@k2b/cloud 0.42.0 → 0.44.0

package/src/services/providers/local/users.ts

@@ -1,5 +1,6 @@
 import { sql } from "bun";
 import type { MutationResult, UserProfile } from "../../../contracts/shared";
+import { coreUserEventPublisher } from "../../../events/core-user-created";
 import { isAccountCategoryAllowed } from "../../account-category-policy";
 import { writeDeletedAccountAudit } from "../../account-lifecycle/audit";
 import { emailAlreadyUsed, findAccountsByEmail, lockAccountEmail, normalizeAccountEmail } from "../../accounts/email-write";
@@ -96,6 +97,10 @@ export const create = async (params: {
       )
       RETURNING id
     `;
+      await coreUserEventPublisher().publish(tx, "user.created", {
+        subject: rows[0]!.id,
+        data: { userId: rows[0]!.id, provider: "local" },
+      });
       return { ok: true, data: { id: rows[0]!.id } };
     }, params.actor);
   } catch (error) {

package/src/services/pwa-devices.ts

@@ -52,6 +52,7 @@ export type PwaDevicePairedNotice = {
   platform: PwaPlatform;
   pairedAt: string;
   locale: string | null;
+  pairedBy?: { userId: string | null; name: string };
 };
 export type PwaDeviceNotifier = (notice: PwaDevicePairedNotice) => Promise<unknown>;
 
@@ -59,6 +60,8 @@ type PairingRow = {
   id: string;
   user_id: string;
   initiator_sid: string;
+  initiator_user_id: string | null;
+  device_confirmation_hash: string | null;
   auth_epoch: string;
   comparison: string | null;
   platform: PwaPlatform | null;
@@ -83,6 +86,8 @@ type DeviceRow = {
   revoked_at: Date | null;
   locale: string | null;
   notified_at: Date | null;
+  paired_by_user_id: string | null;
+  paired_by_name: string | null;
 };
 type UserRow = {
   id: string;
@@ -126,7 +131,7 @@ export const parseDeviceKey = (value: string | null | undefined): { deviceId: st
 
 /** Untranslated default names; the person renames the phone in the app. */
 export const defaultDeviceName = (platform: PwaPlatform, userAgent: string | undefined): string =>
-  platform === "ios" ? (/\biPad\b/.test(userAgent ?? "") ? "iPad" : "iPhone") : platform === "android" ? "Android" : "Phone";
+  platform === "ios" ? (/\biPad\b/.test(userAgent ?? "") ? "iPad" : "iPhone") : platform === "android" ? "Android" : "Device";
 
 const accountName = (user: Pick<UserRow, "display_name" | "uid">) => user.display_name?.trim() || user.uid;
 
@@ -160,10 +165,17 @@ const initiatorValid = async (tx: SQL, pairing: PairingRow): Promise<boolean> =>
     SELECT 1 FROM auth.session_families sf
     JOIN auth.users u ON u.id = sf.user_id
     JOIN auth.signing_keys sk ON sk.kid = sf.signing_kid AND sk.state <> 'revoked'
-    WHERE sf.sid = ${pairing.initiator_sid}::uuid AND sf.user_id = ${pairing.user_id}::uuid
+    WHERE sf.sid = ${pairing.initiator_sid}::uuid AND sf.user_id = ${pairing.initiator_user_id ?? pairing.user_id}::uuid
       AND sf.revoked_at IS NULL AND sf.expires_at > now() AND sf.auth_epoch = u.auth_epoch AND sf.pwa_device_id IS NULL
+      AND (${pairing.initiator_user_id === null} OR u.admin = true)
+      AND (${pairing.initiator_user_id === null} OR u.account_expires IS NULL OR u.account_expires > now())
   `;
-  return Boolean(row);
+  if (!row) return false;
+  if (pairing.initiator_user_id) {
+    const [admin] = await tx<UserRow[]>`SELECT * FROM auth.users WHERE id = ${pairing.initiator_user_id}::uuid`;
+    return Boolean(admin && (await isAccountCategoryAllowed(admin, tx)));
+  }
+  return true;
 };
 
 const accountExpired = (user: UserRow) => Boolean(user.account_expires && passed(user.account_expires));
@@ -176,6 +188,7 @@ const pairedNotice = (device: DeviceRow, name: string): PwaDevicePairedNotice =>
   platform: device.platform,
   pairedAt: iso(device.created_at),
   locale: device.locale,
+  ...(device.paired_by_name ? { pairedBy: { userId: device.paired_by_user_id, name: device.paired_by_name } } : {}),
 });
 
 /**
@@ -268,6 +281,14 @@ export type PwaRenewal =
 
 export type PwaCompletion =
   | { state: "paired"; credentials: PwaCredentials | null; platform: PwaPlatform }
+  | { state: "rejected" }
+  | {
+      state: "confirmation_required";
+      account: { name: string };
+      administrator: { name: string };
+      confirmationToken: string;
+      expiresAt: string;
+    }
   | { state: "waiting"; code: string; account: { name: string }; expiresAt: string };
 
 export const createPwaDeviceService = (hints: PwaPairingClaimHints = syncPairingClaimHints) => {
@@ -336,28 +357,48 @@ export const createPwaDeviceService = (hints: PwaPairingClaimHints = syncPairing
     return value;
   };
 
+  const startPairing = async (actor: PwaWebActor, targetUserId?: string) => {
+    const id = crypto.randomUUID();
+    const secret = pairingSecret.create();
+    const now = Date.now();
+    const claimUntil = new Date(now + limits.linkClaimSeconds * 1000);
+    const expiresAt = new Date(now + limits.pairingSeconds * 1000);
+    await sql.begin(async (tx) => {
+      const userId = targetUserId ?? actor.userId;
+      await tx`SELECT id FROM auth.users WHERE id IN (${actor.userId}::uuid, ${userId}::uuid) ORDER BY id FOR UPDATE`;
+      const account = await requireRecentWebSession(tx, actor, limits.recentSessionSeconds, (code) => fail(code, 403));
+      if (targetUserId) {
+        const [admin] = await tx`SELECT admin FROM auth.users WHERE id = ${actor.userId}::uuid`;
+        if (!admin?.admin) fail("FORBIDDEN", 403);
+      }
+      const target = targetUserId ? await lockUser(tx, targetUserId) : account;
+      if (!target) return fail("NOT_FOUND", 404);
+      if (targetUserId && (accountExpired(target) || !(await isAccountCategoryAllowed(target, tx)))) fail("ACCOUNT_BLOCKED", 403);
+      const [open] = await tx<{ count: number }[]>`
+          SELECT count(*)::int AS count FROM auth.pwa_pairings
+          WHERE user_id = ${userId}::uuid AND expires_at > now() AND state IN ('pending', 'claimed', 'awaiting_device', 'confirmed')
+        `;
+      if ((open?.count ?? 0) >= limits.pendingPerAccount) fail("LIMIT_REACHED", 429);
+      await tx`INSERT INTO auth.pwa_pairings (id, user_id, initiator_sid, initiator_user_id, auth_epoch, link_secret_hash, state, claim_until, expires_at)
+          VALUES (${id}::uuid, ${userId}::uuid, ${actor.sid}::uuid, ${targetUserId ? actor.userId : null}::uuid, ${target.auth_epoch}, ${pairingSecret.hash(secret)}, 'pending', ${claimUntil}, ${expiresAt})`;
+      await record(
+        tx,
+        "pairing.start",
+        { type: "pwa_pairing", id },
+        actor.userId,
+        targetUserId ? { targetUserId, administratorUserId: actor.userId } : {},
+      );
+    });
+    return { id, secret, claimUntil: iso(claimUntil), expiresAt: iso(expiresAt) };
+  };
+
   return {
     // ---------- Web side: the initiating web session ----------
 
-    startPairing: async (actor: PwaWebActor) => {
-      const id = crypto.randomUUID();
-      const secret = pairingSecret.create();
-      const now = Date.now();
-      const claimUntil = new Date(now + limits.linkClaimSeconds * 1000);
-      const expiresAt = new Date(now + limits.pairingSeconds * 1000);
-      await sql.begin(async (tx) => {
-        await lockUser(tx, actor.userId);
-        const account = await requireRecentWebSession(tx, actor, limits.recentSessionSeconds, (code) => fail(code, 403));
-        const [open] = await tx<{ count: number }[]>`
-          SELECT count(*)::int AS count FROM auth.pwa_pairings
-          WHERE user_id = ${actor.userId}::uuid AND expires_at > now() AND state IN ('pending', 'claimed', 'confirmed')
-        `;
-        if ((open?.count ?? 0) >= limits.pendingPerAccount) fail("LIMIT_REACHED", 429);
-        await tx`INSERT INTO auth.pwa_pairings (id, user_id, initiator_sid, auth_epoch, link_secret_hash, state, claim_until, expires_at)
-          VALUES (${id}::uuid, ${actor.userId}::uuid, ${actor.sid}::uuid, ${account.auth_epoch}, ${pairingSecret.hash(secret)}, 'pending', ${claimUntil}, ${expiresAt})`;
-        await record(tx, "pairing.start", { type: "pwa_pairing", id }, actor.userId);
-      });
-      return { id, secret, claimUntil: iso(claimUntil), expiresAt: iso(expiresAt) };
+    startPairing: (actor: PwaWebActor) => startPairing(actor),
+    startUserPairing: (actor: PwaWebActor & PwaDeviceAdministrator, userId: string) => {
+      if (!actor.admin) return fail("FORBIDDEN", 403);
+      return startPairing(actor, userId);
     },
 
     /** Never returns the code: the person types what the phone shows. */
@@ -365,12 +406,12 @@ export const createPwaDeviceService = (hints: PwaPairingClaimHints = syncPairing
       const read = async (validateInitiator = false) => {
         const [p] = await sql<(PairingRow & { current_epoch: string })[]>`
           SELECT p.*, u.auth_epoch AS current_epoch FROM auth.pwa_pairings p JOIN auth.users u ON u.id = p.user_id
-          WHERE p.id = ${id}::uuid AND p.user_id = ${actor.userId}::uuid AND p.initiator_sid = ${actor.sid}::uuid
+          WHERE p.id = ${id}::uuid AND COALESCE(p.initiator_user_id, p.user_id) = ${actor.userId}::uuid AND p.initiator_sid = ${actor.sid}::uuid
         `;
         if (!p) return fail("NOT_FOUND", 404);
         if (passed(p.expires_at) || p.current_epoch !== p.auth_epoch || (p.state === "pending" && passed(p.claim_until)))
           return fail("EXPIRED", 410);
-        if (validateInitiator && !(await initiatorValid(sql, p))) return fail("EXPIRED", 410);
+        if ((validateInitiator || p.initiator_user_id !== null) && !(await initiatorValid(sql, p))) return fail("EXPIRED", 410);
         return {
           state: p.state,
           claimUntil: iso(p.claim_until),
@@ -406,10 +447,10 @@ export const createPwaDeviceService = (hints: PwaPairingClaimHints = syncPairing
     confirmPairing: async (actor: PwaWebActor, id: string, code: string) => {
       type Outcome = { ok: true } | { ok: false; code: PwaErrorCode; status: PwaError["status"]; attemptsLeft?: number };
       const outcome = await sql.begin(async (tx): Promise<Outcome> => {
-        const user = await lockUser(tx, actor.userId);
-        const [p] = await tx<PairingRow[]>`
-          SELECT * FROM auth.pwa_pairings WHERE id = ${id}::uuid AND user_id = ${actor.userId}::uuid AND initiator_sid = ${actor.sid}::uuid FOR UPDATE
-        `;
+        const [snapshot] = await tx<PairingRow[]>`SELECT * FROM auth.pwa_pairings WHERE id = ${id}::uuid
+          AND COALESCE(initiator_user_id, user_id) = ${actor.userId}::uuid AND initiator_sid = ${actor.sid}::uuid`;
+        const user = snapshot ? await lockUser(tx, snapshot.user_id) : null;
+        const [p] = await tx<PairingRow[]>`SELECT * FROM auth.pwa_pairings WHERE id = ${snapshot?.id ?? null}::uuid FOR UPDATE`;
         if (!user || !p) return { ok: false, code: "NOT_FOUND", status: 404 };
         if (p.state === "cancelled" || passed(p.expires_at) || user.auth_epoch !== p.auth_epoch || !(await initiatorValid(tx, p)))
           return { ok: false, code: "EXPIRED", status: 410 };
@@ -426,8 +467,11 @@ export const createPwaDeviceService = (hints: PwaPairingClaimHints = syncPairing
           await tx`UPDATE auth.pwa_pairings SET failed_attempts = ${failed} WHERE id = ${p.id}::uuid`;
           return { ok: false, code: "WRONG_CODE", status: 409, attemptsLeft: limits.confirmAttempts - failed };
         }
-        await tx`UPDATE auth.pwa_pairings SET state = 'confirmed' WHERE id = ${p.id}::uuid`;
-        await record(tx, "pairing.confirm", { type: "pwa_pairing", id: p.id }, actor.userId, { platform: p.platform });
+        await tx`UPDATE auth.pwa_pairings SET state = ${p.initiator_user_id ? "awaiting_device" : "confirmed"} WHERE id = ${p.id}::uuid`;
+        await record(tx, "pairing.confirm", { type: "pwa_pairing", id: p.id }, actor.userId, {
+          platform: p.platform,
+          ...(p.initiator_user_id ? { targetUserId: p.user_id, administratorUserId: p.initiator_user_id } : {}),
+        });
         return { ok: true };
       });
       if (!outcome.ok) fail(outcome.code, outcome.status, outcome.attemptsLeft);
@@ -435,10 +479,10 @@ export const createPwaDeviceService = (hints: PwaPairingClaimHints = syncPairing
 
     cancelPairing: async (actor: PwaWebActor, id: string) => {
       await sql.begin(async (tx) => {
-        await lockUser(tx, actor.userId);
-        const [p] = await tx<PairingRow[]>`
-          SELECT * FROM auth.pwa_pairings WHERE id = ${id}::uuid AND user_id = ${actor.userId}::uuid AND initiator_sid = ${actor.sid}::uuid FOR UPDATE
-        `;
+        const [snapshot] = await tx<PairingRow[]>`SELECT * FROM auth.pwa_pairings WHERE id = ${id}::uuid
+          AND COALESCE(initiator_user_id, user_id) = ${actor.userId}::uuid AND initiator_sid = ${actor.sid}::uuid`;
+        if (snapshot) await lockUser(tx, snapshot.user_id);
+        const [p] = await tx<PairingRow[]>`SELECT * FROM auth.pwa_pairings WHERE id = ${snapshot?.id ?? null}::uuid FOR UPDATE`;
         if (!p) return fail("NOT_FOUND", 404);
         if (p.state === "completed") return fail("CONFLICT", 409);
         if (p.state === "cancelled") return;
@@ -517,6 +561,28 @@ export const createPwaDeviceService = (hints: PwaPairingClaimHints = syncPairing
         SELECT * FROM auth.pwa_pairings WHERE completion_secret_hash = ${pairingSecret.hash(input.completionSecret)}
       `;
       if (!snapshot || snapshot.state === "cancelled" || passed(snapshot.expires_at)) return fail("EXPIRED", 410);
+      if (snapshot.state === "rejected") return { state: "rejected" };
+      if (snapshot.state === "awaiting_device") {
+        return sql.begin(async (tx) => {
+          const user = await lockUser(tx, snapshot.user_id);
+          const [p] = await tx<PairingRow[]>`SELECT * FROM auth.pwa_pairings WHERE id = ${snapshot.id}::uuid FOR UPDATE`;
+          if (!user || !p || passed(p.expires_at) || user.auth_epoch !== p.auth_epoch || !(await initiatorValid(tx, p)))
+            return fail("EXPIRED", 410);
+          if (p.state !== "awaiting_device" || !p.initiator_user_id) return fail("CONFLICT", 409);
+          if (accountExpired(user) || !(await isAccountCategoryAllowed(user, tx))) return fail("ACCOUNT_BLOCKED", 403);
+          const [admin] = await tx<UserRow[]>`SELECT * FROM auth.users WHERE id = ${p.initiator_user_id}::uuid`;
+          if (!admin) return fail("EXPIRED", 410);
+          const confirmationToken = pairingSecret.create();
+          await tx`UPDATE auth.pwa_pairings SET device_confirmation_hash = ${pairingSecret.hash(confirmationToken)} WHERE id = ${p.id}::uuid`;
+          return {
+            state: "confirmation_required" as const,
+            account: { name: accountName(user) },
+            administrator: { name: accountName(admin) },
+            confirmationToken,
+            expiresAt: iso(p.expires_at),
+          };
+        });
+      }
       if (snapshot.state === "claimed") {
         const [user] = await sql<UserRow[]>`SELECT * FROM auth.users WHERE id = ${snapshot.user_id}::uuid`;
         // Signing out on the web, or everywhere, voids the pairing at once.
@@ -570,12 +636,17 @@ export const createPwaDeviceService = (hints: PwaPairingClaimHints = syncPairing
         // An unusually long locale tag is dropped; the notice then uses the operator's locale.
         const locale = input.locale && input.locale.length <= 35 ? input.locale : null;
         const [device] = await tx<DeviceRow[]>`
-          INSERT INTO auth.pwa_devices (id, user_id, name, platform, auth_epoch, secret_hash, rotated_at, locale)
-          VALUES (${deviceId}::uuid, ${user.id}::uuid, ${p.device_name}, ${p.platform}, ${user.auth_epoch}, ${pairingSecret.hash(secret)}, now(), ${locale})
+          INSERT INTO auth.pwa_devices (id, user_id, name, platform, auth_epoch, secret_hash, rotated_at, locale, paired_by_user_id, paired_by_name)
+          VALUES (${deviceId}::uuid, ${user.id}::uuid, ${p.device_name}, ${p.platform}, ${user.auth_epoch}, ${pairingSecret.hash(secret)}, now(), ${locale}, ${p.initiator_user_id}::uuid,
+            (SELECT COALESCE(NULLIF(trim(display_name), ''), uid) FROM auth.users WHERE id = ${p.initiator_user_id}::uuid))
           RETURNING *`;
         await issue(user.id, appSession(deviceId));
         await tx`UPDATE auth.pwa_pairings SET state = 'completed', device_id = ${deviceId}::uuid WHERE id = ${p.id}::uuid`;
-        await record(tx, "device.enroll", { type: "pwa_device", id: deviceId }, user.id, { platform: p.platform, pairingId: p.id });
+        await record(tx, "device.enroll", { type: "pwa_device", id: deviceId }, p.initiator_user_id ?? user.id, {
+          platform: p.platform,
+          pairingId: p.id,
+          ...(p.initiator_user_id ? { targetUserId: user.id, administratorUserId: p.initiator_user_id } : {}),
+        });
         return { kind: "issued", deviceKey: `${deviceId}.${secret}`, notice: pairedNotice(device!, p.device_name) };
       });
       const platform = snapshot.platform ?? "other";
@@ -585,6 +656,45 @@ export const createPwaDeviceService = (hints: PwaPairingClaimHints = syncPairing
       return { state: "paired", credentials: { deviceKey: value.deviceKey, sessionToken: token }, platform };
     },
 
+    decidePairing: async (
+      completionSecret: string | null | undefined,
+      input: { confirmationToken: string; decision: "confirm" | "reject" },
+    ) => {
+      if (!completionSecret) return fail("EXPIRED", 410);
+      const [snapshot] = await sql<
+        PairingRow[]
+      >`SELECT * FROM auth.pwa_pairings WHERE completion_secret_hash = ${pairingSecret.hash(completionSecret)}`;
+      if (!snapshot) return fail("EXPIRED", 410);
+      await sql.begin(async (tx) => {
+        const user = await lockUser(tx, snapshot.user_id);
+        const [p] = await tx<PairingRow[]>`SELECT * FROM auth.pwa_pairings WHERE id = ${snapshot.id}::uuid FOR UPDATE`;
+        if (
+          !user ||
+          !p ||
+          !p.initiator_user_id ||
+          passed(p.expires_at) ||
+          user.auth_epoch !== p.auth_epoch ||
+          !(await initiatorValid(tx, p))
+        )
+          return fail("EXPIRED", 410);
+        if (!p.device_confirmation_hash || !pairingSecret.matches(input.confirmationToken, p.device_confirmation_hash))
+          return fail("FORBIDDEN", 403);
+        const next = input.decision === "confirm" ? "confirmed" : "rejected";
+        if (p.state === next || (next === "confirmed" && p.state === "completed")) return;
+        if (p.state !== "awaiting_device") return fail("CONFLICT", 409);
+        if (accountExpired(user) || !(await isAccountCategoryAllowed(user, tx))) return fail("ACCOUNT_BLOCKED", 403);
+        await tx`UPDATE auth.pwa_pairings SET state = ${next} WHERE id = ${p.id}::uuid`;
+        await record(
+          tx,
+          input.decision === "confirm" ? "pairing.device_confirm" : "pairing.reject",
+          { type: "pwa_pairing", id: p.id },
+          user.id,
+          { targetUserId: user.id, administratorUserId: p.initiator_user_id },
+        );
+      });
+      hints.publish(snapshot.id);
+    },
+
     /** Renewal with device-key rotation; `launch` and `renew` share it. */
     renew: renewal,
 

package/src/services/service-account-credentials.ts

@@ -491,8 +491,10 @@ export const createStandaloneApiToken = async (params: {
   name: string;
   expiresAt?: string | null;
   scopes?: string[];
+  access?: "full" | "models";
 }): Promise<Result<{ credential: ServiceAccountCredential; token: string }>> => {
-  if (params.scopes?.includes(AI_INFERENCE_SCOPE)) return fail(err.badInput("ai:inference is reserved for models-only personal API keys"));
+  if (params.scopes?.includes(AI_INFERENCE_SCOPE) || (params.access === "models" && params.scopes?.length))
+    return fail(err.badInput("Models-only access cannot be combined with general credential scopes"));
   const serviceAccount = await serviceAccounts.get({ id: params.serviceAccountId });
   if (!serviceAccount || !isStandaloneServiceAccountKind(serviceAccount.kind)) return fail(err.notFound("Service account"));
   if (serviceAccount.status !== "active") return fail(err.badInput("Service account is disabled"));
@@ -503,7 +505,7 @@ export const createStandaloneApiToken = async (params: {
       name: params.name,
       expiresAt: params.expiresAt,
       createdBy: params.actor.id,
-      scopes: params.scopes,
+      scopes: params.access === "models" ? [AI_INFERENCE_SCOPE] : params.scopes,
     });
 
     return audit.recordResult({
@@ -514,6 +516,7 @@ export const createStandaloneApiToken = async (params: {
         serviceAccountId: serviceAccount.id,
         kind: "api_token",
         serviceAccountKind: serviceAccount.kind,
+        access: params.access ?? "full",
         expiresAt: params.expiresAt ?? null,
       },
       result,

package/src/services/session/index.ts

@@ -31,6 +31,14 @@ import { loadJwtSession, loadJwtSessionIdentity } from "./user";
 
 const log = logger("auth:session");
 
+/** A browser already signed in must prove that same account before continuing. */
+export class SessionAccountMismatchError extends Error {
+  constructor() {
+    super("Sign in with the account already open in this browser.");
+    this.name = "SessionAccountMismatchError";
+  }
+}
+
 export type SessionKind = "web" | "app";
 
 export type SessionData = {
@@ -585,6 +593,12 @@ export const session = {
       appDeviceId?: string;
     },
   ): Promise<string> => {
+    if (c.req.header("X-Cloud-Reauthenticate") === "1") {
+      const currentToken = session.getWebToken(c);
+      const current = currentToken ? await session.authenticateRequest(c, currentToken) : null;
+      if (!current || current.user.id !== userId) throw new SessionAccountMismatchError();
+    }
+
     const expiryHours = await settings.get<number>("user.session.expiry_hours");
     if (!Number.isFinite(expiryHours) || expiryHours < 1) throw new Error("user.session.expiry_hours must be a positive number");
     const ttlSeconds = Math.floor(expiryHours * 60 * 60);

package/src/services/settings/core-settings.ts

@@ -30,6 +30,76 @@ const IPA_ACCOUNT_TRANSITION_OPTIONS = [
 ] as const;
 
 export const CORE_SETTINGS = {
+  "storage.endpoint": {
+    kind: "url",
+    label: "Garage S3 endpoint",
+    description: "Garage S3 API origin, such as https://s3.example.org.",
+    default: "",
+    presentation: {
+      translations: { de: { label: "Garage-S3-Endpunkt", description: "Origin der Garage-S3-API, etwa https://s3.example.org." } },
+    },
+  },
+  "storage.region": {
+    kind: "string",
+    label: "Signing region",
+    description: "Must match the Garage S3 region.",
+    default: "garage",
+    presentation: { translations: { de: { label: "Signaturregion", description: "Muss der S3-Region von Garage entsprechen." } } },
+  },
+  "storage.bucket": {
+    kind: "string",
+    label: "Bucket",
+    description: "One private Garage bucket for application objects; keep website mode disabled.",
+    default: "",
+    presentation: {
+      translations: {
+        de: { label: "Bucket", description: "Ein privater Garage-Bucket für App-Dateien; Website-Modus ausgeschaltet lassen." },
+      },
+    },
+  },
+  "storage.access_key_id": {
+    kind: "secret",
+    label: "Access key ID",
+    description: "Installation-wide key with read and write access to the configured bucket.",
+    default: "",
+    presentation: {
+      translations: {
+        de: {
+          label: "Access-Key-ID",
+          description: "Installationsweiter Schlüssel mit Lese- und Schreibzugriff auf den eingetragenen Bucket.",
+        },
+      },
+    },
+  },
+  "storage.secret_access_key": {
+    kind: "secret",
+    label: "Secret access key",
+    description: "Secret belonging to the installation-wide Garage key.",
+    default: "",
+    presentation: {
+      translations: {
+        de: { label: "Geheimer Zugriffsschlüssel", description: "Geheimer Teil des installationsweiten Garage-Schlüssels." },
+      },
+    },
+  },
+  "storage.max_object_bytes": {
+    kind: "number",
+    label: "Maximum object size (bytes)",
+    description: "Default 32 MiB covers 25 MB documents and 1–5 MB images. Budget memory for concurrent operations.",
+    default: 32 * 1024 ** 2,
+    min: 1,
+    max: 5 * 1024 ** 3,
+    integer: true,
+    presentation: {
+      translations: {
+        de: {
+          label: "Maximale Objektgröße (Bytes)",
+          description: "32 MiB reichen für Dokumente bis 25 MB und Bilder von 1–5 MB. Speicher für gleichzeitige Vorgänge einplanen.",
+        },
+      },
+    },
+  },
+
   "outgoing_mail.content_retention_days": {
     kind: "number",
     label: "Mail content retention (days)",
@@ -69,6 +139,22 @@ export const CORE_SETTINGS = {
       "Trusted HTTPS origin of the authenticator, used for app installation and pairing links. Changing this origin requires reviewing existing devices; never use a wildcard.",
     default: "https://cloud-login.pwa.k2b.dev",
   },
+  "user.app_approval.label": {
+    kind: "string",
+    label: "Name in Cloud Login",
+    description:
+      "Suggested label for new Cloud Login connections. Empty uses the application display name. People can change it; existing connections keep their names.",
+    default: "",
+    presentation: {
+      translations: {
+        de: {
+          label: "Name in Cloud Login",
+          description:
+            "Namensvorschlag für neue Cloud-Login-Verbindungen. Leer übernimmt den Anzeigenamen der Anwendung. Bestehende Verbindungen behalten ihren Namen; Nutzer können den Vorschlag ändern.",
+        },
+      },
+    },
+  },
   "user.app_approval.admin_pairing": {
     kind: "boolean",
     label: "Allow administrator-assisted pairing",
@@ -299,48 +385,6 @@ export const CORE_SETTINGS = {
     default: false,
     description: "Enable Cloud AI features including personal conversations, Assistant, and app Capabilities.",
   },
-  "ai.default_model_id": {
-    kind: "string",
-    label: "Default Model ID",
-    default: "",
-    description: "Model profile id used when an app asks for the platform default AI model.",
-    placeholder: "e.g. openrouter-fast",
-  },
-  "ai.model_profiles_json": {
-    kind: "text",
-    label: "Model Profiles",
-    default: "[]",
-    description: "JSON array of model profiles. Provider API keys are stored on the profile they belong to.",
-    placeholder:
-      '[{"id":"openrouter-fast","label":"OpenRouter Fast","provider":"openrouter","model":"openai/gpt-4.1-mini","enabled":true,"dataBoundary":"hosted","capabilities":["streaming"],"apiKey":"sk-or-..."}]',
-  },
-  "ai.background_model_id": {
-    kind: "string",
-    label: "Background Model ID",
-    default: "",
-    description: "Model profile id used for background AI jobs. Empty = platform default model.",
-    placeholder: "e.g. openrouter-fast",
-  },
-  "ai.audio_model_id": {
-    kind: "string",
-    label: "Audio Model ID",
-    default: "",
-    description: "Audio transcription model profile for dictation and audio files. Empty disables transcription.",
-  },
-  "ai.vision_model_id": {
-    kind: "string",
-    label: "Vision Model ID",
-    default: "",
-    description: "Vision-capable model profile used by the view_image tool. Empty disables the tool fallback.",
-    placeholder: "e.g. openrouter-vision",
-  },
-  "ai.workflow_model_id": {
-    kind: "string",
-    label: "Workflow Model ID",
-    default: "",
-    description: "Model profile id used for AI workflow actions. Empty = background model, then platform default.",
-    placeholder: "e.g. openrouter-fast",
-  },
   "ai.enrich_cron": {
     kind: "cron",
     label: "Chat Enrichment Schedule",
@@ -428,20 +472,20 @@ export const CORE_SETTINGS = {
     label: "OpenAI-compatible API",
     default: false,
     description:
-      "Let people create API keys with the access “AI models only” and call the Assistant models they may use. Checked on every request: turning this off stops existing keys too. Models without reference prices have no usage limit; only the rate limit and the concurrent request limit protect them.",
+      "Let people create personal models-only API keys and administrators issue them to standalone accounts and agents. Keys use only models granted to their account. Checked on every request: turning this off stops existing keys too. Models without reference prices have no usage limit; only the rate limit and the concurrent request limit protect them.",
   },
   // Default 4: one process runs at most 8 chat turns at once (AI_TURN_WORKER_CONCURRENCY in ai/runtime.ts), and this
-  // synchronous API bypasses that queue, so one person may hold at most half of it. Typical clients need 1-2 (one
+  // synchronous API bypasses that queue, so one account may hold at most half of it. Typical clients need 1-2 (one
   // request after another plus a connection test); 4 leaves room for a second client without letting a script in a
   // loop crowd out everyone else. Operators with more provider capacity raise it.
   "ai.openai_api_max_concurrent_requests": {
     kind: "number",
-    label: "OpenAI API concurrent requests per person",
+    label: "OpenAI API concurrent requests per account",
     integer: true,
     min: 1,
     max: 64,
     default: 4,
-    description: "Maximum simultaneous OpenAI-compatible API requests per person across all Cloud instances.",
+    description: "Maximum simultaneous OpenAI-compatible API requests per account across all Cloud instances.",
   },
   // ── PDF rendering ─────────────────────────────────────────────────────
   "gotenberg.url": {
@@ -812,7 +856,7 @@ export const CORE_SETTINGS = {
     label: "Requests Per Second",
     default: 60,
     min: 1,
-    description: "Maximum API requests per second per IP address",
+    description: "Maximum API and public storage requests per second per IP address, with separate budgets",
   },
 
   // ── Command line ────────────────────────────────────────────────────────

package/src/services/settings/index.ts

@@ -209,6 +209,9 @@ export { invalidateSettingsCache, readStates, SettingUnreadableError } from "./s
 export async function getAll(locale?: string): Promise<SettingEntry[]> {
   const allKeys = SETTINGS.map((def) => def.key);
   const values = await readStates(allKeys);
+  const versions = await sql<
+    { key: string; updated_at: Date; updated_by: string | null; name: string | null }[]
+  >`SELECT e.key,e.updated_at,e.updated_by,COALESCE(NULLIF(u.display_name,''),u.uid) AS name FROM settings.entries e LEFT JOIN auth.users u ON u.id=e.updated_by`;
 
   return SETTINGS.map((def) => {
     const presentation = resolveSettingPresentation(def, locale);
@@ -218,6 +221,11 @@ export async function getAll(locale?: string): Promise<SettingEntry[]> {
     const resetValue = envFallback ?? def.default;
 
     return {
+      updatedAt: versions.find((row) => row.key === def.key)?.updated_at.toISOString() ?? null,
+      updatedBy: (() => {
+        const row = versions.find((row) => row.key === def.key);
+        return row?.updated_by ? { id: row.updated_by, name: row.name ?? row.updated_by } : null;
+      })(),
       key: def.key,
       label: presentation.label,
       kind: def.kind,

package/src/services/settings/versions.ts

@@ -0,0 +1,26 @@
+import { sql } from "bun";
+import { ConfigConflict } from "../config-conflict";
+import { SETTINGS_MAP } from "./defaults";
+import { readKeyState } from "./store";
+
+/** Lock missing keys as well as existing rows, so first writes have the same conflict guarantee. */
+export const assertSettingVersions = async (expected: Record<string, string | null>, db = sql): Promise<void> => {
+  for (const key of Object.keys(expected).sort()) {
+    await db`SELECT pg_advisory_xact_lock(hashtext(${`settings:${key}`}))`;
+    const [row] = await db<
+      { updated_at: Date; updated_by: string | null }[]
+    >`SELECT updated_at,updated_by FROM settings.entries WHERE key=${key} FOR UPDATE`;
+    if ((row?.updated_at.toISOString() ?? null) === expected[key]) continue;
+    const [who] = row?.updated_by
+      ? await db<
+          { id: string; name: string }[]
+        >`SELECT id,COALESCE(NULLIF(display_name,''),uid) AS name FROM auth.users WHERE id=${row.updated_by}::uuid`
+      : [];
+    throw new ConfigConflict(
+      SETTINGS_MAP.has(key) && SETTINGS_MAP.get(key)?.kind !== "secret" ? (await readKeyState(key, db)).value : "",
+      who ?? null,
+      row?.updated_at.toISOString() ?? new Date(0).toISOString(),
+      key,
+    );
+  }
+};