@k2b/cloud 0.40.0 → 0.42.0

package/src/services/app-access-metrics.ts

@@ -0,0 +1,24 @@
+import { logger } from "./logging";
+import { requestCacheRedis } from "./request-cache-redis";
+
+const KEY = "cloud:app-access:denied";
+let lastFailureLog = -Infinity;
+
+/** Count denied entry/invocation attempts, never discovery filtering or audit rows. Call only for registered app IDs. */
+export const recordAppAccessDenied = (appId: string): void => {
+  void requestCacheRedis()
+    .then((redis) => redis.send("HINCRBY", [KEY, appId, "1"]))
+    .catch(() => {
+      if (Date.now() - lastFailureLog < 60_000) return;
+      lastFailureLog = Date.now();
+      logger("app-access").warn("Application access denial metrics are unavailable");
+    });
+};
+
+/** The metric collector reads only the current registry's bounded set of app labels. */
+export const readAppAccessDenials = async (appIds: readonly string[]): Promise<{ app: string; count: number }[]> => {
+  if (!appIds.length) return [];
+  const values: unknown = await (await requestCacheRedis()).send("HMGET", [KEY, ...appIds]);
+  if (!Array.isArray(values)) throw new Error("Invalid application access metrics response");
+  return appIds.map((app, index) => ({ app, count: Number(values[index] ?? 0) }));
+};

package/src/services/app-access.ts

@@ -0,0 +1,123 @@
+import { type SQL, sql } from "bun";
+import type { Context } from "hono";
+import type { AppMeta } from "../contracts/app";
+import { AppAccessRuleSchema, type FixedAppAccessRule } from "../contracts/app-access";
+import { userFromActor } from "../server/actor";
+import type { AuthContext, RequestAuthority } from "../server/middleware/auth";
+import { buildAccessPrincipalCondition } from "../server/services/access";
+import { logger } from "./logging";
+import { toPgTextArray } from "./postgres";
+
+type AccessApp = Pick<AppMeta, "id" | "access">;
+type GrantState = { app_id: string; configured: boolean; permission: "read" | "admin" | null };
+
+/** Read the already resolved identity; never reload unrestricted roles from its subject ID. */
+export const appAccessAuthority = <E extends AuthContext>(c: Context<E>): RequestAuthority | null => {
+  const actor = c.get("actor");
+  const accessSubject = c.get("accessSubject");
+  const credentialKind = c.get("credentialKind");
+  if (!actor || !accessSubject || !credentialKind) return null;
+  return { actor, accessSubject, credentialKind, scopes: c.get("credentialScopes") ?? [] };
+};
+
+const credentialAllows = (authority: RequestAuthority, appId: string): boolean => {
+  const actor = authority.actor;
+  if (actor.kind === "service_account") {
+    if (actor.serviceAccount.status !== "active") return false;
+    if (actor.serviceAccount.kind === "resource_bound" && actor.serviceAccount.appId !== appId) return false;
+    if (actor.credentialExpiresAt && !(new Date(actor.credentialExpiresAt).getTime() > Date.now())) return false;
+  }
+  const credentialKind = authority.credentialKind === "invocation" ? actor.delegation?.credentialKind : authority.credentialKind;
+  if (authority.scopes.includes("ai:inference")) return false;
+  // Full personal API keys intentionally carry no scopes. Resource/standalone
+  // keys retain their caps; app-prefixed scopes are already used by applications.
+  if (credentialKind === "session" || credentialKind === "mandate") return true;
+  if (
+    credentialKind === "api_key" &&
+    actor.kind === "service_account" &&
+    actor.serviceAccount.kind === "user_delegated" &&
+    authority.scopes.length === 0
+  )
+    return true;
+  return authority.scopes.some((scope) =>
+    ["read", "write", "admin", `${appId}:read`, `${appId}:write`, `${appId}:admin`, `${appId}:*`].includes(scope),
+  );
+};
+
+const fixedAllows = (authority: RequestAuthority, rule: FixedAppAccessRule): boolean => {
+  const user = userFromActor(authority.actor);
+  switch (rule.kind) {
+    case "signedIn":
+      return true;
+    case "noGuests":
+      return user?.profile !== "guest";
+    case "roles":
+      return !!user && rule.roles.some((role) => (role === "guest" ? user.profile === "guest" : user.roles.includes(role)));
+    default:
+      return false;
+  }
+};
+
+/** Pure decision shared by single-app and batched reads. Missing grant state means unconfigured, not an implicit grant. */
+export const evaluateAppAccess = (authority: RequestAuthority | null, app: AccessApp, state?: GrantState): boolean => {
+  if (app.access === undefined) return true; // Step 1 compatibility; no inferred entry rule.
+  if (!authority || !credentialAllows(authority, app.id)) return false;
+  const parsed = AppAccessRuleSchema.safeParse(app.access);
+  if (!parsed.success) return false;
+  const rule = parsed.data;
+  if (rule.kind !== "grants") return fixedAllows(authority, rule);
+  if (!state?.configured) return !!rule.until && fixedAllows(authority, rule.until);
+  return state.permission === "read" || state.permission === "admin";
+};
+
+let lastFailureLog = -Infinity;
+const reportFailure = () => {
+  if (Date.now() - lastFailureLog < 60_000) return;
+  lastFailureLog = Date.now();
+  logger("app-access").error("Application access could not be resolved; configurable applications are unavailable");
+};
+
+/**
+ * One authoritative SQL read for all configurable apps. No grant cache: revocation applies on the next request.
+ * Pass the reserved transaction as `db` when checking access inside a guarded operation.
+ */
+export const usableAppIds = async (
+  authority: RequestAuthority | null,
+  apps: readonly AccessApp[],
+  options: { db?: SQL } = {},
+): Promise<Set<string>> => {
+  const db = options.db ?? sql;
+  const allowed = new Set(apps.filter((app) => app.access?.kind !== "grants" && evaluateAppAccess(authority, app)).map((app) => app.id));
+  if (!authority) return allowed;
+  const configurable = apps.filter((app) => app.access?.kind === "grants" && credentialAllows(authority, app.id));
+  if (configurable.length === 0) return allowed;
+  try {
+    const principal = buildAccessPrincipalCondition({
+      subject: authority.accessSubject,
+      columns: {
+        userId: db`a.user_id`,
+        groupId: db`a.group_id`,
+        serviceAccountId: db`a.service_account_id`,
+        authenticatedOnly: db`a.authenticated_only`,
+      },
+    });
+    const states = await db<GrantState[]>`
+      SELECT requested.app_id, s.configured_at IS NOT NULL AS configured,
+        (SELECT a.permission FROM auth.app_access j JOIN auth.access a ON a.id = j.access_id
+         WHERE j.app_id = requested.app_id AND a.permission IN ('read', 'admin')
+           AND (a.user_id IS NOT NULL OR a.group_id IS NOT NULL OR a.service_account_id IS NOT NULL OR a.authenticated_only)
+           AND ${principal}
+         ORDER BY CASE a.permission WHEN 'admin' THEN 2 ELSE 1 END DESC LIMIT 1) AS permission
+      FROM unnest(${toPgTextArray(configurable.map((app) => app.id))}::text[]) AS requested(app_id)
+      LEFT JOIN auth.app_access_state s ON s.app_id = requested.app_id
+    `;
+    const byApp = new Map(states.map((state) => [state.app_id, state]));
+    for (const app of configurable) if (evaluateAppAccess(authority, app, byApp.get(app.id))) allowed.add(app.id);
+  } catch {
+    reportFailure();
+  }
+  return allowed;
+};
+
+export const canUseApp = async (authority: RequestAuthority | null, app: AccessApp, options: { db?: SQL } = {}): Promise<boolean> =>
+  (await usableAppIds(authority, [app], options)).has(app.id);

package/src/services/app-discovery.ts

@@ -0,0 +1,27 @@
+import { listApps } from "../_internal/registry";
+import type { AppMeta } from "../contracts/app";
+import type { AppRegistryEntry } from "../contracts/registry";
+import type { RequestAuthority } from "../server/middleware/auth";
+import { usableAppIds } from "./app-access";
+
+/** Filter before projecting any app-owned names, schemas, or content. */
+export const discoverableApps = async <T extends Pick<AppMeta, "id" | "access">>(
+  authority: RequestAuthority | null,
+  apps: readonly T[],
+): Promise<T[]> => {
+  const usable = await usableAppIds(authority, apps);
+  return apps.filter((app) => usable.has(app.id));
+};
+
+/** Capability and widget records carry an app ID; the live registry owns their access declaration. */
+export const discoverableAppEntries = async <T extends { appId: string }>(
+  authority: RequestAuthority | null,
+  entries: readonly T[],
+  registry: () => Promise<AppRegistryEntry[]> = listApps,
+): Promise<T[]> => {
+  if (!entries.length) return [];
+  const ids = new Set(entries.map((entry) => entry.appId));
+  const apps = (await registry()).filter((app) => ids.has(app.id));
+  const usable = await usableAppIds(authority, apps);
+  return entries.filter((entry) => usable.has(entry.appId));
+};

package/src/services/approvals/content.ts

@@ -0,0 +1,40 @@
+import { sql } from "bun";
+import { parseStoredReviewContent } from "../../capabilities/review-storage";
+import { CAPABILITY_MAX_REVIEW_CONTENT_BYTES } from "../../contracts/capabilities";
+
+// Start with this person's indexed pending rows; a Studio page alone cannot continue a chat.
+export const openRequests = (approverUserId: string, id?: string) => sql`SELECT r.* FROM approvals.requests r
+  WHERE r.approver_user_id=${approverUserId}::uuid AND r.status='pending' AND r.expires_at > now()
+    AND r.approver_auth_epoch=(SELECT auth_epoch FROM auth.users WHERE id=${approverUserId}::uuid)
+    AND (${id ?? null}::uuid IS NULL OR r.id=${id ?? null}::uuid)
+    AND EXISTS (SELECT 1 FROM ai.pending_actions p WHERE p.approval_id=r.id AND p.status='pending')`;
+
+/** Keep the original approval's digest and reader even when the turn has moved to a newer question. */
+export const compactApprovalDetailsSql = (row = "r") => {
+  const details = sql`${sql(`${row}.details`)}`;
+  return sql`CASE WHEN jsonb_typeof(${details}) = 'object' THEN (${details} - 'content') || CASE WHEN ${details} ? 'content' THEN jsonb_build_object(
+    'contentRef', jsonb_build_object('href', '/api/approvals/' || ${sql(`${row}.id`)}::text || '/content', 'digest', ${sql(`${row}.review_digest`)})
+  ) ELSE '{}'::jsonb END ELSE ${details} END`;
+};
+
+/** Open requests retain the existing approver, pending-action, expiry and sign-out-epoch requirements. */
+export const readApprovalContent = async (input: { id: string; approverUserId: string; digest: string; signal?: AbortSignal }) => {
+  input.signal?.throwIfAborted();
+  const query = sql<{ content: unknown }[]>`
+    SELECT r.details->'content' AS content FROM (${openRequests(input.approverUserId, input.id)}) r
+    WHERE r.review_digest=${input.digest}
+      AND octet_length((r.details->'content')::text) <= ${2 * CAPABILITY_MAX_REVIEW_CONTENT_BYTES + 2} LIMIT 1`;
+  const abort = () => query.cancel();
+  input.signal?.addEventListener("abort", abort, { once: true });
+  if (input.signal?.aborted) abort();
+  let rows: { content: unknown }[];
+  try {
+    rows = await query;
+  } finally {
+    input.signal?.removeEventListener("abort", abort);
+  }
+  input.signal?.throwIfAborted();
+  const row = rows[0];
+  const parsed = parseStoredReviewContent(row?.content);
+  return parsed.success ? parsed.data : null;
+};

package/src/services/approvals/device.ts

@@ -1,4 +1,6 @@
-import { capabilityReviewView } from "../../_internal/capability-reviews";
+import { listApps } from "../../_internal/registry";
+import type { ActionCard } from "../../ai/chat/action-card";
+import { type ActionQuestionText, actionCardText, actionNoteLabel } from "../../ai/chat/action-text";
 import {
   APP_APPROVAL_LIMITS,
   type AppActionSummary,
@@ -6,9 +8,12 @@ import {
   appActionDigest,
   APP_ACTION_LIMITS as limits,
 } from "../../contracts/app-approval";
-import { CapabilityActionReviewDataSchema } from "../../contracts/capabilities";
 import { DEFAULT_LOCALE } from "../../server/locale";
+import { resolveAppIdentityPresentation } from "../../shared/app-presentation";
+import { get } from ".";
 import type { PendingApprovalRow } from "./list";
+import { listPending } from "./list";
+import { type ApprovalActionPolicy, loadApprovalActionPolicies, pendingApprovalCard } from "./question";
 
 const plain = (value: string): string =>
   value
@@ -22,12 +27,26 @@ const cut = (value: string, limit: number): string => {
   return points.length > limit ? `${points.slice(0, limit - 1).join("")}…` : value;
 };
 
+export { pendingApprovalCard };
+
 export const appApprovalText = (value: string, limit: number): string => cut(plain(value), limit);
 
+/**
+ * Incomplete sends must be decided with the complete review in the browser. Without the declared policy Cloud cannot
+ * rule out `sends`, so an incomplete question then stays in the browser too.
+ */
+export const appActionOffered = (view: AppActionView, question: ActionCard | ActionQuestionText, policy?: ApprovalActionPolicy): boolean =>
+  !(
+    view.truncated &&
+    (policy === null ||
+      ("reasonCode" in question ? question.reasonCode : question.reason.code) === "sends" ||
+      (policy && "ask" in policy && policy.ask === "sends"))
+  );
+
 /** A deterministic, plain-text snapshot; the digest binds the device's choice to everything it shows. */
 export const appActionView = async (
   row: PendingApprovalRow,
-  options: { issuer: string; appName: (appId: string, locale: string) => string },
+  options: { issuer: string; appName: (appId: string, locale: string) => string; policy?: ApprovalActionPolicy },
 ): Promise<AppActionView> => {
   let truncated = false;
   const text = (value: string, limit: number) => {
@@ -44,41 +63,20 @@ export const appActionView = async (
     // The snapshot, so renaming the chat does not change what the device signs.
     title: text(row.requesterTitle ?? "", limits.titleChars) || null,
   };
-  const lines = row.sentence.split(/\r?\n/).map(plain).filter(Boolean);
-  const first = lines[0] ?? plain(row.action);
-  const prefix = `${appName}: `;
-  const sentence = first.startsWith(prefix) && first.length > prefix.length ? first.slice(prefix.length) : first;
-  const review = CapabilityActionReviewDataSchema.safeParse(row.details);
-  let message: string | null;
+  const question = actionCardText(pendingApprovalCard(row, options.appName, options.policy));
+  truncated ||= question.incomplete;
   const details: AppActionView["details"] = [];
-  const detail = (label: string, value: string, format?: "date" | "date-time") => {
+  for (const field of question.rows) {
     if (details.length >= limits.details) {
       truncated = true;
-      return;
+      break;
     }
-    const cleanedLabel = text(label, limits.labelChars);
-    if (!cleanedLabel) return;
-    details.push({ label: cleanedLabel, value: text(value, limits.valueChars), ...(format ? { format } : {}) });
-  };
-  const messages: string[] = [];
-  const reviewLines = new Set<string>();
-  if (review.success) {
-    const view = capabilityReviewView(review.data, { timeZone: "UTC" });
-    const cleaned = plain(view.message);
-    if (cleaned !== sentence) messages.push(cleaned);
-    reviewLines.add(cleaned);
-    for (const line of view.message.split(/\r?\n/)) reviewLines.add(plain(line));
-    for (const field of view.details ?? [])
-      detail(field.label, field.value, field.format === "date" || field.format === "date-time" ? field.format : undefined);
-  }
-  for (const line of lines.slice(1)) {
-    if (reviewLines.has(line)) continue;
-    const match = /^([^:]{1,40}):\s+(.+)$/.exec(line);
-    if (match) detail(match[1]!, match[2]!);
-    else messages.push(line);
+    // The device protocol requires labels; a line an old review left unlabelled is shown as a note, not dropped.
+    const label = text(field.label, limits.labelChars) || text(actionNoteLabel(question.locale), limits.labelChars);
+    details.push({ label, value: text(field.value, limits.valueChars), ...(field.format ? { format: field.format } : {}) });
   }
-  message = text(messages.join(" "), limits.messageChars) || null;
-  const boundedSentence = text(sentence, limits.sentenceChars);
+  const message = text(question.reason, limits.messageChars) || null;
+  const boundedSentence = text(question.question, limits.sentenceChars);
   const view: AppActionView = {
     actionId: row.id,
     app,
@@ -114,3 +112,21 @@ export const appActionSummary = (view: AppActionView): AppActionSummary => ({
   createdAt: view.createdAt,
   expiresAt: view.expiresAt,
 });
+
+/** Whether a pending approval can wake a device under the same mapping used by its inbox and detail view. */
+export const deviceOffersApproval = async (approvalId: string): Promise<boolean> => {
+  const request = await get(approvalId);
+  if (!request) return false;
+  const { items } = await listPending({ approverUserId: request.approverUserId, id: approvalId, limit: 1 });
+  const row = items[0];
+  if (!row) return false;
+  const apps = await listApps();
+  const appName = (id: string, locale: string) => {
+    const app = apps.find((entry) => entry.id === id);
+    return app ? resolveAppIdentityPresentation(app, locale).name : id;
+  };
+  const policy = (await loadApprovalActionPolicies([row]))(row);
+  // Offering does not sign a decision; the issuer has no effect on truncation or eligibility.
+  const view = await appActionView(row, { issuer: "", appName, policy });
+  return appActionOffered(view, pendingApprovalCard(row, appName, policy), policy);
+};

package/src/services/approvals/index.ts

@@ -1,14 +1,18 @@
 import { type SQL, sql } from "bun";
 import { capabilityRequestHash } from "../../capabilities/claims";
+import { restoreReviewSnapshot, serializeReviewSnapshot } from "../../capabilities/review-storage";
 import { APPROVAL_ACP_CLIENT } from "../../contracts/approvals";
 import type { CapabilityActionReviewData } from "../../contracts/capabilities";
+import { CapabilityActionReviewPresentationSchema } from "../../contracts/capabilities";
 import { isAppSessionActor } from "../../server/actor";
 import type { RequestActor, RequestCredentialKind } from "../../server/middleware/auth";
 import { audit } from "../audit";
 import { toPgTextArray } from "../postgres";
+import { compactApprovalDetailsSql } from "./content";
 
 export { countPending, listPending, presentPendingApproval } from "./list";
 export { migrateApprovals } from "./migrate";
+export { type ApprovalActionPolicy, loadApprovalActionPolicies, pendingApprovalCard } from "./question";
 
 // Derived from chat's AI_ACTION_BUDGET_MS and Studio's one-day abandonment of pending calls.
 export const APPROVAL_MAX_WAIT_MS = 24 * 60 * 60_000;
@@ -82,10 +86,10 @@ export type ApprovalRequest = {
 };
 // SQL aliases keep the public row shape identical for reads and locked transaction reads. A function, because a
 // fragment built at import time would bind the default sql handle before a test can choose its database.
-const columns = () => sql`id, app_id AS "appId", action, approval_scope AS "approvalScope",
+const columns = (compact = false) => sql`id, app_id AS "appId", action, approval_scope AS "approvalScope",
   requester_kind AS "requesterKind", requester_ref AS "requesterRef", requester_app_id AS "requesterAppId",
   requester_title AS "requesterTitle", subject_id AS "subjectId", approver_user_id AS "approverUserId",
-  assurance, sentence, details, args_digest AS "argsDigest", review_digest AS "reviewDigest", status,
+  assurance, sentence, ${compact ? compactApprovalDetailsSql("approvals.requests") : sql`details`} AS details, args_digest AS "argsDigest", review_digest AS "reviewDigest", status,
   decided_device_id AS "decidedDeviceId", approver_auth_epoch::text AS "approverAuthEpoch",
   decided_via AS "decidedVia", decided_at AS "decidedAt", consumed_at AS "consumedAt",
   created_at AS "createdAt", expires_at AS "expiresAt"`;
@@ -121,7 +125,7 @@ export const request = async (input: ApprovalRequestInput, db?: SQL): Promise<Ap
         requester_title, subject_id, approver_user_id, approver_auth_epoch, assurance, sentence, details, args_digest, review_digest, expires_at)
       VALUES (${input.appId}, ${input.action}, ${input.approvalScope ?? null}, ${input.requester.kind}, ${input.requester.ref},
         ${input.requester.appId}, ${input.requester.title ?? null}, ${input.subjectId}::uuid, ${input.approverUserId}::uuid,
-        (SELECT auth_epoch FROM auth.users WHERE id=${input.approverUserId}::uuid), ${input.assurance}, ${input.sentence}, ${JSON.stringify(input.review ?? null)}::text::jsonb,
+        (SELECT auth_epoch FROM auth.users WHERE id=${input.approverUserId}::uuid), ${input.assurance}, ${input.sentence}, ${serializeReviewSnapshot(input.review ?? null)}::text::jsonb,
         ${approvalArgsDigest(input.input)}, ${approvalReviewDigest(input.review)}, now() + (${expiresInMs} * interval '1 millisecond'))
       ON CONFLICT (requester_kind, requester_ref) DO NOTHING
       RETURNING id
@@ -136,10 +140,15 @@ export const request = async (input: ApprovalRequestInput, db?: SQL): Promise<Ap
   });
 };
 
-export const get = async (id: string, db?: SQL): Promise<ApprovalRequest | null> =>
+export const get = async (id: string, db?: SQL, compactReview = false): Promise<ApprovalRequest | null> =>
   transaction(db, async (tx) => {
-    const [row] = await tx<ApprovalRequest[]>`SELECT ${columns()} FROM approvals.requests WHERE id=${id}::uuid`;
-    return row ?? null;
+    const [row] = await tx<ApprovalRequest[]>`SELECT ${columns(compactReview)} FROM approvals.requests WHERE id=${id}::uuid`;
+    return row
+      ? {
+          ...row,
+          details: row.details === null ? null : CapabilityActionReviewPresentationSchema.parse(restoreReviewSnapshot(row.details)),
+        }
+      : null;
   });
 
 export type ApprovalDecisionResult =

package/src/services/approvals/list.ts

@@ -4,8 +4,9 @@ import { AI_WEBSITE_APPROVAL_TOOL, aiTurnAllowsRememberedApprovals } from "../..
 import type { AiTurnRunConfig } from "../../ai/types";
 import type { RuntimeAppMeta } from "../../contracts/app";
 import { APPROVALS_PAGE_SIZE, type ApprovalCounts, type PendingApproval } from "../../contracts/approvals";
-import { type CapabilityActionPolicy, CapabilityActionReviewDataSchema } from "../../contracts/capabilities";
+import { type CapabilityActionPolicy, CapabilityActionReviewPresentationSchema } from "../../contracts/capabilities";
 import type { ApprovalAssurance } from ".";
+import { compactApprovalDetailsSql, openRequests } from "./content";
 import { decodeApprovalCursor, encodeApprovalCursor } from "./cursor";
 
 export type PendingApprovalRow = {
@@ -32,12 +33,6 @@ export type PendingApprovalRow = {
   runConfig: AiTurnRunConfig | null;
 };
 
-// Start with this person's indexed pending rows; a Studio page alone cannot continue a chat.
-const openRequests = (approverUserId: string, id?: string) => sql`SELECT r.* FROM approvals.requests r
-  WHERE r.approver_user_id=${approverUserId}::uuid AND r.status='pending' AND r.expires_at > now()
-    AND r.approver_auth_epoch=(SELECT auth_epoch FROM auth.users WHERE id=${approverUserId}::uuid)
-    AND (${id ?? null}::uuid IS NULL OR r.id=${id ?? null}::uuid)
-    AND EXISTS (SELECT 1 FROM ai.pending_actions p WHERE p.approval_id=r.id AND p.status='pending')`;
 const matches = (appId?: string, link?: string) => sql`
   (${appId ?? null}::text IS NULL OR r.app_id=${appId ?? null} OR r.requester_app_id=${appId ?? null})
   AND (${link ?? null}::text IS NULL OR COALESCE(r.details->'links' @> jsonb_build_array(jsonb_build_object('href', ${link ?? null}::text)),false))`;
@@ -58,7 +53,7 @@ export const listPending = async (input: {
     SELECT count(*) FILTER (WHERE ${matches(input.appId, input.link)})::int AS count,
       count(*) FILTER (WHERE NOT (${matches(input.appId, input.link)}))::int AS elsewhere FROM open r`;
   const rows = await sql<PendingApprovalRow[]>`WITH open AS (${openRequests(input.approverUserId, input.id)})
-    SELECT r.id, r.app_id AS "appId", r.action, r.requester_app_id AS "requesterAppId", r.requester_title AS "requesterTitle", r.assurance, r.sentence, r.details, r.args_digest AS "argsDigest",
+    SELECT r.id, r.app_id AS "appId", r.action, r.requester_app_id AS "requesterAppId", r.requester_title AS "requesterTitle", r.assurance, r.sentence, ${compactApprovalDetailsSql()} AS details, r.args_digest AS "argsDigest",
       r.created_at AS "createdAt", r.expires_at AS "expiresAt",
       to_char(r.created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') AS "cursorCreatedAt",
       question.short_id AS "conversationShortId", question.title AS "conversationTitle",
@@ -67,7 +62,7 @@ export const listPending = async (input: {
       question.stored_review AS "storedReview"
     FROM open r JOIN LATERAL (
       SELECT c.short_id, c.title, p.allow_chat, p.allow_always, p.remember_tool_name, p.tool_name, t.run_config,
-        (SELECT m.meta->'toolReviews'->review.call_id FROM (
+        (SELECT (m.meta->'toolReviews'->review.call_id) - 'content' - 'contentRef' FROM (
           SELECT meta, conversation_id, loop_id, role, seq FROM ai.messages
           UNION ALL
           SELECT meta, conversation_id, loop_id, role, seq FROM ai.task_messages
@@ -109,12 +104,12 @@ export const presentPendingApproval = (
   policy?: CapabilityActionPolicy,
 ): PendingApproval => {
   const app = apps.find((entry) => entry.id === row.appId);
-  const review = CapabilityActionReviewDataSchema.nullable().safeParse(row.details);
+  const review = CapabilityActionReviewPresentationSchema.nullable().safeParse(row.details);
   const originalReview = review.success ? review.data : null;
   const displayReview =
     originalReview && "sentence" in originalReview
       ? row.storedReview && "sentence" in row.storedReview
-        ? row.storedReview
+        ? { ...originalReview, ask: originalReview.ask ?? row.storedReview.ask }
         : storedActionReview(originalReview, policy)
       : originalReview;
   const remember = row.assurance === "standard" && aiTurnAllowsRememberedApprovals(row.runConfig);

package/src/services/approvals/question.ts

@@ -0,0 +1,72 @@
+import { listCapabilities } from "../../_internal/registry";
+import { type AiStoredActionReview, storedActionReview } from "../../ai/action-review";
+import type { ActionCard } from "../../ai/chat/action-card";
+import { approvalCard } from "../../approvals/approval-card";
+import {
+  type CapabilityActionPolicy,
+  CapabilityActionReviewPresentationSchema,
+  capabilityActionPolicy,
+} from "../../contracts/capabilities";
+import { DEFAULT_LOCALE } from "../../server/locale";
+import type { PendingApprovalRow } from "./list";
+
+/**
+ * One open approval as the question card words it, for places outside the browser: Cloud Login and notifications.
+ * The approvals page builds the same card from the same rows.
+ */
+
+/**
+ * The declared policy of a row's Action, needed for new-shape reviews' device eligibility and fallback reason:
+ * `undefined` when none is needed or declared, `null` when the registry could not say.
+ */
+export type ApprovalActionPolicy = CapabilityActionPolicy | null | undefined;
+const needsPolicy = (row: PendingApprovalRow): boolean => {
+  if (row.storedReview && "sentence" in row.storedReview) return true;
+  const review = CapabilityActionReviewPresentationSchema.safeParse(row.details);
+  return review.success && "sentence" in review.data;
+};
+/** Reads the registry once for the rows that need their Action's declared policy, as the approvals page does. */
+export const loadApprovalActionPolicies = async (
+  rows: readonly PendingApprovalRow[],
+): Promise<(row: PendingApprovalRow) => ApprovalActionPolicy> => {
+  if (!rows.some(needsPolicy)) return () => undefined;
+  const capabilities = await listCapabilities().catch(() => null);
+  return (row) => {
+    if (!needsPolicy(row)) return undefined;
+    if (capabilities === null) return null;
+    // An app that is not registered right now cannot say why its Action asks either.
+    const manifest = capabilities.find((entry) => entry.appId === row.appId)?.manifest;
+    return manifest ? capabilityActionPolicy(manifest, row.action) : null;
+  };
+};
+
+/** The open request binds the content; the turn supplies the declared reason for older snapshots. */
+export const pendingApprovalReview = (
+  row: Pick<PendingApprovalRow, "storedReview" | "details">,
+  policy?: ApprovalActionPolicy,
+): AiStoredActionReview | null => {
+  const parsed = CapabilityActionReviewPresentationSchema.safeParse(row.details);
+  if (parsed.success && "sentence" in parsed.data)
+    return storedActionReview(
+      { ...parsed.data, ask: parsed.data.ask ?? (row.storedReview && "sentence" in row.storedReview ? row.storedReview.ask : undefined) },
+      policy,
+    );
+  return row.storedReview ?? (parsed.success ? storedActionReview(parsed.data, policy) : null);
+};
+
+/** Resolve the recorded question in the language and time zone of its originating turn. */
+export const pendingApprovalCard = (
+  row: PendingApprovalRow,
+  appName: (appId: string, locale: string) => string,
+  policy?: ApprovalActionPolicy,
+  fallbackLocale = DEFAULT_LOCALE,
+): ActionCard => {
+  const locale = row.runConfig?.kind === "compact" ? fallbackLocale : (row.runConfig?.locale ?? fallbackLocale);
+  const timeZone = row.runConfig?.kind === "compact" ? "UTC" : (row.runConfig?.timeZone ?? "UTC");
+  const review = pendingApprovalReview(row, policy);
+  return approvalCard(
+    { sentence: row.sentence, action: row.action, appName: appName(row.appId, locale), appIcon: null, review },
+    locale,
+    timeZone,
+  );
+};

package/src/services/audit/index.ts

@@ -122,6 +122,7 @@ const SELF_SERVICE_ACTION_LABELS = {
   "webauthn_credential.authenticate": "Passkey used",
   "auth.pwa.device.enroll": "App paired",
   "auth.pwa.device.revoke": "App removed",
+  "auth.session.sign_out_others": "Signed out everywhere else",
 } as const satisfies Record<string, string>;
 const SELF_SERVICE_ACTIONS = Object.keys(SELF_SERVICE_ACTION_LABELS);
 

package/src/services/auth-flows/ipa.ts

@@ -4,6 +4,7 @@ import { isAccountCategoryAllowed } from "../account-category-policy";
 import { accounts } from "../accounts";
 import { logger } from "../logging";
 import { providers } from "../providers";
+import { session } from "../session";
 
 type IpaLoginFailure =
   | { ok: false; status: 403; reason: "category_disabled"; message: string }
@@ -19,6 +20,8 @@ type IpaLoginSuccess = {
   ok: true;
   userId: string;
   user: User;
+  /** Read before the password check; session issuance refuses a newer one. */
+  authEpoch: number;
 };
 
 export type IpaLoginFlowResult = IpaLoginSuccess | IpaLoginFailure;
@@ -96,6 +99,13 @@ export const login = async (params: { username: string; password: string }): Pro
     return failInvalidCredentials({ identifier: params.username, password: params.password });
   }
 
+  // Read before the password check so a concurrent password change or sign-out ends this sign-in too.
+  const [account] = await sql<Array<{ auth_epoch: string | number | bigint }>>`
+    SELECT auth_epoch FROM auth.users WHERE provider = 'ipa' AND uid = ${uid}
+  `;
+  const authEpoch = account ? Number(account.auth_epoch) : null;
+  if (authEpoch !== null && (!Number.isSafeInteger(authEpoch) || authEpoch < 0)) throw new Error("User auth_epoch is invalid");
+
   const loginResult = await providers.ipa.auth.login(uid, params.password).catch((error) => {
     log.error("FreeIPA login transport failed", {
       uid,
@@ -168,11 +178,21 @@ export const login = async (params: { username: string; password: string }): Pro
 
   const userResult = await loadSyncedIpaUser(uid);
   if (!userResult.ok) return userResult;
+  // An account synced in only after the read has no epoch this sign-in is bound to; the next attempt has one.
+  if (authEpoch === null) {
+    return {
+      ok: false,
+      status: 400,
+      reason: "user_not_synced",
+      message: "Your account is not yet available. Please try again in a few minutes.",
+    };
+  }
 
   return {
     ok: true,
     userId: userResult.userId,
     user: userResult.user,
+    authEpoch,
   };
 };
 
@@ -180,7 +200,11 @@ export const changeExpiredPassword = async (params: {
   username: string;
   currentPassword: string;
   newPassword: string;
-}): Promise<IpaLoginFlowResult | { ok: false; status: number; reason: "change_failed"; message: string }> => {
+}): Promise<
+  | (IpaLoginSuccess & { signOutOthersFailed: boolean })
+  | IpaLoginFailure
+  | { ok: false; status: number; reason: "change_failed"; message: string }
+> => {
   if (!(await isAccountCategoryAllowed({ provider: "ipa", profile: "user" })))
     return { ok: false, status: 403, reason: "category_disabled", message: "FreeIPA accounts are disabled. Contact an administrator." };
   const changeResult = await providers.ipa.auth.changeExpiredPassword(params);
@@ -193,5 +217,18 @@ export const changeExpiredPassword = async (params: {
     };
   }
 
-  return login({ username: params.username, password: params.newPassword });
+  // Resolve the local account here, before the caller issues its new browser session, even if login later fails.
+  const uid = await resolveIpaLoginUid(params.username);
+  const [user] = uid ? await sql<Array<{ id: string }>>`SELECT id FROM auth.users WHERE provider = 'ipa' AND uid = ${uid}` : [];
+  let signOutOthersFailed = false;
+  if (user) {
+    try {
+      await session.endOtherSignIns(user.id, { reason: "password_change" });
+    } catch {
+      log.warn("Password changed, but ending other sign-ins failed", { userId: user.id });
+      signOutOthersFailed = true;
+    }
+  }
+  const loginResult = await login({ username: params.username, password: params.newPassword });
+  return loginResult.ok ? { ...loginResult, signOutOthersFailed } : loginResult;
 };