@learncard/lca-api-service 1.6.3 → 1.7.0

package/src/models/EscrowHold.indexes.test.ts

@@ -0,0 +1,208 @@
+import { randomUUID } from 'node:crypto';
+import { inspect } from 'node:util';
+import { MongoClient, type Db } from 'mongodb';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { CreateEscrowHoldInput } from './EscrowHold';
+
+const database = vi.hoisted(() => {
+    const state: { current?: Db } = {};
+    return state;
+});
+vi.mock('@mongo', () => ({
+    default: {
+        collection: (name: string) => {
+            if (!database.current) throw new Error('Disposable Mongo is not ready');
+            return database.current.collection(name);
+        },
+    },
+}));
+vi.mock('@environment', () => ({
+    environment: { SEED: 'a'.repeat(64), ESCROW_HOLD_RESTART_MIN_AGE_MS: 0 },
+}));
+
+const key = { 'authProvider.type': 1, 'authProvider.id': 1, releasePolicy: 1 };
+const name = 'pending_escrow_identity_policy_unique';
+const unique = { unique: true, partialFilterExpression: { status: 'pending' } };
+const identity = { type: 'firebase', id: 'synthetic-private-identity' } as const;
+const input = (): CreateEscrowHoldInput => ({
+    holdRecord: {
+        hold: {
+            holdId: randomUUID(),
+            did: 'did:key:test',
+            shareVersion: 1,
+            blobHash: 'ab'.repeat(32),
+            enrollmentEpoch: 1,
+            releasePolicy: 'hold',
+            clientEphemeralPublicKey: 'test-key',
+            createdLo: 0,
+            createdHi: 0,
+            policyVersion: 1,
+            signature: 'test-signature',
+        },
+        holdDurationMs: 0,
+        ledgerSeq: 0,
+    },
+    authProvider: identity,
+    primaryDid: 'did:key:test',
+    shareVersion: 1,
+    identityProofType: 'auth-token',
+    requestedAt: new Date(),
+    releaseAfter: new Date(),
+    releasePolicy: 'hold',
+    clientEphemeralPublicKey: 'test-key',
+    resumeTokenHash: 'ab'.repeat(32),
+});
+
+let server: MongoMemoryServer;
+let client: MongoClient;
+let model: typeof import('./EscrowHold');
+beforeAll(async () => {
+    // Never uses MONGO_URI, the service environment, or a running/shared Mongo.
+    server = await MongoMemoryServer.create({ instance: { ip: '127.0.0.1' } });
+    client = new MongoClient(server.getUri());
+    database.current = client.db('escrow_index_regression');
+});
+beforeEach(async () => {
+    await database.current?.dropDatabase();
+    vi.resetModules();
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    model = await import('./EscrowHold');
+});
+afterEach(() => vi.restoreAllMocks());
+afterAll(async () => {
+    await client?.close();
+    await server?.stop();
+});
+
+const collection = () => {
+    if (!database.current) throw new Error('Disposable Mongo is not ready');
+    return database.current.collection('escrowholds');
+};
+
+describe('escrow index migration with real Mongo', () => {
+    it('surfaces E11000, shares failing waiters, blocks writes and retries after repair', async () => {
+        await collection().insertMany([
+            { authProvider: identity, status: 'pending' },
+            { authProvider: identity, status: 'pending', releasePolicy: 'hold' },
+        ]);
+        const ready = model.ensureEscrowHoldsIndexes();
+        expect(model.ensureEscrowHoldsIndexes()).toBe(ready);
+        await expect(ready).rejects.toMatchObject({
+            message: 'Escrow hold index initialization failed',
+            cause: { code: 11000, codeName: 'DuplicateKey' },
+        });
+        const failure = await ready.catch((error: unknown) => error);
+        expect(inspect(failure, { depth: null })).not.toContain(identity.id);
+        expect(console.error).toHaveBeenCalledWith(
+            '[escrow-hold-indexes] initialization failed',
+            expect.objectContaining({
+                operation: name,
+                code: 11000,
+                codeName: 'DuplicateKey',
+                errmsg: expect.stringContaining('E11000'),
+                keyValue: {
+                    'authProvider.type': '[redacted]',
+                    'authProvider.id': '[redacted]',
+                    releasePolicy: '[redacted]',
+                },
+            })
+        );
+        expect(JSON.stringify(vi.mocked(console.error).mock.calls)).not.toContain(identity.id);
+        await expect(model.createEscrowHold(input())).rejects.toMatchObject({
+            cause: { code: 11000 },
+        });
+        await expect(model.retryClaimedEscrowHold(randomUUID(), new Date())).rejects.toMatchObject({
+            cause: { code: 11000 },
+        });
+        expect(await collection().countDocuments()).toBe(2);
+        // This repair is ONLY to this test's owned, temporary database.
+        await collection().deleteOne({ authProvider: identity });
+        await expect(model.ensureEscrowHoldsIndexes()).resolves.toBeUndefined();
+        await expect(model.createEscrowHold(input())).rejects.toMatchObject({ code: 11000 });
+        expect(await collection().countDocuments()).toBe(1);
+    });
+
+    it('is idempotent when the old index is absent and preserves per-policy uniqueness', async () => {
+        await expect(model.createEscrowHoldsIndexes()).resolves.toBeUndefined();
+        await expect(model.createEscrowHoldsIndexes()).resolves.toBeUndefined();
+        await model.createEscrowHold(input());
+        await expect(model.createEscrowHold(input())).rejects.toMatchObject({ code: 11000 });
+        await expect(
+            model.createEscrowHold({ ...input(), releasePolicy: 'pin' })
+        ).resolves.toBeDefined();
+        expect(console.error).not.toHaveBeenCalled();
+    });
+
+    it('normalizes legacy rows and installs the replacement before dropping the old index', async () => {
+        await collection().createIndex(
+            { 'authProvider.type': 1, 'authProvider.id': 1 },
+            { name: 'pending_escrow_identity_unique', ...unique }
+        );
+        await collection().insertOne({ authProvider: identity, status: 'pending' });
+        await model.createEscrowHoldsIndexes();
+        expect(await collection().findOne()).toMatchObject({ releasePolicy: 'hold' });
+        const indexes = await collection().listIndexes().toArray();
+        expect(indexes.find(index => index.name === name)).toMatchObject({ key, ...unique });
+        expect(indexes.some(index => index.name === 'pending_escrow_identity_unique')).toBe(false);
+    });
+
+    it('preserves the old guard when a conflicting same-name nonunique index blocks migration', async () => {
+        await collection().createIndex(
+            { 'authProvider.type': 1, 'authProvider.id': 1 },
+            { name: 'pending_escrow_identity_unique', ...unique }
+        );
+        await collection().createIndex(key, { name });
+        await expect(model.ensureEscrowHoldsIndexes()).rejects.toMatchObject({
+            cause: { code: 86 },
+        });
+        expect(console.error).toHaveBeenCalledWith(
+            expect.any(String),
+            expect.objectContaining({
+                operation: name,
+                code: 86,
+                codeName: 'IndexKeySpecsConflict',
+            })
+        );
+        const indexes = await collection().listIndexes().toArray();
+        expect(indexes.find(index => index.name === 'pending_escrow_identity_unique')?.unique).toBe(
+            true
+        );
+        expect(indexes.find(index => index.name === name)?.unique).not.toBe(true);
+        await expect(model.createEscrowHold(input())).rejects.toMatchObject({
+            cause: { code: 86 },
+        });
+        expect(await collection().countDocuments()).toBe(0);
+    });
+
+    it('accepts a verified equivalent unique index under another name', async () => {
+        await collection().createIndex(key, { name: 'existing_equivalent', ...unique });
+        await expect(model.ensureEscrowHoldsIndexes()).resolves.toBeUndefined();
+        await model.createEscrowHold(input());
+        await expect(model.createEscrowHold(input())).rejects.toMatchObject({ code: 11000 });
+    });
+
+    it('does not hide a lookup conflict just because a unique index exists', async () => {
+        await collection().createIndex(key, { name, ...unique });
+        await collection().createIndex({ releaseAfter: 1 }, { expireAfterSeconds: 60 });
+        await expect(model.ensureEscrowHoldsIndexes()).rejects.toMatchObject({
+            cause: { code: 85 },
+        });
+        expect(console.error).toHaveBeenCalledWith(
+            expect.any(String),
+            expect.objectContaining({ operation: 'releaseAfter_1', code: 85 })
+        );
+    });
+
+    it('allows only one winner when the first concurrent creates initialize the indexes', async () => {
+        const results = await Promise.allSettled([
+            model.createEscrowHold(input()),
+            model.createEscrowHold(input()),
+        ]);
+        expect(results.filter(result => result.status === 'fulfilled')).toHaveLength(1);
+        expect(results.find(result => result.status === 'rejected')).toMatchObject({
+            reason: { code: 11000 },
+        });
+        expect(await collection().countDocuments()).toBe(1);
+    });
+});

package/src/models/EscrowHold.ts

@@ -7,6 +7,7 @@ import {
 import type { Collection } from 'mongodb';
 import mongodb from '@mongo';
 import { environment } from '@environment';
+import { createRetryingOnce } from '../helpers/retryingOnce';
 import {
     AuthProviderMappingValidator,
     EscrowEnvelopeValidator,
@@ -167,77 +168,130 @@ export type CreateEscrowHoldInput = Omit<
 export const getEscrowHoldsCollection = (): Collection<EscrowHold> =>
     mongodb.collection<EscrowHold>(ESCROW_HOLDS_COLLECTION);
 
-const runIndexMigrationOperation = async (operation: () => Promise<unknown>): Promise<void> => {
+const mongoIndexError = z.object({
+    code: z.union([z.number(), z.string()]).optional(),
+    codeName: z.string().optional(),
+    errmsg: z.string().optional(),
+    message: z.string().optional(),
+    keyValue: z.record(z.string(), z.unknown()).optional(),
+});
+
+const runIndexMigrationOperation = async (
+    operationName: string,
+    operation: () => Promise<unknown>
+): Promise<void> => {
     try {
         await operation();
     } catch (error) {
-        const code =
-            typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
-        // Unlike lookup indexes, uniqueness is a security invariant: fail closed on duplicates.
-        if (code === 27 || code === 85 || code === 86) {
-            const indexes = await getEscrowHoldsCollection().listIndexes().toArray();
-            if (
-                indexes.some(
-                    index =>
-                        index.unique &&
-                        Object.keys(index.key ?? {}).length === 3 &&
-                        index.key?.['authProvider.type'] === 1 &&
-                        index.key?.['authProvider.id'] === 1 &&
-                        index.key?.releasePolicy === 1 &&
-                        Object.keys(index.partialFilterExpression ?? {}).length === 1 &&
-                        index.partialFilterExpression?.status === 'pending'
-                )
-            )
-                return;
-        }
-        throw new Error('Escrow hold index initialization failed', { cause: error });
+        const parsed = mongoIndexError.safeParse(error);
+        const details = parsed.success ? parsed.data : {};
+        // E11000 embeds the identity in both errmsg and keyValue. Keep the Mongo
+        // diagnosis in CloudWatch without copying account identifiers into logs.
+        const redactDuplicateKey = (message: string | undefined): string | undefined =>
+            message?.replace(/dup key:.*$/s, 'dup key: [redacted]');
+        const diagnostic = {
+            operation: operationName,
+            code: details.code,
+            codeName: details.codeName,
+            errmsg: redactDuplicateKey(details.errmsg),
+            message: redactDuplicateKey(details.message),
+            keyValue: details.keyValue
+                ? Object.fromEntries(Object.keys(details.keyValue).map(key => [key, '[redacted]']))
+                : undefined,
+        };
+        console.error('[escrow-hold-indexes] initialization failed', diagnostic);
+        // Generic route loggers also inspect Error.cause; never retain the raw identity there.
+        // eslint-disable-next-line preserve-caught-error -- MongoError retains PII; keep only the sanitized cause.
+        throw new Error('Escrow hold index initialization failed', { cause: diagnostic });
     }
 };
 
 export const createEscrowHoldsIndexes = async (): Promise<void> => {
     const collection = getEscrowHoldsCollection();
     // Normalize legacy rows while the old, stricter index still protects them.
-    await collection.updateMany(
-        { releasePolicy: { $exists: false } },
-        { $set: { releasePolicy: 'hold' } }
-    );
-    await runIndexMigrationOperation(() =>
-        collection.createIndex(
-            { 'authProvider.type': 1, 'authProvider.id': 1, releasePolicy: 1 },
-            {
-                name: 'pending_escrow_identity_policy_unique',
-                unique: true,
-                partialFilterExpression: { status: 'pending' },
-            }
+    await runIndexMigrationOperation('normalize-legacy-release-policy', () =>
+        collection.updateMany(
+            { releasePolicy: { $exists: false } },
+            { $set: { releasePolicy: 'hold' } }
         )
     );
-    // Install the replacement before dropping the old index: no uniqueness gap.
-    try {
-        await collection.dropIndex('pending_escrow_identity_unique');
-    } catch (error) {
-        if (!(typeof error === 'object' && error !== null && 'code' in error && error.code === 27))
+    await runIndexMigrationOperation('pending_escrow_identity_policy_unique', async () => {
+        try {
+            await collection.createIndex(
+                { 'authProvider.type': 1, 'authProvider.id': 1, releasePolicy: 1 },
+                {
+                    name: 'pending_escrow_identity_policy_unique',
+                    unique: true,
+                    partialFilterExpression: { status: 'pending' },
+                }
+            );
+        } catch (error) {
+            const code = mongoIndexError.safeParse(error);
+            if (code.success && (code.data.code === 85 || code.data.code === 86)) {
+                const indexes = await collection.listIndexes().toArray();
+                // Accept an equivalent unique index under another name. Never
+                // drop/rebuild a conflicting spec or mistake a lookup for protection.
+                if (
+                    indexes.some(
+                        index =>
+                            index.unique === true &&
+                            index.sparse !== true &&
+                            (!index.collation || index.collation.locale === 'simple') &&
+                            Object.keys(index.key ?? {}).join(',') ===
+                                'authProvider.type,authProvider.id,releasePolicy' &&
+                            index.key?.['authProvider.type'] === 1 &&
+                            index.key?.['authProvider.id'] === 1 &&
+                            index.key?.releasePolicy === 1 &&
+                            Object.keys(index.partialFilterExpression ?? {}).length === 1 &&
+                            index.partialFilterExpression?.status === 'pending'
+                    )
+                )
+                    return;
+            }
             throw error;
-    }
-    await runIndexMigrationOperation(() =>
+        }
+    });
+    // Install the replacement before dropping the old index: no uniqueness gap.
+    await runIndexMigrationOperation('drop-pending_escrow_identity_unique', async () => {
+        try {
+            await collection.dropIndex('pending_escrow_identity_unique');
+        } catch (error) {
+            const parsed = mongoIndexError.safeParse(error);
+            if (!parsed.success || parsed.data.code !== 27) throw error;
+        }
+    });
+    await runIndexMigrationOperation('authProvider.type_1_authProvider.id_1_status_1', () =>
         collection.createIndex({ 'authProvider.type': 1, 'authProvider.id': 1, status: 1 })
     );
-    await runIndexMigrationOperation(() => collection.createIndex({ releaseAfter: 1 }));
-    // Backs findEscrowHoldsDueForReminder's { status:'pending', releaseAfter: {$gt,$lte} } scan.
-    await collection.createIndex(
-        { status: 1, releaseAfter: 1 },
-        { name: 'pending_escrow_hold_reminder_lookup' }
+    await runIndexMigrationOperation('releaseAfter_1', () =>
+        collection.createIndex({ releaseAfter: 1 })
+    );
+    await runIndexMigrationOperation('pending_escrow_hold_reminder_lookup', () =>
+        collection.createIndex(
+            { status: 1, releaseAfter: 1 },
+            { name: 'pending_escrow_hold_reminder_lookup' }
+        )
     );
-    await collection.createIndex(
-        { status: 1, enclaveCancelConfirmedAt: 1, enclaveCancelAttempts: 1, releaseAfter: 1 },
-        { name: 'escrow_enclave_cancel_retry_lookup' }
+    await runIndexMigrationOperation('escrow_enclave_cancel_retry_lookup', () =>
+        collection.createIndex(
+            { status: 1, enclaveCancelConfirmedAt: 1, enclaveCancelAttempts: 1, releaseAfter: 1 },
+            { name: 'escrow_enclave_cancel_retry_lookup' }
+        )
     );
-    await collection.createIndex(
-        { primaryDid: 1, status: 1, enclaveCancelConfirmedAt: 1 },
-        { name: 'escrow_enclave_cancel_identity_lookup' }
+    await runIndexMigrationOperation('escrow_enclave_cancel_identity_lookup', () =>
+        collection.createIndex(
+            { primaryDid: 1, status: 1, enclaveCancelConfirmedAt: 1 },
+            { name: 'escrow_enclave_cancel_identity_lookup' }
+        )
     );
 };
 
+/** Only escrow writers wait for this migration; a failure can retry on the next request. */
+export const ensureEscrowHoldsIndexes: () => Promise<void> =
+    createRetryingOnce(createEscrowHoldsIndexes);
+
 export const createEscrowHold = async (input: CreateEscrowHoldInput): Promise<EscrowHold> => {
+    await ensureEscrowHoldsIndexes();
     const now = new Date();
     const parsed = EscrowHoldValidator.safeParse({
         ...input,
@@ -491,6 +545,7 @@ export const markClaimedEscrowHoldFailed = async (
 };
 /** Reopen only our own failed release claim, never another request's terminal row. */
 export const retryClaimedEscrowHold = async (id: string, completedAt: Date): Promise<void> => {
+    await ensureEscrowHoldsIndexes();
     try {
         await getEscrowHoldsCollection().updateOne(
             { _id: id, status: 'completed', completedAt },

package/src/models/UserKey.ts

@@ -241,6 +241,15 @@ const MongoUserKeyBaseValidator = z.object({
 
     migratedFromWeb3Auth: z.boolean().default(false),
     migratedAt: z.date().optional(),
+    /**
+     * The login whose Web3Auth key this account was migrated from, recorded by
+     * `/keys/migrate` only when that login is the account's sole login at security
+     * epoch 0. Web3Auth derives a key from the login alone, so only this login
+     * still derives the account's key: a Web3Auth-mode client may sign in an SSS
+     * account only through it (see `isWeb3AuthLogin`). Absent means no login is
+     * known to be safe; migrations from before this field was added have none.
+     */
+    web3AuthLogin: AuthProviderMappingValidator.optional(),
 
     sssActivationState: z.enum(['provisional', 'active']).optional(),
     provisionalCreatedAt: z.date().optional(),
@@ -819,6 +828,47 @@ const getAuthProviderFilter = (authProvider: AuthProviderMapping): Filter<MongoU
     authProviders: { $elemMatch: authProvider },
 });
 
+/**
+ * Whether Web3Auth, signing in through `authProvider`, derives this account's key.
+ * Web3Auth derives a key from the login alone, so this holds only for the login
+ * the account's key came from; any other login (added by PIN sign-in, recovery or
+ * a revoke) derives a different, empty identity. Web3Auth-mode clients stop every
+ * existing account for which this is false.
+ *
+ * - A recorded `web3AuthLogin` decides it: true only for that login, on a record
+ *   that is still Web3Auth (mid-migration) or finished migrating from it.
+ * - Without one, only a still-Web3Auth record (e.g. a migration that started
+ *   before logins were recorded) qualifies, and only through its sole login at
+ *   security epoch 0: the same evidence `/keys/migrate` requires to record it.
+ *   A migrated or SSS-native record without one is never confirmed.
+ */
+export const isWeb3AuthLogin = (
+    userKey: Pick<
+        MongoUserKeyType,
+        'keyProvider' | 'migratedFromWeb3Auth' | 'web3AuthLogin' | 'authProviders' | 'securityEpoch'
+    >,
+    authProvider: AuthProviderMapping
+): boolean => {
+    const isThisLogin = (login: AuthProviderMapping | undefined): boolean =>
+        login?.type === authProvider.type && login?.id === authProvider.id;
+    const stillWeb3Auth = (userKey.keyProvider ?? 'sss') === 'web3auth';
+
+    if (userKey.web3AuthLogin) {
+        return (
+            isThisLogin(userKey.web3AuthLogin) &&
+            (stillWeb3Auth || userKey.migratedFromWeb3Auth === true)
+        );
+    }
+
+    const logins = userKey.authProviders ?? [];
+    return (
+        stillWeb3Auth &&
+        logins.length === 1 &&
+        isThisLogin(logins[0]) &&
+        getSecurityEpoch(userKey) === 0
+    );
+};
+
 /** The account's security epoch; a legacy record without the field is at epoch 0. */
 export const getSecurityEpoch = (userKey: Pick<MongoUserKeyType, 'securityEpoch'>): number =>
     userKey.securityEpoch ?? 0;
@@ -1581,8 +1631,26 @@ export const markUserKeyMigrationProvisionalByAuthProvider = async (
             },
         }
     );
+    const marked = result.modifiedCount > 0 || result.matchedCount > 0;
+
+    if (marked) {
+        // Record the login that derived the legacy key, but only when it provably
+        // did: it is the account's sole login and no rebind/revoke has happened. A
+        // second login (PIN sign-in) holding the account key could otherwise claim
+        // it. Never replace a recorded login; when unsure, record nothing (Web3Auth
+        // clients then stop the account: a false negative, never a split).
+        await getUserKeysCollection().updateOne(
+            {
+                ...getAuthProviderFilter(authProvider),
+                authProviders: { $size: 1, $elemMatch: authProvider },
+                web3AuthLogin: { $exists: false },
+                ...getSecurityEpochFilter(0),
+            },
+            { $set: { web3AuthLogin: authProvider } }
+        );
+    }
 
-    return result.modifiedCount > 0 || result.matchedCount > 0;
+    return marked;
 };
 
 /**

package/src/routes/escrow.ts

@@ -54,7 +54,7 @@ import {
     clearEscrowByAuthProvider,
     setEscrowOptInByAuthProvider,
     createEscrowHold,
-    createEscrowHoldsIndexes,
+    ensureEscrowHoldsIndexes,
     findPendingEscrowHoldByAuthProvider,
     findEscrowHoldById,
     cancelEscrowHold,
@@ -90,6 +90,7 @@ import {
     getEscrowHoldDurationMs,
     getEscrowHoldRestartMinAgeMs,
     isEscrowRemoteMode,
+    getEscrowAuthorityTenant,
     activeEscrowClientMode,
     getEnclaveAttestationIdentity,
     notifyEscrowHoldEvent,
@@ -185,18 +186,16 @@ const lockPin = async (
         }
     }
 };
-let holdIndexes: Promise<void> | undefined;
-
-// Lambda and in-process callers do not run docker-entry's index initialization.
 const ensureHoldIndexes = async (): Promise<void> => {
-    holdIndexes ??= createEscrowHoldsIndexes().catch(() => {
-        holdIndexes = undefined;
+    try {
+        await ensureEscrowHoldsIndexes();
+    } catch (cause) {
         throw new TRPCError({
             code: 'INTERNAL_SERVER_ERROR',
             message: 'Recovery could not be started.',
+            cause,
         });
-    });
-    await holdIndexes;
+    }
 };
 const successValidator = z.object({ success: z.literal(true) });
 const cancelByLinkInput = z
@@ -498,7 +497,7 @@ const removeEscrow = async (
             !enclave.applyEnrollmentIntent ||
             signed.intent.action !== 'disable' ||
             signed.intent.did !== did ||
-            signed.intent.tenant !== tenant.id
+            signed.intent.tenant !== getEscrowAuthorityTenant()
         )
             throw new TRPCError({
                 code: 'BAD_REQUEST',
@@ -656,7 +655,10 @@ export const escrowRouter = t.router({
             const result = await enclaveOperation(() =>
                 enclave.getEnrollmentState!({ expectedDid: ctx.user.did, nonce: input.nonce })
             );
-            if (result.state.did !== ctx.user.did || result.state.tenant !== ctx.tenant.id)
+            if (
+                result.state.did !== ctx.user.did ||
+                result.state.tenant !== getEscrowAuthorityTenant()
+            )
                 throw new TRPCError({ code: 'FORBIDDEN', message: invalidMessage });
             return result;
         }),
@@ -726,7 +728,7 @@ export const escrowRouter = t.router({
                 const intent = signed.intent;
                 if (
                     intent.did !== ctx.user.did ||
-                    intent.tenant !== ctx.tenant.id ||
+                    intent.tenant !== getEscrowAuthorityTenant() ||
                     intent.action === 'disable' ||
                     intent.shareVersion !== input.shareVersion ||
                     !!input.pinSalt !==
@@ -740,6 +742,10 @@ export const escrowRouter = t.router({
                         nonce: randomBytes(32).toString('hex'),
                     })
                 );
+                // The enclave signs its own (measured) tenant; a different one means this
+                // lca-api's ESCROW_AUTHORITY_TENANT does not match the enclave it talks to.
+                if (current.state.tenant !== intent.tenant)
+                    throw new TRPCError({ code: 'FORBIDDEN', message: invalidMessage });
                 if (
                     current.state.enrollmentVersion !== intent.expectedEnrollmentVersion ||
                     current.state.authorityGeneration !== intent.authorityGeneration
@@ -1398,6 +1404,7 @@ export const escrowRouter = t.router({
             // Legacy Mongo rows can predate the required creation-time record.
             if (hold.status !== 'pending' || !hold.holdRecord)
                 throw new TRPCError({ code: 'FORBIDDEN', message: invalidMessage });
+            await ensureHoldIndexes();
             const now = new Date();
             if (now < hold.releaseAfter) {
                 throw new TRPCError({

package/src/routes/index.ts

@@ -35,13 +35,8 @@ export type Context = {
     tenant: ResolvedTenant;
     debug?: boolean;
     clientIp?: string;
-    // Value of the X-Auth-Token header — a caller's own provider token
-    // (e.g. a Firebase ID token), distinct from the Authorization header
-    // (reserved for the DID-Auth VP). Lets GET routes that verify a
-    // provider token (e.g. keys.getRecoveryShare, P0-4) read it without
-    // putting it in a query string, without colliding with clients that
-    // send a DID-Auth VP as Authorization for the same route.
     providerToken?: string;
+    authorizationHeader?: string;
 };
 
 export const t = initTRPC.context<Context>().meta<OpenApiMeta>().create();
@@ -57,12 +52,12 @@ export const createContext = async (
     const domainName = 'requestContext' in event ? event.requestContext.domainName : '';
     const debug = environment.NODE_ENV === 'test';
 
-    // See Context.providerToken — a separate header from Authorization,
-    // which is reserved for the DID-Auth VP handled below.
+    // The original signed DID VP may be forwarded only to brain-service's authenticated self-profile route.
     const providerTokenHeader = (event.headers as Record<string, string | undefined>)[
         'x-auth-token'
     ];
     const providerToken = providerTokenHeader || undefined;
+    const authorizationHeader = authHeader || undefined;
 
     const domain =
         !domainName || environment.IS_OFFLINE
@@ -132,6 +127,7 @@ export const createContext = async (
                             debug,
                             clientIp,
                             providerToken,
+                            authorizationHeader,
                         };
 
                     const cacheResponse = await consumeChallengeForDid(did, challenge);
@@ -143,6 +139,7 @@ export const createContext = async (
                         debug,
                         clientIp,
                         providerToken,
+                        authorizationHeader,
                     };
                 }
             }

package/src/routes/keys.ts

@@ -42,6 +42,7 @@ import {
     setRecoveryEmailByAuthProvider,
     markUserKeyMigrationProvisionalByAuthProvider,
     activateUserKeyByAuthProvider,
+    isWeb3AuthLogin,
     purgeExpiredProvisionalMigrationByAuthProvider,
     getSssActivationState,
     hasActivatableRecoveryMethod,
@@ -1058,6 +1059,12 @@ export const keysRouter = t.router({
                      */
                     priorEscrowEnrollment: z.boolean(),
                     sssActivationState: z.enum(['provisional', 'active']),
+                    /**
+                     * Web3Auth, signing in through this login, derives this account's
+                     * key (see `isWeb3AuthLogin`). Web3Auth-mode clients stop any
+                     * existing account where this is false.
+                     */
+                    isWeb3AuthLogin: z.boolean(),
                 })
                 .nullable()
         )
@@ -1133,6 +1140,7 @@ export const keysRouter = t.router({
                     ? maskEmail(userKey.recoveryEmail)
                     : null,
                 sssActivationState: getSssActivationState(userKey),
+                isWeb3AuthLogin: isWeb3AuthLogin(userKey, authProvider),
                 escrowOptedOut: Boolean(userKey.escrowOptedOutAt),
                 escrowPin: getEscrowPinStatus(userKey),
                 escrowStale: userKey.escrowBlob