@k2b/cloud 0.40.0 → 0.41.0

package/src/approvals/approval-card.ts

@@ -0,0 +1,68 @@
+import { capabilityQuestionText, capabilityUnknownText } from "../_internal/capability-sentences";
+import { type AiStoredActionReview, isLegacyActionReview, storedActionReview } from "../ai/action-review";
+import { type ActionCard, legacyActionCard, reviewActionCard } from "../ai/chat/action-card";
+import { aiChatMessages } from "../ai/chat/messages";
+import type { CapabilityActionReviewData } from "../contracts/capabilities";
+
+export type ApprovalCardInput = {
+  sentence: string;
+  action: string;
+  appName: string;
+  appIcon?: string | null;
+  review: CapabilityActionReviewData | AiStoredActionReview | null;
+};
+
+const lines = (item: ApprovalCardInput) =>
+  item.sentence
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+
+/** The first line names the app and the Action; the app already shows as the row's icon and origin. */
+const approvalTitle = (item: ApprovalCardInput): string => {
+  const first = lines(item)[0] ?? item.action;
+  const prefix = `${item.appName}: `;
+  return first.startsWith(prefix) && first.length > prefix.length ? first.slice(prefix.length) : first;
+};
+
+/** Without a review, the sentence's later `Label: value` lines are what the person approves. */
+const sentenceRows = (item: ApprovalCardInput) =>
+  lines(item)
+    .slice(1)
+    .map((line) => {
+      const match = /^([^:]{1,40}):\s+(\S.*)$/.exec(line);
+      return match ? { label: match[1]!, value: match[2] ?? "" } : { label: "", value: line };
+    });
+
+/**
+ * The same card as the chat: a new review gives the app's sentence, reason, and preview; an old review its literal
+ * message and rows; a request without a review its sentence. Times show in the reader's zone (UTC until the page
+ * passes one, the same on the server and in the first browser render).
+ */
+export const approvalCard = (item: ApprovalCardInput, locale: string, timeZone: string): ActionCard => {
+  const app = { name: item.appName, icon: item.appIcon ?? "ti ti-shield-check" };
+  const context = { locale, timeZone, app };
+  const review = item.review ? ("legacy" in item.review ? item.review : storedActionReview(item.review)) : null;
+  if (review && !isLegacyActionReview(review)) return reviewActionCard(review, context);
+  const title = approvalTitle(item);
+  const t = aiChatMessages(locale);
+  return legacyActionCard(
+    {
+      question: review?.legacy.question ?? capabilityQuestionText(title, locale),
+      rows: review?.legacy.rows ?? sentenceRows(item),
+      ...(review?.legacy.markdown ? { markdown: review.legacy.markdown } : {}),
+      ...(review?.legacy.links ? { links: review.legacy.links } : {}),
+      subject: title,
+      title,
+      outcome: {
+        running: t.receiptRunning({ title }),
+        done: t.receiptDone({ title }),
+        rejected: t.receiptRejected({ title }),
+        notRun: t.receiptNotRun({ title, stopped: false }),
+        unknown: capabilityUnknownText(title, locale),
+        unknownStill: capabilityUnknownText(title, locale, true),
+      },
+    },
+    context,
+  );
+};

package/src/contracts/app-approval.ts

@@ -360,14 +360,14 @@ const actionFields = {
   createdAt: DateTime,
   expiresAt: DateTime,
 };
-/** One inbox row. `sentence` is the start of the app's sentence; read the Action for everything the person approves. */
+/** One inbox row. `sentence` is the start of the plain question; read the Action for everything the person approves. */
 export const AppActionSummarySchema = z.object({ ...actionFields, sentence: PlainText(APP_ACTION_LIMITS.summaryChars).min(1) }).strict();
 export const AppActionViewSchema = z
   .object({
     ...actionFields,
-    /** What the Action does, in the app's words and the person's language. */
+    /** The plain Assistant question, in the originating turn's language. */
     sentence: PlainText(APP_ACTION_LIMITS.sentenceChars).min(1),
-    /** The app's review of this call, or `null`. */
+    /** The question's reason line, or `null` for older snapshots. */
     message: PlainText(APP_ACTION_LIMITS.messageChars).nullable(),
     details: z
       .array(

package/src/contracts/capabilities.ts

@@ -195,7 +195,7 @@ const reviewBlock = (max: number) =>
     .max(max)
     .refine((text) => !/[\p{Cc}\p{Cf}\u2028\u2029]/u.test(text.replace(/[\n\t]/g, "")), "Contains unsafe characters");
 export const CapabilityPersonSchema = z
-  .object({ name: reviewLine(120).optional(), address: reviewLine(320).optional(), userId: z.uuid().optional() })
+  .object({ name: reviewLine(200).optional(), address: reviewLine(320).optional(), userId: z.uuid().optional() })
   .strict()
   .refine((person) => person.name !== undefined || person.address !== undefined, "A person needs a name or address");
 export type CapabilityPerson = z.infer<typeof CapabilityPersonSchema>;

package/src/contracts/shared.ts

@@ -206,6 +206,9 @@ export const MessageResponseSchema = z.object({
 });
 export type MessageResponse = z.infer<typeof MessageResponseSchema>;
 
+export const SignOutOthersResponseSchema = MessageResponseSchema.extend({ signInAgain: z.boolean() });
+export type SignOutOthersResponse = z.infer<typeof SignOutOthersResponseSchema>;
+
 export type MutationResult<T = void> = { ok: true; data: T } | { ok: false; error: string; status: 400 | 401 | 403 | 404 | 409 | 500 };
 
 export const PermissionLevelSchema = z.enum(["none", "read", "write", "admin"]);

package/src/server/middleware/auth.ts

@@ -414,12 +414,14 @@ const getAuthority = (c: Context<AuthContext>): RequestAuthority => {
 const isAppSession = <E extends AuthContext>(c: Context<E>): boolean => isAppSessionActor(c.get("actor"));
 
 /** Returns only the browser session identity authenticated for this request. */
-const browserSignIn = async <E extends AuthContext>(c: Context<E>): Promise<{ userId: string; sid: string } | null> => {
+const browserSignIn = async <E extends AuthContext>(c: Context<E>): Promise<{ userId: string; sid: string; authEpoch: number } | null> => {
   if (c.get("credentialKind") !== "session" || c.get("actor")?.kind !== "user" || isAppSession(c)) return null;
   const token = c.get("sessionToken");
   if (!token) return null;
   const authenticated = await session.authenticateRequest(c, token);
-  return authenticated?.data.kind === "web" ? { userId: authenticated.data.userId, sid: authenticated.data.sid } : null;
+  return authenticated?.data.kind === "web"
+    ? { userId: authenticated.data.userId, sid: authenticated.data.sid, authEpoch: authenticated.data.authEpoch }
+    : null;
 };
 
 /** The standard answer for actions the mobile app may not take. */

package/src/services/accounts/app.ts

@@ -31,6 +31,7 @@ import { getFreeIpaConfig } from "../freeipa-config";
 import { type LogEntry, logger, logging } from "../logging";
 import { isUniqueViolation } from "../postgres";
 import { providers } from "../providers";
+import { session } from "../session";
 import { get as getSetting } from "../settings";
 import { type AccountsActor, canMutateManagedGroup, hasOnlySelfUpdateFields, isAdminActor, isSelfTarget } from "./authz";
 import { listDuplicateEmails } from "./duplicate-emails";
@@ -838,7 +839,12 @@ export const accountsAppService = {
      * admin app is UI only and must not dispatch on provider or speak to
      * FreeIPA directly.
      */
-    changeOwnPassword: async (config: { user: User; currentPassword: string; newPassword: string }): Promise<Result<void>> => {
+    changeOwnPassword: async (config: {
+      user: User;
+      currentPassword: string;
+      newPassword: string;
+      keep?: { sid: string; authEpoch: number } | null;
+    }): Promise<Result<{ kept: { token: string; expiresAt: Date } | null }>> => {
       const actor = { userId: config.user.id, uid: config.user.uid, roles: config.user.roles, provider: config.user.provider };
       if (!(await getFreeIpaConfig()).enabled) {
         const result = fail(err.badInput("FreeIPA is disabled."));
@@ -875,8 +881,22 @@ export const accountsAppService = {
         uid: config.user.uid,
         newPassword: config.newPassword,
       });
-      const serviceResult = result.ok ? ok(undefined) : fail(toServiceError(result.status, result.error));
-      return recordCompletedMutation({
+      let serviceResult: Result<{ kept: { token: string; expiresAt: Date } | null }>;
+      if (!result.ok) {
+        serviceResult = fail(toServiceError(result.status, result.error));
+      } else {
+        try {
+          serviceResult = ok(await session.endOtherSignIns(config.user.id, { keep: config.keep, reason: "password_change" }));
+        } catch {
+          serviceResult = fail({
+            code: "SIGN_OUT_OTHERS_FAILED",
+            status: 500,
+            message: "Password changed. Signing out your other sign-ins did not work.",
+          });
+        }
+      }
+      const record = result.ok ? audit.recordResultAfterSideEffect : audit.recordResult;
+      return record({
         action: "accounts.user.change_own_password",
         actor: auditActor(actor),
         target: userTarget(config.user),

package/src/services/accounts/users.ts

@@ -675,10 +675,21 @@ export const resetPassword = async (params: { id: string }): Promise<MutationRes
   const serviceSession = await getServiceIpaSession();
   if (!serviceSession.ok) return serviceSession;
 
-  return providers.ipa.users.resetPassword({
+  const result = await providers.ipa.users.resetPassword({
     ipaSession: serviceSession.data,
     id: params.id,
   });
+  if (!result.ok) return result;
+  try {
+    await session.endOtherSignIns(params.id, { reason: "password_reset" });
+  } catch {
+    return {
+      ok: false,
+      error: "The password was reset, but signing out the person's other sign-ins did not work. Reset the password again.",
+      status: 500,
+    };
+  }
+  return result;
 };
 
 export const switchProvider = async (params: { id: string; provider: UserProvider }): Promise<MutationResult<void>> => {

package/src/services/approvals/device.ts

@@ -1,4 +1,6 @@
-import { capabilityReviewView } from "../../_internal/capability-reviews";
+import { listApps } from "../../_internal/registry";
+import type { ActionCard } from "../../ai/chat/action-card";
+import { type ActionQuestionText, actionCardText, actionNoteLabel } from "../../ai/chat/action-text";
 import {
   APP_APPROVAL_LIMITS,
   type AppActionSummary,
@@ -6,9 +8,12 @@ import {
   appActionDigest,
   APP_ACTION_LIMITS as limits,
 } from "../../contracts/app-approval";
-import { CapabilityActionReviewDataSchema } from "../../contracts/capabilities";
 import { DEFAULT_LOCALE } from "../../server/locale";
+import { resolveAppIdentityPresentation } from "../../shared/app-presentation";
+import { get } from ".";
 import type { PendingApprovalRow } from "./list";
+import { listPending } from "./list";
+import { type ApprovalActionPolicy, loadApprovalActionPolicies, pendingApprovalCard } from "./question";
 
 const plain = (value: string): string =>
   value
@@ -22,12 +27,26 @@ const cut = (value: string, limit: number): string => {
   return points.length > limit ? `${points.slice(0, limit - 1).join("")}…` : value;
 };
 
+export { pendingApprovalCard };
+
 export const appApprovalText = (value: string, limit: number): string => cut(plain(value), limit);
 
+/**
+ * Incomplete sends must be decided with the complete review in the browser. Without the declared policy Cloud cannot
+ * rule out `sends`, so an incomplete question then stays in the browser too.
+ */
+export const appActionOffered = (view: AppActionView, question: ActionCard | ActionQuestionText, policy?: ApprovalActionPolicy): boolean =>
+  !(
+    view.truncated &&
+    (policy === null ||
+      ("reasonCode" in question ? question.reasonCode : question.reason.code) === "sends" ||
+      (policy && "ask" in policy && policy.ask === "sends"))
+  );
+
 /** A deterministic, plain-text snapshot; the digest binds the device's choice to everything it shows. */
 export const appActionView = async (
   row: PendingApprovalRow,
-  options: { issuer: string; appName: (appId: string, locale: string) => string },
+  options: { issuer: string; appName: (appId: string, locale: string) => string; policy?: ApprovalActionPolicy },
 ): Promise<AppActionView> => {
   let truncated = false;
   const text = (value: string, limit: number) => {
@@ -44,41 +63,20 @@ export const appActionView = async (
     // The snapshot, so renaming the chat does not change what the device signs.
     title: text(row.requesterTitle ?? "", limits.titleChars) || null,
   };
-  const lines = row.sentence.split(/\r?\n/).map(plain).filter(Boolean);
-  const first = lines[0] ?? plain(row.action);
-  const prefix = `${appName}: `;
-  const sentence = first.startsWith(prefix) && first.length > prefix.length ? first.slice(prefix.length) : first;
-  const review = CapabilityActionReviewDataSchema.safeParse(row.details);
-  let message: string | null;
+  const question = actionCardText(pendingApprovalCard(row, options.appName, options.policy));
+  truncated ||= question.incomplete;
   const details: AppActionView["details"] = [];
-  const detail = (label: string, value: string, format?: "date" | "date-time") => {
+  for (const field of question.rows) {
     if (details.length >= limits.details) {
       truncated = true;
-      return;
+      break;
     }
-    const cleanedLabel = text(label, limits.labelChars);
-    if (!cleanedLabel) return;
-    details.push({ label: cleanedLabel, value: text(value, limits.valueChars), ...(format ? { format } : {}) });
-  };
-  const messages: string[] = [];
-  const reviewLines = new Set<string>();
-  if (review.success) {
-    const view = capabilityReviewView(review.data, { timeZone: "UTC" });
-    const cleaned = plain(view.message);
-    if (cleaned !== sentence) messages.push(cleaned);
-    reviewLines.add(cleaned);
-    for (const line of view.message.split(/\r?\n/)) reviewLines.add(plain(line));
-    for (const field of view.details ?? [])
-      detail(field.label, field.value, field.format === "date" || field.format === "date-time" ? field.format : undefined);
-  }
-  for (const line of lines.slice(1)) {
-    if (reviewLines.has(line)) continue;
-    const match = /^([^:]{1,40}):\s+(.+)$/.exec(line);
-    if (match) detail(match[1]!, match[2]!);
-    else messages.push(line);
+    // The device protocol requires labels; a line an old review left unlabelled is shown as a note, not dropped.
+    const label = text(field.label, limits.labelChars) || text(actionNoteLabel(question.locale), limits.labelChars);
+    details.push({ label, value: text(field.value, limits.valueChars), ...(field.format ? { format: field.format } : {}) });
   }
-  message = text(messages.join(" "), limits.messageChars) || null;
-  const boundedSentence = text(sentence, limits.sentenceChars);
+  const message = text(question.reason, limits.messageChars) || null;
+  const boundedSentence = text(question.question, limits.sentenceChars);
   const view: AppActionView = {
     actionId: row.id,
     app,
@@ -114,3 +112,21 @@ export const appActionSummary = (view: AppActionView): AppActionSummary => ({
   createdAt: view.createdAt,
   expiresAt: view.expiresAt,
 });
+
+/** Whether a pending approval can wake a device under the same mapping used by its inbox and detail view. */
+export const deviceOffersApproval = async (approvalId: string): Promise<boolean> => {
+  const request = await get(approvalId);
+  if (!request) return false;
+  const { items } = await listPending({ approverUserId: request.approverUserId, id: approvalId, limit: 1 });
+  const row = items[0];
+  if (!row) return false;
+  const apps = await listApps();
+  const appName = (id: string, locale: string) => {
+    const app = apps.find((entry) => entry.id === id);
+    return app ? resolveAppIdentityPresentation(app, locale).name : id;
+  };
+  const policy = (await loadApprovalActionPolicies([row]))(row);
+  // Offering does not sign a decision; the issuer has no effect on truncation or eligibility.
+  const view = await appActionView(row, { issuer: "", appName, policy });
+  return appActionOffered(view, pendingApprovalCard(row, appName, policy), policy);
+};

package/src/services/approvals/index.ts

@@ -9,6 +9,7 @@ import { toPgTextArray } from "../postgres";
 
 export { countPending, listPending, presentPendingApproval } from "./list";
 export { migrateApprovals } from "./migrate";
+export { type ApprovalActionPolicy, loadApprovalActionPolicies, pendingApprovalCard } from "./question";
 
 // Derived from chat's AI_ACTION_BUDGET_MS and Studio's one-day abandonment of pending calls.
 export const APPROVAL_MAX_WAIT_MS = 24 * 60 * 60_000;

package/src/services/approvals/list.ts

@@ -33,7 +33,7 @@ export type PendingApprovalRow = {
 };
 
 // Start with this person's indexed pending rows; a Studio page alone cannot continue a chat.
-const openRequests = (approverUserId: string, id?: string) => sql`SELECT r.* FROM approvals.requests r
+export const openRequests = (approverUserId: string, id?: string) => sql`SELECT r.* FROM approvals.requests r
   WHERE r.approver_user_id=${approverUserId}::uuid AND r.status='pending' AND r.expires_at > now()
     AND r.approver_auth_epoch=(SELECT auth_epoch FROM auth.users WHERE id=${approverUserId}::uuid)
     AND (${id ?? null}::uuid IS NULL OR r.id=${id ?? null}::uuid)

package/src/services/approvals/question.ts

@@ -0,0 +1,68 @@
+import { listCapabilities } from "../../_internal/registry";
+import { type AiStoredActionReview, storedActionReview } from "../../ai/action-review";
+import type { ActionCard } from "../../ai/chat/action-card";
+import { approvalCard } from "../../approvals/approval-card";
+import {
+  CapabilityActionCallReviewSchema,
+  type CapabilityActionPolicy,
+  CapabilityActionReviewDataSchema,
+  capabilityActionPolicy,
+} from "../../contracts/capabilities";
+import { DEFAULT_LOCALE } from "../../server/locale";
+import type { PendingApprovalRow } from "./list";
+
+/**
+ * One open approval as the question card words it, for places outside the browser: Cloud Login and notifications.
+ * The approvals page builds the same card from the same rows.
+ */
+
+/**
+ * The declared policy of a row's Action, needed for new-shape reviews' device eligibility and fallback reason:
+ * `undefined` when none is needed or declared, `null` when the registry could not say.
+ */
+export type ApprovalActionPolicy = CapabilityActionPolicy | null | undefined;
+const needsPolicy = (row: PendingApprovalRow): boolean => {
+  if (row.storedReview && "sentence" in row.storedReview) return true;
+  const review = CapabilityActionCallReviewSchema.safeParse(row.details);
+  return review.success;
+};
+/** Reads the registry once for the rows that need their Action's declared policy, as the approvals page does. */
+export const loadApprovalActionPolicies = async (
+  rows: readonly PendingApprovalRow[],
+): Promise<(row: PendingApprovalRow) => ApprovalActionPolicy> => {
+  if (!rows.some(needsPolicy)) return () => undefined;
+  const capabilities = await listCapabilities().catch(() => null);
+  return (row) => {
+    if (!needsPolicy(row)) return undefined;
+    if (capabilities === null) return null;
+    // An app that is not registered right now cannot say why its Action asks either.
+    const manifest = capabilities.find((entry) => entry.appId === row.appId)?.manifest;
+    return manifest ? capabilityActionPolicy(manifest, row.action) : null;
+  };
+};
+
+/** Prefer the turn's snapshot, then the linked request's review. */
+export const pendingApprovalReview = (
+  row: Pick<PendingApprovalRow, "storedReview" | "details">,
+  policy?: ApprovalActionPolicy,
+): AiStoredActionReview | null => {
+  const parsed = CapabilityActionReviewDataSchema.safeParse(row.details);
+  return row.storedReview ?? (parsed.success ? storedActionReview(parsed.data, policy ?? undefined) : null);
+};
+
+/** Resolve the recorded question in the language and time zone of its originating turn. */
+export const pendingApprovalCard = (
+  row: PendingApprovalRow,
+  appName: (appId: string, locale: string) => string,
+  policy?: ApprovalActionPolicy,
+  fallbackLocale = DEFAULT_LOCALE,
+): ActionCard => {
+  const locale = row.runConfig?.kind === "compact" ? fallbackLocale : (row.runConfig?.locale ?? fallbackLocale);
+  const timeZone = row.runConfig?.kind === "compact" ? "UTC" : (row.runConfig?.timeZone ?? "UTC");
+  const review = pendingApprovalReview(row, policy);
+  return approvalCard(
+    { sentence: row.sentence, action: row.action, appName: appName(row.appId, locale), appIcon: null, review },
+    locale,
+    timeZone,
+  );
+};

package/src/services/audit/index.ts

@@ -122,6 +122,7 @@ const SELF_SERVICE_ACTION_LABELS = {
   "webauthn_credential.authenticate": "Passkey used",
   "auth.pwa.device.enroll": "App paired",
   "auth.pwa.device.revoke": "App removed",
+  "auth.session.sign_out_others": "Signed out everywhere else",
 } as const satisfies Record<string, string>;
 const SELF_SERVICE_ACTIONS = Object.keys(SELF_SERVICE_ACTION_LABELS);
 

package/src/services/auth-flows/ipa.ts

@@ -4,6 +4,7 @@ import { isAccountCategoryAllowed } from "../account-category-policy";
 import { accounts } from "../accounts";
 import { logger } from "../logging";
 import { providers } from "../providers";
+import { session } from "../session";
 
 type IpaLoginFailure =
   | { ok: false; status: 403; reason: "category_disabled"; message: string }
@@ -19,6 +20,8 @@ type IpaLoginSuccess = {
   ok: true;
   userId: string;
   user: User;
+  /** Read before the password check; session issuance refuses a newer one. */
+  authEpoch: number;
 };
 
 export type IpaLoginFlowResult = IpaLoginSuccess | IpaLoginFailure;
@@ -96,6 +99,13 @@ export const login = async (params: { username: string; password: string }): Pro
     return failInvalidCredentials({ identifier: params.username, password: params.password });
   }
 
+  // Read before the password check so a concurrent password change or sign-out ends this sign-in too.
+  const [account] = await sql<Array<{ auth_epoch: string | number | bigint }>>`
+    SELECT auth_epoch FROM auth.users WHERE provider = 'ipa' AND uid = ${uid}
+  `;
+  const authEpoch = account ? Number(account.auth_epoch) : null;
+  if (authEpoch !== null && (!Number.isSafeInteger(authEpoch) || authEpoch < 0)) throw new Error("User auth_epoch is invalid");
+
   const loginResult = await providers.ipa.auth.login(uid, params.password).catch((error) => {
     log.error("FreeIPA login transport failed", {
       uid,
@@ -168,11 +178,21 @@ export const login = async (params: { username: string; password: string }): Pro
 
   const userResult = await loadSyncedIpaUser(uid);
   if (!userResult.ok) return userResult;
+  // An account synced in only after the read has no epoch this sign-in is bound to; the next attempt has one.
+  if (authEpoch === null) {
+    return {
+      ok: false,
+      status: 400,
+      reason: "user_not_synced",
+      message: "Your account is not yet available. Please try again in a few minutes.",
+    };
+  }
 
   return {
     ok: true,
     userId: userResult.userId,
     user: userResult.user,
+    authEpoch,
   };
 };
 
@@ -180,7 +200,11 @@ export const changeExpiredPassword = async (params: {
   username: string;
   currentPassword: string;
   newPassword: string;
-}): Promise<IpaLoginFlowResult | { ok: false; status: number; reason: "change_failed"; message: string }> => {
+}): Promise<
+  | (IpaLoginSuccess & { signOutOthersFailed: boolean })
+  | IpaLoginFailure
+  | { ok: false; status: number; reason: "change_failed"; message: string }
+> => {
   if (!(await isAccountCategoryAllowed({ provider: "ipa", profile: "user" })))
     return { ok: false, status: 403, reason: "category_disabled", message: "FreeIPA accounts are disabled. Contact an administrator." };
   const changeResult = await providers.ipa.auth.changeExpiredPassword(params);
@@ -193,5 +217,18 @@ export const changeExpiredPassword = async (params: {
     };
   }
 
-  return login({ username: params.username, password: params.newPassword });
+  // Resolve the local account here, before the caller issues its new browser session, even if login later fails.
+  const uid = await resolveIpaLoginUid(params.username);
+  const [user] = uid ? await sql<Array<{ id: string }>>`SELECT id FROM auth.users WHERE provider = 'ipa' AND uid = ${uid}` : [];
+  let signOutOthersFailed = false;
+  if (user) {
+    try {
+      await session.endOtherSignIns(user.id, { reason: "password_change" });
+    } catch {
+      log.warn("Password changed, but ending other sign-ins failed", { userId: user.id });
+      signOutOthersFailed = true;
+    }
+  }
+  const loginResult = await login({ username: params.username, password: params.newPassword });
+  return loginResult.ok ? { ...loginResult, signOutOthersFailed } : loginResult;
 };

package/src/services/auth-flows/password-reset.ts

@@ -29,6 +29,8 @@ type ResetAttemptSuccess = {
   ok: true;
   userId: string;
   user: User;
+  authEpoch: number;
+  signOutOthersFailed: boolean;
 };
 
 type ResetAttemptFailure =
@@ -154,13 +156,24 @@ const changeTemporaryPassword = async (params: {
     };
   }
 
-  await session.revokeAllForUser(changeResult.userId);
+  // The old password stayed valid while FreeIPA changed it, so a sign-in or device paired in that time outlives the
+  // sign-out before the change. Signing out everywhere again ends them, and everything the change already ended.
+  // Without it, this browser gets no session: the retry for other sign-ins keeps devices, a new reset link does not.
+  // Bind issuance to this final sign-out so a later sign-out also ends this sign-in.
+  let authEpoch: number;
+  try {
+    authEpoch = await session.revokeAllForUser(changeResult.userId);
+  } catch {
+    log.warn("Password reset: signing out everywhere after the change failed", { userId: changeResult.userId });
+    return {
+      ok: false,
+      status: 500,
+      reason: "reset_failed",
+      message: "Your password was changed, but signing you out everywhere did not work. Request a new reset link to finish.",
+    };
+  }
 
-  return {
-    ok: true,
-    userId: changeResult.userId,
-    user: changeResult.user,
-  };
+  return { ok: true, userId: changeResult.userId, user: changeResult.user, authEpoch, signOutOthersFailed: false };
 };
 
 type ResetRequest = { email: string; redirectTo?: string; locale?: string };
@@ -258,6 +271,19 @@ export const complete = async (params: { token?: string; newPassword: string }):
     };
   }
 
+  // The consumed reset token authorizes signing out everywhere; unpair phones before changing the password.
+  try {
+    await session.revokeAllForUser(target.userId);
+  } catch {
+    log.warn("Password reset stopped: signing out everywhere failed", { userId: target.userId });
+    return {
+      ok: false,
+      status: 500,
+      reason: "reset_failed",
+      message: "Signing you out everywhere did not work, so your password was not changed. Request a new reset link.",
+    };
+  }
+
   const resetResult = await providers.ipa.users.resetPassword({
     ipaSession: serviceSession.data,
     id: target.userId,

package/src/services/index.ts

@@ -257,3 +257,5 @@ export {
   type NewBrowserSignInNotifier,
 } from "./known-browsers";
 export { LASTING_ACCESS_SIGN_IN_SECONDS, requireConfirmedBrowserSignIn } from "./session/recent";
+
+export { deviceOffersApproval } from "./approvals/device";