@k2b/cloud 0.6.0 → 0.8.0

package/src/services/providers/local/users.ts

@@ -2,6 +2,7 @@ import { sql } from "bun";
 import type { MutationResult, UserProfile } from "../../../contracts/shared";
 import { isAccountCategoryAllowed } from "../../account-category-policy";
 import { writeDeletedAccountAudit } from "../../account-lifecycle/audit";
+import { emailAlreadyUsed, findAccountsByEmail, lockAccountEmail, normalizeAccountEmail } from "../../accounts/email-write";
 import { resolveStoredAdminState } from "../../accounts/model";
 import { writeLocalAccount } from "../../accounts/posix";
 import type { AuditActor } from "../../audit";
@@ -31,6 +32,7 @@ export const create = async (params: {
   admin?: boolean;
   actor?: AuditActor;
 }): Promise<MutationResult<{ id: string }>> => {
+  const email = normalizeAccountEmail(params.data.email);
   const uid = await createLocalUid();
   const admin = resolveStoredAdminState({
     provider: "local",
@@ -42,6 +44,8 @@ export const create = async (params: {
     return await writeLocalAccount(async (tx) => {
       if (!(await isAccountCategoryAllowed({ provider: "local", profile: params.profile }, tx)))
         return { ok: false, error: "This account category is disabled. Contact an administrator.", status: 403 };
+      await lockAccountEmail(tx, email);
+      if ((await findAccountsByEmail(tx, email)).length > 0) return emailAlreadyUsed();
       const rows = await tx<{ id: string }[]>`
       INSERT INTO auth.users (
         uid,
@@ -58,7 +62,7 @@ export const create = async (params: {
         ${uid},
         'local',
         ${params.profile},
-        ${params.data.email},
+        ${email},
         ${params.data.givenname ?? ""},
         ${params.data.sn ?? ""},
         ${params.data.displayName ?? ""},
@@ -118,21 +122,26 @@ export const update = async (params: {
     mail?: string;
   };
 }): Promise<MutationResult<void>> => {
-  const existingRows = await sql<DbRow[]>`SELECT id FROM auth.users WHERE id = ${params.id}::uuid AND provider = 'local'`;
-  if (existingRows.length === 0) {
-    return { ok: false, error: "Local user not found", status: 404 };
-  }
-
-  await sql`
-    UPDATE auth.users
-    SET given_name = CASE WHEN ${params.data.givenname !== undefined} THEN ${params.data.givenname ?? ""} ELSE given_name END,
-        sn = CASE WHEN ${params.data.sn !== undefined} THEN ${params.data.sn ?? ""} ELSE sn END,
-        display_name = CASE WHEN ${params.data.displayName !== undefined} THEN ${params.data.displayName ?? ""} ELSE display_name END,
-        mail = CASE WHEN ${params.data.mail !== undefined} THEN ${params.data.mail ?? null} ELSE mail END
-    WHERE id = ${params.id}::uuid
-  `;
-
-  return { ok: true, data: undefined };
+  return sql.begin(async (tx) => {
+    if (params.data.mail !== undefined) await lockAccountEmail(tx, params.data.mail);
+    else await tx`LOCK TABLE auth.users IN ROW EXCLUSIVE MODE`;
+    const [existing] = await tx<{ mail: string | null }[]>`
+      SELECT mail FROM auth.users WHERE id = ${params.id}::uuid AND provider = 'local' FOR UPDATE
+    `;
+    if (!existing) return { ok: false, error: "Local user not found", status: 404 };
+    const email = params.data.mail === undefined ? undefined : normalizeAccountEmail(params.data.mail);
+    const changed = email !== undefined && email !== normalizeAccountEmail(existing.mail ?? "");
+    if (changed && email && (await findAccountsByEmail(tx, email)).some((row) => row.id !== params.id)) return emailAlreadyUsed();
+    await tx`
+      UPDATE auth.users
+      SET given_name = CASE WHEN ${params.data.givenname !== undefined} THEN ${params.data.givenname ?? ""} ELSE given_name END,
+          sn = CASE WHEN ${params.data.sn !== undefined} THEN ${params.data.sn ?? ""} ELSE sn END,
+          display_name = CASE WHEN ${params.data.displayName !== undefined} THEN ${params.data.displayName ?? ""} ELSE display_name END,
+          mail = CASE WHEN ${changed} THEN ${email || null} ELSE mail END
+      WHERE id = ${params.id}::uuid
+    `;
+    return { ok: true, data: undefined };
+  });
 };
 
 export const setProfile = async (params: {

package/src/services/public-http.ts

@@ -0,0 +1,101 @@
+import type { ClientRequest, IncomingMessage } from "node:http";
+import { type RequestOptions, request } from "node:https";
+import { resolvePublicNetworkAddresses } from "./network-security";
+
+export type PublicHttpInput = {
+  url: string;
+  method: string;
+  headers: Record<string, string>;
+  body?: Uint8Array;
+  maxBytes: number;
+  signal: AbortSignal;
+};
+
+/** One public HTTPS request, pinned to a validated address. Never redirects or retries.
+ * Callers own credential authorization, request budgets and response disclosure. */
+export async function requestPublicHttps(
+  input: PublicHttpInput,
+  dependencies: {
+    resolve: typeof resolvePublicNetworkAddresses;
+    request: (options: RequestOptions, callback: (response: IncomingMessage) => void) => ClientRequest;
+  } = { resolve: resolvePublicNetworkAddresses, request },
+) {
+  if (!Number.isSafeInteger(input.maxBytes) || input.maxBytes < 0) throw new Error("INVALID_BYTE_LIMIT");
+  const url = new URL(input.url);
+  if (url.protocol !== "https:" || url.username || url.password) throw new Error("HTTPS_REQUIRED");
+  input.signal.throwIfAborted();
+  let cancelLookup = () => {};
+  const addresses = await Promise.race([
+    dependencies.resolve(url.hostname),
+    new Promise<never>((_, reject) => {
+      cancelLookup = () => reject(new Error("HTTP_CANCELLED"));
+      input.signal.addEventListener("abort", cancelLookup, { once: true });
+      if (input.signal.aborted) cancelLookup();
+    }),
+  ]).finally(() => input.signal.removeEventListener("abort", cancelLookup));
+  input.signal.throwIfAborted();
+  const target = addresses[0]!;
+  return new Promise<{ status: number; headers: Record<string, string>; body: Uint8Array }>((resolve, reject) => {
+    let settled = false;
+    const fail = () => finish(undefined);
+    const finish = (value?: { status: number; headers: Record<string, string>; body: Uint8Array }) => {
+      if (settled) return;
+      settled = true;
+      input.signal.removeEventListener("abort", abort);
+      if (value) resolve(value);
+      else reject(new Error("HTTP_FAILED"));
+    };
+    const outgoing = dependencies.request(
+      {
+        hostname: target.address,
+        family: target.family,
+        port: url.port || 443,
+        servername: url.hostname.replace(/^\[|\]$/g, ""),
+        rejectUnauthorized: true,
+        path: url.pathname + url.search,
+        method: input.method,
+        headers: { ...input.headers, host: url.host, "accept-encoding": "identity" },
+      },
+      (incoming) => {
+        const status = incoming.statusCode ?? 0;
+        const headers: Record<string, string> = {};
+        for (const name of ["content-type", "retry-after", "etag", "last-modified"]) {
+          const value = incoming.headers[name];
+          if (typeof value === "string") headers[name] = value;
+        }
+        // A redirect never receives a second request or exposes a Location token.
+        if (status >= 300 && status < 400 && status !== 304) {
+          incoming.destroy();
+          finish({ status, headers, body: new Uint8Array() });
+          return;
+        }
+        if (incoming.headers["content-encoding"] && incoming.headers["content-encoding"] !== "identity") {
+          incoming.destroy();
+          fail();
+          return;
+        }
+        const chunks: Uint8Array[] = [];
+        let bytes = 0;
+        incoming.on("data", (chunk: Buffer) => {
+          if (settled) return;
+          bytes += chunk.byteLength;
+          if (bytes > input.maxBytes) {
+            incoming.destroy();
+            fail();
+          } else chunks.push(chunk);
+        });
+        incoming.on("end", () => finish({ status, headers, body: Buffer.concat(chunks, bytes) }));
+        incoming.on("error", fail);
+        incoming.on("aborted", fail);
+      },
+    );
+    const abort = () => {
+      outgoing.destroy();
+      fail();
+    };
+    outgoing.on("error", fail); // Never expose errors containing injected headers.
+    input.signal.addEventListener("abort", abort, { once: true });
+    if (input.signal.aborted) abort();
+    else outgoing.end(input.body);
+  });
+}

package/src/services/rail-shortcuts.ts

@@ -0,0 +1,95 @@
+import { type SQL, sql } from "bun";
+import { type RailAdminInput, RailAdminInputSchema, RailAdminSchema, type RailAdminState } from "../contracts/rail-admin";
+import { RailShortcutSchema } from "../contracts/rail-preferences";
+import { hasRole, type User } from "../contracts/shared";
+import { buildAccessPrincipalCondition, createAccess } from "../server/services/access";
+
+export class RailAdminError extends Error {
+  constructor(
+    public status: 400 | 403 | 409,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+const requireAdmin = (actor: User | undefined) => {
+  if (!actor || !hasRole(actor, "admin")) throw new RailAdminError(403, "Administrator access required");
+};
+
+export const createRailShortcutsService = (db: SQL = sql) => {
+  const list = async (query: SQL = db): Promise<RailAdminState> => {
+    const [state] = await query<{ revision: number }[]>`SELECT revision FROM auth.rail_state WHERE singleton`;
+    const rows = await query<{ shortcut: unknown; access: unknown }[]>`
+      SELECT r.shortcut, COALESCE((
+        SELECT jsonb_agg(jsonb_build_object(
+          'id', a.id, 'permission', a.permission, 'createdAt', a.created_at,
+          'principal', CASE WHEN a.user_id IS NOT NULL THEN jsonb_build_object('type', 'user', 'userId', a.user_id)
+            WHEN a.group_id IS NOT NULL THEN jsonb_build_object('type', 'group', 'groupId', a.group_id)
+            ELSE jsonb_build_object('type', 'authenticated') END,
+          'displayName', COALESCE(u.display_name, g.name, '')
+        ) ORDER BY a.created_at, a.id)
+        FROM auth.rail_shortcut_access ra JOIN auth.access a ON a.id = ra.access_id
+        LEFT JOIN auth.users u ON u.id = a.user_id LEFT JOIN auth.groups g ON g.id = a.group_id
+        WHERE ra.shortcut_id = r.id
+      ), '[]'::jsonb) AS access
+      FROM auth.rail_shortcuts r ORDER BY r.position, r.id
+    `;
+    return RailAdminSchema.parse({ revision: state?.revision ?? 0, entries: rows });
+  };
+  return {
+    async invalidateCache(actor: User | undefined) {
+      requireAdmin(actor);
+      // One generation switch invalidates every user, including concurrent old refills.
+      // Keep the configuration revision unchanged so open editors remain valid.
+      await db`UPDATE auth.rail_state SET cache_version = gen_random_uuid() WHERE singleton`;
+    },
+    async list(actor: User | undefined) {
+      requireAdmin(actor);
+      return list();
+    },
+    async save(actor: User | undefined, input: RailAdminInput) {
+      requireAdmin(actor);
+      const value = RailAdminInputSchema.parse(input);
+      return db.begin(async (tx) => {
+        const [state] = await tx<{ revision: number }[]>`SELECT revision FROM auth.rail_state WHERE singleton FOR UPDATE`;
+        if (state?.revision !== value.revision) throw new RailAdminError(409, "App bar configuration changed. Reload before saving.");
+        await tx`DELETE FROM auth.access WHERE id IN (SELECT access_id FROM auth.rail_shortcut_access)`;
+        await tx`DELETE FROM auth.rail_shortcuts`;
+        for (const [position, entry] of value.entries.entries()) {
+          await tx`INSERT INTO auth.rail_shortcuts(id, position, shortcut)
+            VALUES (${entry.shortcut.id}, ${position}, (${JSON.stringify(entry.shortcut)}::text)::jsonb)`;
+          const seen = new Set<string>();
+          for (const access of entry.access) {
+            const key = JSON.stringify(access.principal);
+            if (seen.has(key)) continue;
+            seen.add(key);
+            const created = await createAccess({ principal: access.principal, permission: "read" }, tx);
+            if (!created.ok) throw new RailAdminError(400, "A selected user or group no longer exists.");
+            await tx`INSERT INTO auth.rail_shortcut_access(shortcut_id, access_id) VALUES (${entry.shortcut.id}, ${created.data.id}::uuid)`;
+          }
+        }
+        await tx`UPDATE auth.rail_state SET revision = revision + 1 WHERE singleton`;
+        return list(tx);
+      });
+    },
+    async forUser(userId: string) {
+      const match = buildAccessPrincipalCondition({
+        subject: { type: "user", userId },
+        columns: {
+          userId: db`a.user_id`,
+          groupId: db`a.group_id`,
+          serviceAccountId: db`a.service_account_id`,
+          authenticatedOnly: db`a.authenticated_only`,
+        },
+      });
+      const rows = await db<{ shortcut: unknown }[]>`
+        SELECT r.shortcut FROM auth.rail_shortcuts r WHERE EXISTS (
+          SELECT 1 FROM auth.rail_shortcut_access ra JOIN auth.access a ON a.id = ra.access_id
+          WHERE ra.shortcut_id = r.id AND a.permission = 'read' AND ${match}
+        ) ORDER BY r.position, r.id
+      `;
+      return rows.map((row) => RailShortcutSchema.parse(row.shortcut));
+    },
+  };
+};
+export const railShortcuts = createRailShortcutsService();

package/src/services/rail-snapshot.ts

@@ -0,0 +1,53 @@
+import { type RailSnapshot, RailSnapshotSchema } from "../contracts/rail-preferences";
+import type { User } from "../contracts/shared";
+import { railPreferences } from "./rail-preferences";
+import { railShortcuts } from "./rail-shortcuts";
+import { requestCacheRedis } from "./request-cache-redis";
+
+// Private request metadata: never serialized into the public User contract.
+const versions = new WeakMap<User, string>();
+export const setRailCacheVersion = (user: User, version: unknown) => {
+  if (typeof version === "string") versions.set(user, version);
+};
+
+/** TTL only bounds unused generations; freshness comes from the current identity query. */
+const CACHE_TTL_SECONDS = 300;
+export const createRailSnapshotReader =
+  (
+    load: (userId: string) => Promise<RailSnapshot>,
+    cache: { get(key: string): Promise<string | null>; set(key: string, value: string): Promise<unknown> },
+  ) =>
+  async (user: User): Promise<RailSnapshot> => {
+    const version = versions.get(user);
+    if (!version) return load(user.id);
+    const key = `appglobalcache:user:${user.id}:rail:v1:${version}`;
+    try {
+      const cached = await cache.get(key);
+      if (cached !== null) {
+        const parsed = RailSnapshotSchema.safeParse(JSON.parse(cached));
+        if (parsed.success) return parsed.data;
+      }
+    } catch {
+      /* Valkey is an optimization; authoritative reads still work. */
+    }
+    const value = await load(user.id);
+    // A concurrent mutation changes the generation. A late refill remains under
+    // this request's old key and cannot poison a subsequent request's snapshot.
+    try {
+      await cache.set(key, JSON.stringify(value));
+    } catch {
+      /* Retry on a later read. */
+    }
+    return value;
+  };
+
+export const readRailSnapshot = createRailSnapshotReader(
+  async (userId) => {
+    const [personal, managedShortcuts] = await Promise.all([railPreferences.get(userId), railShortcuts.forUser(userId)]);
+    return { ...personal, managedShortcuts };
+  },
+  {
+    get: async (key) => (await requestCacheRedis()).get(key),
+    set: async (key, value) => (await requestCacheRedis()).set(key, value, "EX", CACHE_TTL_SECONDS),
+  },
+);

package/src/services/request-cache-redis.ts

@@ -0,0 +1,29 @@
+import { RedisClient } from "bun";
+import { env } from "../config/env";
+
+// Cache commands must not queue across a disconnect: delayed fills/invalidations
+// are not useful, and reads must be able to fall back to Postgres. Keep this
+// connection separate from sessions, rate limits and other Redis consumers.
+let client: RedisClient | undefined;
+let initialConnection: Promise<void> | undefined;
+let reconnecting: Promise<void> | undefined;
+
+export const requestCacheRedis = async (): Promise<RedisClient> => {
+  if (!client) {
+    client = new RedisClient(env.REDIS_URL, { enableOfflineQueue: false });
+    // The first operation waits for normal connection establishment (Bun's
+    // connection timeout applies). Later disconnected operations fail promptly.
+    initialConnection = client.connect().catch(() => {});
+  }
+  await initialConnection;
+  if (!client.connected && !reconnecting) {
+    // Bun reconnects automatically; also allow recovery after its retry limit.
+    reconnecting = client
+      .connect()
+      .catch(() => {})
+      .finally(() => {
+        reconnecting = undefined;
+      });
+  }
+  return client;
+};

package/src/services/session/index.ts

@@ -11,7 +11,7 @@ import { invalidateIdentitySignerCache, prepareIdentitySigner } from "../identit
 import { getIdentityRuntimeConfig } from "../identity/runtime-config";
 import { type CloudSessionClaims, isSessionJwtCandidate, signSessionToken, verifySessionToken } from "../identity/session-token";
 import * as settings from "../settings";
-import { loadJwtSessionUser } from "./user";
+import { loadJwtSessionIdentity, loadJwtSessionUser } from "./user";
 
 export type SessionData = {
   userId: string;
@@ -68,7 +68,6 @@ const authenticateVerified = async (credential: CloudSessionClaims): Promise<Aut
     groupsAdmin,
   });
   if (!user) return null;
-  if (!(await isAccountCategoryAllowed(user))) return null;
   if (isAccountExpired(user.accountExpires)) {
     await session.revokeAllForUser(user.id);
     return null;
@@ -89,6 +88,18 @@ const authenticateToken = async (token: string): Promise<AuthenticatedSession |
   return credential ? authenticateVerified(credential) : null;
 };
 
+const authenticateUserId = async (token: string): Promise<string | null> => {
+  const credential = await verifyCredential(token);
+  if (!credential) return null;
+  const identity = await loadJwtSessionIdentity({ userId: credential.sub, sid: credential.sid, authEpoch: credential.auth_epoch });
+  if (!identity) return null;
+  if (isAccountExpired(identity.accountExpires)) {
+    await session.revokeAllForUser(identity.userId);
+    return null;
+  }
+  return identity.userId;
+};
+
 const revokeToken = async (token: string, requestId?: string | null): Promise<void> => {
   if (isSessionJwtCandidate(token)) {
     const claims = await verifySessionToken(token);
@@ -222,6 +233,8 @@ export const session = {
   },
 
   authenticate: authenticateToken,
+  /** Fresh session validity for user-scoped streams; does not grant resource access. */
+  authenticateUserId,
 
   authenticateRequest: (c: Context, token: string): Promise<AuthenticatedSession | null> =>
     requestCached(authenticationByRequest, c, token, async () => {

package/src/services/session/user.ts

@@ -1,11 +1,13 @@
-import { sql } from "bun";
+import { type SQLQuery, sql } from "bun";
 import type { User } from "../../contracts/shared";
+import { decodeAccountCategoryEnabled } from "../account-category-policy";
 import { buildRoles } from "../accounts/authz";
 import { resolveProviderProfile } from "../accounts/base-user";
-import { managedGroupIdsSubquery, managedGroupsNamesSubquery } from "../accounts/group-sql";
+import { managedGroupIdsSubquery } from "../accounts/group-sql";
 import { buildIpaUserData, emptyIpaUserData, userIpaDataColumns, userIpaDataJoin } from "../accounts/ipa-data";
 import { resolveAccountExpires } from "../accounts/model";
 import { toPgTextArray } from "../postgres";
+import { setRailCacheVersion } from "../rail-snapshot";
 
 type DbRow = Record<string, unknown>;
 
@@ -69,14 +71,19 @@ export const buildProjectedUser = (row: DbRow): User => {
     manages,
     managesGroupIds,
   };
-  return provider === "ipa"
-    ? { ...common, provider: "ipa", ipa: buildIpaUserData(row) ?? emptyIpaUserData() }
-    : { ...common, provider: "local", ipa: null };
+  const user: User =
+    provider === "ipa"
+      ? { ...common, provider: "ipa", ipa: buildIpaUserData(row) ?? emptyIpaUserData() }
+      : { ...common, provider: "local", ipa: null };
+  setRailCacheVersion(user, row.rail_cache_version);
+  return user;
 };
 
 export const userProjectionSql = (groupsAdmin: string[]) => sql`
   u.*,
-  ${userIpaDataColumns},
+  (SELECT cache_version::text FROM auth.rail_state WHERE singleton) || ':' ||
+    COALESCE((SELECT cache_version::text FROM auth.rail_preferences WHERE user_id = u.id), 'default') AS rail_cache_version,
+  ${userIpaDataColumns()},
   CASE
     WHEN u.provider = 'local' THEN u.admin
     ELSE EXISTS(
@@ -85,41 +92,45 @@ export const userProjectionSql = (groupsAdmin: string[]) => sql`
         AND eg.group_name = ANY(${toPgTextArray(groupsAdmin)}::text[])
     )
   END AS effective_admin,
-  COALESCE(ARRAY(
-    SELECT g.name
-    FROM auth.user_groups_v2 ug
-    JOIN auth.groups g ON g.id = ug.group_id
-    WHERE ug.user_id = u.id
-    ORDER BY g.name
-  ), '{}') AS member_groups,
-  COALESCE(ARRAY(
-    SELECT ug.group_id
-    FROM auth.user_groups_v2 ug
-    JOIN auth.groups g ON g.id = ug.group_id
+  membership.member_groups, membership.member_group_ids,
+  management.manages, management.manages_group_ids
+`;
+
+/** One scan for membership names/IDs and one recursive traversal for management. */
+export const userProjectionJoin = () => sql`
+  ${userIpaDataJoin()}
+  LEFT JOIN LATERAL (
+    SELECT COALESCE(array_agg(g.name ORDER BY g.name), '{}') AS member_groups,
+      COALESCE(array_agg(g.id ORDER BY g.name), '{}') AS member_group_ids
+    FROM auth.user_groups_v2 ug JOIN auth.groups g ON g.id = ug.group_id
     WHERE ug.user_id = u.id
-    ORDER BY g.name
-  ), '{}') AS member_group_ids,
-  COALESCE(ARRAY(${managedGroupsNamesSubquery(sql`u.id`)}), '{}') AS manages,
-  COALESCE(ARRAY(${managedGroupIdsSubquery(sql`u.id`)}), '{}') AS manages_group_ids
+  ) membership ON true
+  LEFT JOIN LATERAL (
+    SELECT COALESCE(array_agg(DISTINCT g.name ORDER BY g.name), '{}') AS manages,
+      COALESCE(array_agg(g.id ORDER BY g.name), '{}') AS manages_group_ids
+    FROM auth.groups g WHERE g.id IN (${managedGroupIdsSubquery(sql`u.id`)})
+  ) management ON true
 `;
 
-export const loadJwtSessionUser = async (
-  params: {
-    userId: string;
-    sid: string;
-    authEpoch: number;
-    groupsAdmin: string[];
-    /** Core's consent screen only: still validates family, epoch and expiry. */
-    allowPendingLegalConsent?: boolean;
-  },
-  query: typeof sql = sql,
-): Promise<User | null> => {
-  const rows = await query<DbRow[]>`
-    SELECT ${userProjectionSql(params.groupsAdmin)}
+type SessionUserParams = {
+  userId: string;
+  sid: string;
+  authEpoch: number;
+  /** Core's consent screen only: still validates family, epoch and expiry. */
+  allowPendingLegalConsent?: boolean;
+};
+
+// Both projections use the same live validity checks. Neither caches authorization.
+const loadSessionRow = async (params: SessionUserParams, projection: SQLQuery, join: SQLQuery, query: typeof sql) => {
+  const [row] = await query<DbRow[]>`
+    SELECT ${projection}, (
+      SELECT value FROM settings.entries WHERE key = 'user.category.' ||
+        CASE WHEN u.provider = 'ipa' THEN 'freeipa' WHEN u.profile = 'guest' THEN 'guest' ELSE 'login' END || '.enabled'
+    ) AS category_enabled
     FROM auth.session_families sf
     JOIN auth.users u ON u.id = sf.user_id
     JOIN auth.signing_keys sk ON sk.kid = sf.signing_kid AND sk.state <> 'revoked'
-    ${userIpaDataJoin}
+    ${join}
     WHERE sf.sid = ${params.sid}::uuid
       AND sf.user_id = ${params.userId}::uuid
       AND sf.auth_epoch = ${params.authEpoch}
@@ -130,14 +141,28 @@ export const loadJwtSessionUser = async (
         SELECT 1 FROM auth.legal_acceptances la WHERE la.user_id = u.id
       ))
   `;
-  return rows[0] ? buildProjectedUser(rows[0]) : null;
+  return row && (await decodeAccountCategoryEnabled(row.category_enabled)) ? row : null;
+};
+
+export const loadJwtSessionUser = async (
+  params: SessionUserParams & { groupsAdmin: string[] },
+  query: typeof sql = sql,
+): Promise<User | null> => {
+  const row = await loadSessionRow(params, userProjectionSql(params.groupsAdmin), userProjectionJoin(), query);
+  return row ? buildProjectedUser(row) : null;
+};
+
+/** Identity-only consumers must not pay for group, IPA, role and rail projections. */
+export const loadJwtSessionIdentity = async (params: SessionUserParams, query: typeof sql = sql) => {
+  const row = await loadSessionRow(params, sql`u.id, u.account_expires`, sql``, query);
+  return row ? { userId: String(row.id), accountExpires: resolveAccountExpires(row)?.toISOString() ?? null } : null;
 };
 
 export const loadCurrentUser = async (params: { userId: string; groupsAdmin: string[] }, query: typeof sql = sql): Promise<User | null> => {
   const rows = await query<DbRow[]>`
     SELECT ${userProjectionSql(params.groupsAdmin)}
     FROM auth.users u
-    ${userIpaDataJoin}
+    ${userProjectionJoin()}
     WHERE u.id = ${params.userId}::uuid
   `;
   return rows[0] ? buildProjectedUser(rows[0]) : null;

package/src/services/settings/app.ts

@@ -30,7 +30,11 @@ const redactSecretValue = (entry: SettingEntry): SettingEntry => {
 
 export const settingsService = {
   entry: {
-    list: async (config?: { pagination?: PageParams; filter?: { query?: string; group?: string }; locale?: string }): Promise<Paginated<SettingEntry>> => {
+    list: async (config?: {
+      pagination?: PageParams;
+      filter?: { query?: string; group?: string };
+      locale?: string;
+    }): Promise<Paginated<SettingEntry>> => {
       const entries = await settingsPrimitives.getAll(config?.locale);
       const query = config?.filter?.query?.trim().toLowerCase();
       const group = config?.filter?.group?.trim().toLowerCase();