCard => {
+  const locale = row.runConfig?.kind === "compact" ? fallbackLocale : (row.runConfig?.locale ?? fallbackLocale);
+  const timeZone = row.runConfig?.kind === "compact" ? "UTC" : (row.runConfig?.timeZone ?? "UTC");
+  const review = pendingApprovalReview(row, policy);
+  return approvalCard(
+    { sentence: row.sentence, action: row.action, appName: appName(row.appId, locale), appIcon: null, review },
+    locale,
+    timeZone,
+  );
+};

package/src/services/audit/index.ts

@@ -122,6 +122,7 @@ const SELF_SERVICE_ACTION_LABELS = {
   "webauthn_credential.authenticate": "Passkey used",
   "auth.pwa.device.enroll": "App paired",
   "auth.pwa.device.revoke": "App removed",
+  "auth.session.sign_out_others": "Signed out everywhere else",
 } as const satisfies Record<string, string>;
 const SELF_SERVICE_ACTIONS = Object.keys(SELF_SERVICE_ACTION_LABELS);
 

package/src/services/auth-flows/ipa.ts

@@ -4,6 +4,7 @@ import { isAccountCategoryAllowed } from "../account-category-policy";
 import { accounts } from "../accounts";
 import { logger } from "../logging";
 import { providers } from "../providers";
+import { session } from "../session";
 
 type IpaLoginFailure =
   | { ok: false; status: 403; reason: "category_disabled"; message: string }
@@ -19,6 +20,8 @@ type IpaLoginSuccess = {
   ok: true;
   userId: string;
   user: User;
+  /** Read before the password check; session issuance refuses a newer one. */
+  authEpoch: number;
 };
 
 export type IpaLoginFlowResult = IpaLoginSuccess | IpaLoginFailure;
@@ -96,6 +99,13 @@ export const login = async (params: { username: string; password: string }): Pro
     return failInvalidCredentials({ identifier: params.username, password: params.password });
   }
 
+  // Read before the password check so a concurrent password change or sign-out ends this sign-in too.
+  const [account] = await sql<Array<{ auth_epoch: string | number | bigint }>>`
+    SELECT auth_epoch FROM auth.users WHERE provider = 'ipa' AND uid = ${uid}
+  `;
+  const authEpoch = account ? Number(account.auth_epoch) : null;
+  if (authEpoch !== null && (!Number.isSafeInteger(authEpoch) || authEpoch < 0)) throw new Error("User auth_epoch is invalid");
+
   const loginResult = await providers.ipa.auth.login(uid, params.password).catch((error) => {
     log.error("FreeIPA login transport failed", {
       uid,
@@ -168,11 +178,21 @@ export const login = async (params: { username: string; password: string }): Pro
 
   const userResult = await loadSyncedIpaUser(uid);
   if (!userResult.ok) return userResult;
+  // An account synced in only after the read has no epoch this sign-in is bound to; the next attempt has one.
+  if (authEpoch === null) {
+    return {
+      ok: false,
+      status: 400,
+      reason: "user_not_synced",
+      message: "Your account is not yet available. Please try again in a few minutes.",
+    };
+  }
 
   return {
     ok: true,
     userId: userResult.userId,
     user: userResult.user,
+    authEpoch,
   };
 };
 
@@ -180,7 +200,11 @@ export const changeExpiredPassword = async (params: {
   username: string;
   currentPassword: string;
   newPassword: string;
-}): Promise<IpaLoginFlowResult | { ok: false; status: number; reason: "change_failed"; message: string }> => {
+}): Promise<
+  | (IpaLoginSuccess & { signOutOthersFailed: boolean })
+  | IpaLoginFailure
+  | { ok: false; status: number; reason: "change_failed"; message: string }
+> => {
   if (!(await isAccountCategoryAllowed({ provider: "ipa", profile: "user" })))
     return { ok: false, status: 403, reason: "category_disabled", message: "FreeIPA accounts are disabled. Contact an administrator." };
   const changeResult = await providers.ipa.auth.changeExpiredPassword(params);
@@ -193,5 +217,18 @@ export const changeExpiredPassword = async (params: {
     };
   }
 
-  return login({ username: params.username, password: params.newPassword });
+  // Resolve the local account here, before the caller issues its new browser session, even if login later fails.
+  const uid = await resolveIpaLoginUid(params.username);
+  const [user] = uid ? await sql<Array<{ id: string }>>`SELECT id FROM auth.users WHERE provider = 'ipa' AND uid = ${uid}` : [];
+  let signOutOthersFailed = false;
+  if (user) {
+    try {
+      await session.endOtherSignIns(user.id, { reason: "password_change" });
+    } catch {
+      log.warn("Password changed, but ending other sign-ins failed", { userId: user.id });
+      signOutOthersFailed = true;
+    }
+  }
+  const loginResult = await login({ username: params.username, password: params.newPassword });
+  return loginResult.ok ? { ...loginResult, signOutOthersFailed } : loginResult;
 };

package/src/services/auth-flows/notification-sender.ts

@@ -1,9 +1,12 @@
+import type { NewBrowserSignInNotifier } from "../known-browsers";
+
 export type AuthNotificationDeliveryResult = {
   id: string;
   status: "queued" | "delivered" | "suppressed" | "error";
 };
 
 export type AuthNotificationSender = {
+  sendNewBrowserSignIn: NewBrowserSignInNotifier;
   sendMagicLink: (input: { email: string; token: string; magicLink: string; locale?: string }) => Promise<AuthNotificationDeliveryResult>;
   sendIpaLoginHint: (input: { email: string; loginUrl: string; locale?: string }) => Promise<AuthNotificationDeliveryResult>;
   sendPasswordReset: (input: { email: string; resetLink: string; locale?: string }) => Promise<AuthNotificationDeliveryResult>;

package/src/services/auth-flows/password-reset.ts

@@ -29,6 +29,8 @@ type ResetAttemptSuccess = {
   ok: true;
   userId: string;
   user: User;
+  authEpoch: number;
+  signOutOthersFailed: boolean;
 };
 
 type ResetAttemptFailure =
@@ -154,13 +156,24 @@ const changeTemporaryPassword = async (params: {
     };
   }
 
-  await session.revokeAllForUser(changeResult.userId);
+  // The old password stayed valid while FreeIPA changed it, so a sign-in or device paired in that time outlives the
+  // sign-out before the change. Signing out everywhere again ends them, and everything the change already ended.
+  // Without it, this browser gets no session: the retry for other sign-ins keeps devices, a new reset link does not.
+  // Bind issuance to this final sign-out so a later sign-out also ends this sign-in.
+  let authEpoch: number;
+  try {
+    authEpoch = await session.revokeAllForUser(changeResult.userId);
+  } catch {
+    log.warn("Password reset: signing out everywhere after the change failed", { userId: changeResult.userId });
+    return {
+      ok: false,
+      status: 500,
+      reason: "reset_failed",
+      message: "Your password was changed, but signing you out everywhere did not work. Request a new reset link to finish.",
+    };
+  }
 
-  return {
-    ok: true,
-    userId: changeResult.userId,
-    user: changeResult.user,
-  };
+  return { ok: true, userId: changeResult.userId, user: changeResult.user, authEpoch, signOutOthersFailed: false };
 };
 
 type ResetRequest = { email: string; redirectTo?: string; locale?: string };
@@ -258,6 +271,19 @@ export const complete = async (params: { token?: string; newPassword: string }):
     };
   }
 
+  // The consumed reset token authorizes signing out everywhere; unpair phones before changing the password.
+  try {
+    await session.revokeAllForUser(target.userId);
+  } catch {
+    log.warn("Password reset stopped: signing out everywhere failed", { userId: target.userId });
+    return {
+      ok: false,
+      status: 500,
+      reason: "reset_failed",
+      message: "Signing you out everywhere did not work, so your password was not changed. Request a new reset link.",
+    };
+  }
+
   const resetResult = await providers.ipa.users.resetPassword({
     ipaSession: serviceSession.data,
     id: target.userId,

package/src/services/geoip/index.ts

@@ -0,0 +1,164 @@
+import { sql } from "bun";
+import { HTTPException } from "hono/http-exception";
+import {
+  DBIP_ATTRIBUTION,
+  GEOIP_MAX_DATABASE_BYTES,
+  GEOIP_MAX_REQUEST_BYTES,
+  type GeoIpAdminDatabase,
+  type GeoIpAdminStatus,
+  type GeoIpKind,
+} from "../../contracts/geoip";
+import { createGeoIp, type GeoIp, type GeoIpDatabaseInfo, getGeoIp } from "../../server/request-context/geoip";
+import { audit } from "../audit";
+import { GeoIpError, parseGeoIpUpload, readGeoIpUpload } from "./upload";
+
+export { GEOIP_MAX_DATABASE_BYTES, GEOIP_MAX_REQUEST_BYTES } from "../../contracts/geoip";
+export { GeoIpError } from "./upload";
+
+type Actor = { id: string; roles: readonly string[]; uid?: string; provider?: string };
+export type GeoIpUploadInfo = {
+  kind: GeoIpKind;
+  sha256: string;
+  size: number;
+  database_type: string;
+  build_epoch: Date;
+  description: string | null;
+  uploaded_at: Date;
+  uploaded_by: string | null;
+  uploader_name: string | null;
+};
+const requireAdmin = (actor: Actor) => {
+  if (!actor.roles.includes("admin")) throw new HTTPException(403, { message: "Administrator access required." });
+};
+let bundledInfo: ReturnType<GeoIp["status"]> | undefined;
+const getBundledInfo = () => (bundledInfo ??= createGeoIp().status());
+const isDbIp = (value: string) => /db[\s-]?ip/i.test(value);
+
+export const geoIpAdminStatus = (
+  rows: GeoIpUploadInfo[],
+  bundled: { city: GeoIpDatabaseInfo | null; asn: GeoIpDatabaseInfo | null },
+  now: number,
+): GeoIpAdminStatus => {
+  const database = (kind: GeoIpKind): GeoIpAdminDatabase => {
+    const row = rows.find((row) => row.kind === kind);
+    const info = bundled[kind];
+    const buildDate = row?.build_epoch ?? info?.buildDate;
+    return {
+      kind,
+      source: row ? "uploaded" : (info?.source ?? null),
+      bundled: info !== null,
+      databaseType: row?.database_type ?? info?.databaseType ?? null,
+      buildDate: buildDate?.toISOString() ?? null,
+      stale: buildDate !== undefined && now - buildDate.getTime() > 183 * 24 * 60 * 60 * 1000,
+      dbIp: row ? isDbIp(`${row.database_type} ${row.description ?? ""}`) : info !== null,
+      upload: row
+        ? {
+            sha256: row.sha256,
+            size: row.size,
+            uploadedAt: row.uploaded_at.toISOString(),
+            uploadedBy: row.uploaded_by ? { id: row.uploaded_by, name: row.uploader_name ?? row.uploaded_by } : null,
+          }
+        : null,
+    };
+  };
+  const databases: GeoIpAdminStatus["databases"] = [database("city"), database("asn")];
+  return {
+    databases,
+    attribution: databases.some((item) => item.dbIp) ? DBIP_ATTRIBUTION : null,
+    limits: { maxDatabaseBytes: GEOIP_MAX_DATABASE_BYTES, maxRequestBytes: GEOIP_MAX_REQUEST_BYTES },
+  };
+};
+
+let uploading = false;
+// Each write and its reader install run one after another in this process, so the local reader follows the
+// commit order; other instances follow through their refresh.
+let writes: Promise<unknown> = Promise.resolve();
+const serialized = <T>(write: () => Promise<T>): Promise<T> => {
+  const run = writes.then(write, write);
+  writes = run.catch(() => {});
+  return run;
+};
+export const createGeoIpService = (options: { db?: typeof sql; reader?: GeoIp; bundled?: () => ReturnType<GeoIp["status"]> } = {}) => {
+  const db = options.db ?? sql;
+  const reader = () => options.reader ?? getGeoIp();
+  const status = async (actor: Actor, config: { now?: () => number } = {}): Promise<GeoIpAdminStatus> => {
+    requireAdmin(actor);
+    const rows = await db<GeoIpUploadInfo[]>`
+      SELECT d.kind, d.sha256, (d.metadata->>'size')::int AS size, d.database_type, d.build_epoch,
+        d.metadata->'description'->>'en' AS description, d.uploaded_at, d.uploaded_by,
+        COALESCE(NULLIF(u.display_name, ''), u.uid) AS uploader_name
+      FROM geoip.databases d LEFT JOIN auth.users u ON u.id = d.uploaded_by`;
+    return geoIpAdminStatus(rows, (options.bundled ?? getBundledInfo)(), (config.now ?? Date.now)());
+  };
+  return {
+    status,
+    async upload(actor: Actor, body: ReadableStream<Uint8Array>, config: { contentLength?: number; signal?: AbortSignal }) {
+      requireAdmin(actor);
+      if (uploading) throw new GeoIpError("geoip_upload_busy");
+      uploading = true;
+      try {
+        const bytes = await readGeoIpUpload(body, config.contentLength);
+        const { kind, database, metadata } = parseGeoIpUpload(bytes);
+        const sha256 = new Bun.CryptoHasher("sha256").update(bytes).digest("hex");
+        database.info.sha256 = sha256;
+        config.signal?.throwIfAborted();
+        await serialized(async () => {
+          await db.begin(async (tx) => {
+            await tx`
+              INSERT INTO geoip.databases (kind, data, sha256, database_type, build_epoch, metadata, uploaded_by)
+              VALUES (${kind}, ${bytes}, ${sha256}, ${metadata.databaseType}, ${metadata.buildEpoch}::timestamptz,
+                ${JSON.stringify(metadata)}::jsonb, ${actor.id}::uuid)
+              ON CONFLICT (kind) DO UPDATE SET data = EXCLUDED.data, sha256 = EXCLUDED.sha256,
+                database_type = EXCLUDED.database_type, build_epoch = EXCLUDED.build_epoch, metadata = EXCLUDED.metadata,
+                uploaded_by = EXCLUDED.uploaded_by, uploaded_at = now()`;
+            await audit.record(
+              {
+                action: "core.geoip.upload",
+                outcome: "allowed",
+                actor: { ...actor, userId: actor.id },
+                metadata: { kind, databaseType: metadata.databaseType, buildDate: metadata.buildEpoch, sha256, size: bytes.length },
+              },
+              tx,
+            );
+            config.signal?.throwIfAborted();
+          });
+          reader().install(kind, database);
+        });
+        return { ...(await status(actor)), kind };
+      } finally {
+        uploading = false;
+      }
+    },
+    async reset(actor: Actor, kind: GeoIpKind) {
+      requireAdmin(actor);
+      const changed = await serialized(async () => {
+        const deleted = await db.begin(async (tx) => {
+          const [row] = await tx<{ sha256: string; database_type: string; build_epoch: Date; size: number }[]>`
+          DELETE FROM geoip.databases WHERE kind = ${kind}
+          RETURNING sha256, database_type, build_epoch, octet_length(data) AS size`;
+          if (!row) return false;
+          await audit.record(
+            {
+              action: "core.geoip.reset",
+              outcome: "allowed",
+              actor: { ...actor, userId: actor.id },
+              metadata: {
+                kind,
+                databaseType: row.database_type,
+                buildDate: row.build_epoch.toISOString(),
+                sha256: row.sha256,
+                size: row.size,
+              },
+            },
+            tx,
+          );
+          return true;
+        });
+        reader().install(kind, null);
+        return deleted;
+      });
+      return { ...(await status(actor)), changed };
+    },
+  };
+};
+export const geoip = createGeoIpService();