@livedesk/hub 0.1.38 → 0.1.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "description": "LiveDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",

package/src/http/hub-ui-session.js

@@ -0,0 +1,119 @@
+import crypto from 'node:crypto';
+
+export const HUB_UI_SESSION_COOKIE = 'livedesk_hub_ui';
+export const HUB_UI_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
+
+const SAFE_HTTP_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+
+function secureEqual(left, right) {
+  const leftBuffer = Buffer.from(String(left || ''), 'utf8');
+  const rightBuffer = Buffer.from(String(right || ''), 'utf8');
+  return leftBuffer.length === rightBuffer.length
+    && leftBuffer.length > 0
+    && crypto.timingSafeEqual(leftBuffer, rightBuffer);
+}
+
+function parseCookies(value) {
+  const result = new Map();
+  for (const part of String(value || '').split(';')) {
+    const separator = part.indexOf('=');
+    if (separator <= 0) continue;
+    const key = part.slice(0, separator).trim();
+    const rawValue = part.slice(separator + 1).trim();
+    if (!key) continue;
+    try {
+      result.set(key, decodeURIComponent(rawValue));
+    } catch {
+      result.set(key, rawValue);
+    }
+  }
+  return result;
+}
+
+function randomToken() {
+  return crypto.randomBytes(32).toString('base64url');
+}
+
+export function createHubUiSessionAuthority({
+  ttlMs = HUB_UI_SESSION_TTL_MS,
+  maxSessions = 32,
+  now = () => Date.now()
+} = {}) {
+  const sessions = new Map();
+
+  function purgeExpired() {
+    const current = now();
+    for (const [sessionId, session] of sessions) {
+      if (session.expiresAt <= current) sessions.delete(sessionId);
+    }
+    while (sessions.size >= maxSessions) {
+      sessions.delete(sessions.keys().next().value);
+    }
+  }
+
+  function issue(userId) {
+    const normalizedUserId = String(userId || '').trim();
+    if (!normalizedUserId) throw new Error('hub-ui-session-user-required');
+    purgeExpired();
+    const sessionId = randomToken();
+    const csrfToken = randomToken();
+    const expiresAt = now() + ttlMs;
+    sessions.set(sessionId, { userId: normalizedUserId, csrfToken, expiresAt });
+    return { sessionId, csrfToken, expiresAt };
+  }
+
+  function authorize(req, currentUserId, {
+    requireCsrf = !SAFE_HTTP_METHODS.has(String(req.method || 'GET').toUpperCase())
+  } = {}) {
+    purgeExpired();
+    const sessionId = parseCookies(req.headers?.cookie).get(HUB_UI_SESSION_COOKIE) || '';
+    if (!sessionId) {
+      return { ok: false, status: 401, error: 'hub-ui-session-required' };
+    }
+    const session = sessions.get(sessionId);
+    if (!session) {
+      return { ok: false, status: 401, error: 'hub-ui-session-expired' };
+    }
+    const normalizedUserId = String(currentUserId || '').trim();
+    if (!normalizedUserId || session.userId !== normalizedUserId) {
+      sessions.delete(sessionId);
+      return { ok: false, status: 403, error: 'hub-ui-session-account-mismatch' };
+    }
+    if (requireCsrf && !secureEqual(req.headers?.['x-livedesk-csrf'], session.csrfToken)) {
+      return { ok: false, status: 403, error: 'hub-ui-csrf-invalid' };
+    }
+    return { ok: true, sessionId, userId: session.userId, expiresAt: session.expiresAt };
+  }
+
+  return {
+    issue,
+    authorize,
+    revokeAll() {
+      sessions.clear();
+    },
+    sessionCount: () => sessions.size
+  };
+}
+
+export function serializeHubUiSessionCookie(sessionId, expiresAt, { secure = false } = {}) {
+  const maxAgeSeconds = Math.max(1, Math.floor((Number(expiresAt || 0) - Date.now()) / 1000));
+  return [
+    `${HUB_UI_SESSION_COOKIE}=${encodeURIComponent(String(sessionId || ''))}`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Strict',
+    `Max-Age=${maxAgeSeconds}`,
+    secure ? 'Secure' : ''
+  ].filter(Boolean).join('; ');
+}
+
+export function clearHubUiSessionCookie({ secure = false } = {}) {
+  return [
+    `${HUB_UI_SESSION_COOKIE}=`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Strict',
+    'Max-Age=0',
+    secure ? 'Secure' : ''
+  ].filter(Boolean).join('; ');
+}

package/src/live-desk-update.js

@@ -8,10 +8,11 @@ export const LIVE_DESK_UPDATE_COMMAND = 'livedesk.client-update';
 // same device returned, so the Hub-owned compatibility bridge upgrades them.
 export const LIVE_DESK_DEDICATED_CLIENT_UPDATE_MIN_VERSION = '0.1.172';
 export const LIVE_DESK_UPDATE_CLIENT_BATCH_SIZE = 5;
-export const LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS = 480_000;
-export const LIVE_DESK_UPDATE_TIMEOUT_MS = 90 * 60_000;
-export const LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS = 60_000;
-export const LIVE_DESK_UPDATE_CHECK_INTERVAL_MS = 60_000;
+export const LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS = 480_000;
+export const LIVE_DESK_UPDATE_TIMEOUT_MS = 90 * 60_000;
+export const LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS = 60_000;
+export const LIVE_DESK_UPDATE_VERIFIED_CLIENT_STABILITY_MS = 10_000;
+export const LIVE_DESK_UPDATE_CHECK_INTERVAL_MS = 60_000;
 export const LIVE_DESK_LEGACY_COMMAND_MAX_LENGTH = 3900;
 
 function cleanVersion(value) {
@@ -194,9 +195,10 @@ function statusForRun(run) {
     activeCount,
     queuedCount,
     pendingOfflineCount,
-    failedCount,
-    batchSize: run.batchSize,
-    clientRestartStabilityMs: run.clientRestartStabilityMs,
+    failedCount,
+    batchSize: run.batchSize,
+    clientRestartStabilityMs: run.clientRestartStabilityMs,
+    verifiedClientRestartStabilityMs: run.verifiedClientRestartStabilityMs,
     latestManagerVersion: run.latestManagerVersion,
     latestClientVersion: run.latestClientVersion,
     error: run.error || '',
@@ -226,10 +228,14 @@ function resetReconnectCandidate(target) {
   target.candidatePid = 0;
   target.candidateConnectedAt = '';
   target.candidateProductVersion = '';
-  target.candidateAgentVersion = '';
-  target.candidateSince = '';
-  target.stabilityDeadlineAt = '';
-}
+  target.candidateAgentVersion = '';
+  target.candidateSupervisorProofId = '';
+  target.verificationSource = '';
+  target.requiredStabilityMs = 0;
+  target.supervisorProofAt = '';
+  target.candidateSince = '';
+  target.stabilityDeadlineAt = '';
+}
 
 export function createLiveDeskUpdateManager({
   remoteHub,
@@ -240,10 +246,11 @@ export function createLiveDeskUpdateManager({
   fetchImpl = globalThis.fetch,
   now = () => Date.now(),
   clientBatchSize = LIVE_DESK_UPDATE_CLIENT_BATCH_SIZE,
-  targetTimeoutMs = LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS,
-  operationTimeoutMs = LIVE_DESK_UPDATE_TIMEOUT_MS,
-  clientRestartStabilityMs = LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS
-}) {
+  targetTimeoutMs = LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS,
+  operationTimeoutMs = LIVE_DESK_UPDATE_TIMEOUT_MS,
+  clientRestartStabilityMs = LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS,
+  verifiedClientRestartStabilityMs = LIVE_DESK_UPDATE_VERIFIED_CLIENT_STABILITY_MS
+}) {
   let latestRelease = null;
   let checkError = '';
   let checkPromise = null;
@@ -262,12 +269,18 @@ export function createLiveDeskUpdateManager({
     effectiveTargetTimeoutMs,
     Number(operationTimeoutMs) || LIVE_DESK_UPDATE_TIMEOUT_MS
   );
-  const effectiveClientRestartStabilityMs = Math.max(
+  const effectiveClientRestartStabilityMs = Math.max(
     0,
     Number.isFinite(Number(clientRestartStabilityMs))
       ? Number(clientRestartStabilityMs)
-      : LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS
-  );
+      : LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS
+  );
+  const effectiveVerifiedClientRestartStabilityMs = Math.max(
+    5_000,
+    Number.isFinite(Number(verifiedClientRestartStabilityMs))
+      ? Number(verifiedClientRestartStabilityMs)
+      : LIVE_DESK_UPDATE_VERIFIED_CLIENT_STABILITY_MS
+  );
 
   const touch = () => {
     if (run) run.updatedAt = new Date(now()).toISOString();
@@ -341,9 +354,10 @@ export function createLiveDeskUpdateManager({
         queuedCount: 0,
         pendingOfflineCount: 0,
         failedCount: 0,
-        batchSize: effectiveClientBatchSize,
-        clientRestartStabilityMs: effectiveClientRestartStabilityMs,
-        targets: []
+        batchSize: effectiveClientBatchSize,
+        clientRestartStabilityMs: effectiveClientRestartStabilityMs,
+        verifiedClientRestartStabilityMs: effectiveVerifiedClientRestartStabilityMs,
+        targets: []
       })
     };
   };
@@ -535,9 +549,30 @@ export function createLiveDeskUpdateManager({
         const connectedAtEpochMs = Date.parse(connectedAt);
         const dispatchedAtEpochMs = Date.parse(target.dispatchedAt || '');
         const candidatePid = Math.max(0, Math.floor(Number(device?.pid) || 0));
-        const candidateProductVersion = String(device?.productVersion || '');
-        const candidateAgentVersion = String(device?.agentVersion || '');
-        const qualifiesForStability = device?.connected === true
+        const candidateProductVersion = String(device?.productVersion || '');
+        const candidateAgentVersion = String(device?.agentVersion || '');
+        const supervisorProof = device?.clientUpdateProof;
+        const supervisorProofId = [
+          String(supervisorProof?.operationId || ''),
+          String(supervisorProof?.attemptId || ''),
+          String(supervisorProof?.sessionId || ''),
+          String(supervisorProof?.agentPid || ''),
+          String(supervisorProof?.launcherPid || ''),
+          String(supervisorProof?.completedAt || '')
+        ].join(':');
+        const hasSupervisorProof = !!supervisorProof
+          && String(supervisorProof.operationId || '') === run.operationId
+          && !!String(supervisorProof.attemptId || '')
+          && String(supervisorProof.sessionId || '') === sessionId
+          && Number(supervisorProof.agentPid || 0) === candidatePid
+          && Number(supervisorProof.launcherPid || 0) > 1
+          && cleanVersion(supervisorProof.productVersion) === cleanVersion(candidateProductVersion)
+          && cleanVersion(supervisorProof.agentVersion) === cleanVersion(candidateAgentVersion)
+          && Date.parse(String(supervisorProof.receivedAt || '')) >= connectedAtEpochMs;
+        const requiredStabilityMs = hasSupervisorProof
+          ? run.verifiedClientRestartStabilityMs
+          : run.clientRestartStabilityMs;
+        const qualifiesForStability = device?.connected === true
           && !!sessionId
           && candidatePid > 1
           && sessionId !== target.dispatchedSessionId
@@ -546,9 +581,10 @@ export function createLiveDeskUpdateManager({
         const sameCandidate = qualifiesForStability
           && target.candidateSessionId === sessionId
           && target.candidatePid === candidatePid
-          && target.candidateConnectedAt === connectedAt
-          && target.candidateProductVersion === candidateProductVersion
-          && target.candidateAgentVersion === candidateAgentVersion;
+          && target.candidateConnectedAt === connectedAt
+          && target.candidateProductVersion === candidateProductVersion
+          && target.candidateAgentVersion === candidateAgentVersion
+          && target.candidateSupervisorProofId === (hasSupervisorProof ? supervisorProofId : '');
 
         if (!qualifiesForStability) {
           resetReconnectCandidate(target);
@@ -556,12 +592,18 @@ export function createLiveDeskUpdateManager({
           target.candidateSessionId = sessionId;
           target.candidatePid = candidatePid;
           target.candidateConnectedAt = connectedAt;
-          target.candidateProductVersion = candidateProductVersion;
-          target.candidateAgentVersion = candidateAgentVersion;
-          target.candidateSince = new Date(currentTime).toISOString();
-          target.stabilityDeadlineAt = new Date(
-            currentTime + run.clientRestartStabilityMs
-          ).toISOString();
+          target.candidateProductVersion = candidateProductVersion;
+          target.candidateAgentVersion = candidateAgentVersion;
+          target.candidateSupervisorProofId = hasSupervisorProof ? supervisorProofId : '';
+          target.verificationSource = hasSupervisorProof ? 'supervisor-proof' : 'hub-session';
+          target.requiredStabilityMs = requiredStabilityMs;
+          target.supervisorProofAt = hasSupervisorProof
+            ? String(supervisorProof.receivedAt || supervisorProof.completedAt || '')
+            : '';
+          target.candidateSince = new Date(currentTime).toISOString();
+          target.stabilityDeadlineAt = new Date(
+            currentTime + requiredStabilityMs
+          ).toISOString();
         }
 
         if (qualifiesForStability
@@ -646,8 +688,9 @@ export function createLiveDeskUpdateManager({
       latestManagerVersion: release.latestManagerVersion,
       latestClientVersion: release.latestClientVersion,
       needsHubRestart,
-      batchSize: effectiveClientBatchSize,
-      clientRestartStabilityMs: effectiveClientRestartStabilityMs,
+      batchSize: effectiveClientBatchSize,
+      clientRestartStabilityMs: effectiveClientRestartStabilityMs,
+      verifiedClientRestartStabilityMs: effectiveVerifiedClientRestartStabilityMs,
       error: '',
       targets: targets.map(device => ({
         deviceId: String(device.deviceId || ''),
@@ -666,9 +709,13 @@ export function createLiveDeskUpdateManager({
         candidateSessionId: '',
         candidatePid: 0,
         candidateConnectedAt: '',
-        candidateProductVersion: '',
-        candidateAgentVersion: '',
-        candidateSince: '',
+        candidateProductVersion: '',
+        candidateAgentVersion: '',
+        candidateSupervisorProofId: '',
+        verificationSource: '',
+        requiredStabilityMs: 0,
+        supervisorProofAt: '',
+        candidateSince: '',
         stabilityDeadlineAt: '',
         completedAt: '',
         error: ''
@@ -698,7 +745,9 @@ export function createLiveDeskUpdateManager({
 
   const handleRemoteEvent = (type, event) => {
     if (!run || run.state !== 'waiting-for-clients') return;
-    if (type === 'RemoteDeviceConnected' || type === 'RemoteDeviceDisconnected') {
+    if (type === 'RemoteDeviceConnected'
+      || type === 'RemoteDeviceDisconnected'
+      || type === 'RemoteClientUpdateVerified') {
       verifyTargets();
       return;
     }

package/src/remote-hub.js

@@ -286,7 +286,7 @@ function normalizePort(value) {
     return clampNumber(value, 0, 65535, DEFAULT_REMOTE_HUB_PORT);
 }
 
-function safeString(value, maxLength = 200) {
+function safeString(value, maxLength = 200) {
     return String(value ?? '').replace(/[\r\n\t]/g, ' ').trim().slice(0, maxLength);
 }
 
@@ -1123,6 +1123,42 @@ function safeText(value, maxLength = 1000) {
     return String(value ?? '').replace(/\0/g, '').trim().slice(0, maxLength);
 }
 
+function normalizeClientUpdateVerifiedProof(device, message, receivedAt) {
+    const operationId = safeString(message?.operationId, 180);
+    const attemptId = safeString(message?.attemptId, 180);
+    const productVersion = safeString(message?.productVersion, 40);
+    const agentVersion = safeString(message?.agentVersion, 40);
+    const completedAt = safeString(message?.completedAt, 64);
+    const launcherPid = Math.max(0, Math.floor(Number(message?.launcherPid) || 0));
+    const agentPid = Math.max(0, Math.floor(Number(message?.agentPid) || 0));
+    const supervisorPid = Math.max(0, Math.floor(Number(message?.supervisorPid) || 0));
+    if (!operationId
+        || !attemptId
+        || !productVersion
+        || !agentVersion
+        || !Number.isFinite(Date.parse(completedAt))
+        || launcherPid <= 1
+        || agentPid <= 1
+        || supervisorPid <= 1
+        || agentPid !== Number(device?.pid || 0)
+        || productVersion !== String(device?.productVersion || '')
+        || agentVersion !== String(device?.agentVersion || '')) {
+        return null;
+    }
+    return {
+        operationId,
+        attemptId,
+        sessionId: String(device.sessionId || ''),
+        launcherPid,
+        agentPid,
+        supervisorPid,
+        productVersion,
+        agentVersion,
+        completedAt,
+        receivedAt
+    };
+}
+
 function normalizeRemoteKeyboardKey(value) {
     const raw = String(value ?? '').replace(/\0/g, '');
     return raw === ' ' ? ' ' : safeString(raw, 80);
@@ -1626,8 +1662,9 @@ function serializeDevice(device, options = {}) {
                 byteLength: device.latestAudioFrame.byteLength
             }
             : null,
-        latestAudioStatus: device.latestAudioStatus ? { ...device.latestAudioStatus } : null,
-        udp: device.udp ? { ...device.udp } : { enabled: false, state: 'tcp-only', ready: false },
+        latestAudioStatus: device.latestAudioStatus ? { ...device.latestAudioStatus } : null,
+        clientUpdateProof: device.clientUpdateProof ? { ...device.clientUpdateProof } : null,
+        udp: device.udp ? { ...device.udp } : { enabled: false, state: 'tcp-only', ready: false },
         latestTask: device.latestTask ? { ...device.latestTask } : null,
         synthetic: device.synthetic === true,
         recentTasks: Array.isArray(device.recentTasks)
@@ -4427,8 +4464,9 @@ export function createRemoteHub(options = {}) {
             liveCapturePause: existing?.liveCapturePause || null,
             activeAudioStream: null,
             latestAudioFrame: null,
-            latestAudioStatus: null,
-            udp: {
+            latestAudioStatus: null,
+            clientUpdateProof: null,
+            udp: {
                 enabled: capabilities.udpP2p === true,
                 state: 'tcp-only',
                 ready: false,
@@ -7441,7 +7479,7 @@ export function createRemoteHub(options = {}) {
                 device.counters.statusReceived += 1;
                 emitRemoteEvent('RemoteDeviceStatus', device);
                 break;
-            case 'command.result':
+            case 'command.result':
             case 'command.error':
                 device.counters.commandResultsReceived += 1;
                 {
@@ -7469,9 +7507,23 @@ export function createRemoteHub(options = {}) {
                     commandId: safeString(message.commandId, 128),
                     result: message.result ?? null,
                     error: safeString(message.error, 500)
-                });
-                break;
-            case 'input.applied':
+                });
+                break;
+            case 'client.update.verified': {
+                const receivedAt = new Date().toISOString();
+                const proof = normalizeClientUpdateVerifiedProof(device, message, receivedAt);
+                if (!proof) {
+                    logWarn(
+                        'remote',
+                        `ignored invalid Client update supervisor proof from ${device.deviceName} (${device.deviceId})`
+                    );
+                    break;
+                }
+                device.clientUpdateProof = proof;
+                emitRemoteEvent('RemoteClientUpdateVerified', device, { proof });
+                break;
+            }
+            case 'input.applied':
             case 'input.error':
                 handleRemoteInputOutcome(device, message, 'main');
                 break;

package/src/server.js

@@ -51,8 +51,13 @@ import { normalizeRuntimeAuthSession, runtimeRoleError } from '../../runtime-cor
 import { fetchAuthResponse, AUTH_REQUEST_TIMEOUT_MS } from '../../runtime-core/src/auth-http.js';
 import { PRODUCTION_SUPABASE_PUBLISHABLE_KEY, PRODUCTION_SUPABASE_URL } from '../../runtime-core/src/auth-config.js';
 import { createHubRuntime } from './runtime/hub-runtime.js';
-import { hubRuntimeStatus } from './runtime/hub-runtime-status.js';
-import { roleGuardResponse } from './http/hub-role-guard.js';
+import { hubRuntimeStatus } from './runtime/hub-runtime-status.js';
+import { roleGuardResponse } from './http/hub-role-guard.js';
+import {
+  clearHubUiSessionCookie,
+  createHubUiSessionAuthority,
+  serializeHubUiSessionCookie
+} from './http/hub-ui-session.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const webDistCandidates = [
@@ -182,9 +187,10 @@ const persistentSessionGcToken = persistentSessionGcEnabled
   ? String(process.env.LIVEDESK_PERSISTENT_SESSION_TEST_TOKEN || '').trim()
   : '';
 let connectedDeviceCount = 0;
-let runtimeAccessToken = '';
-let runtimeRefreshToken = '';
-let runtimeAccessTokenExpiresAt = 0;
+let runtimeAccessToken = '';
+let runtimeRefreshToken = '';
+let runtimeAccessTokenExpiresAt = 0;
+const hubUiSessionAuthority = createHubUiSessionAuthority();
 let roleWatchInFlight = false;
 let verifiedLicense = {
   userId: '',
@@ -485,11 +491,12 @@ function clearPersistedRuntimeSession() {
   return writePrivateRuntimeAuthState(state);
 }
 
-function clearRuntimeSession() {
-  runtimeAccessToken = '';
-  runtimeRefreshToken = '';
-  runtimeAccessTokenExpiresAt = 0;
-  runtimeManager.setAuthenticated(false);
+function clearRuntimeSession() {
+  runtimeAccessToken = '';
+  runtimeRefreshToken = '';
+  runtimeAccessTokenExpiresAt = 0;
+  hubUiSessionAuthority.revokeAll();
+  runtimeManager.setAuthenticated(false);
   try { clearPersistedRuntimeSession(); } catch { /* runtime auth is already invalid */ }
 }
 
@@ -1405,7 +1412,7 @@ function requestHostname(req) {
   }
 }
 
-function isTrustedBrowserRequest(req) {
+function isTrustedBrowserRequest(req) {
   const origin = String(req.headers.origin || '').trim();
   if (!origin) {
     const fetchSite = String(req.headers['sec-fetch-site'] || '').toLowerCase();
@@ -1422,22 +1429,59 @@ function isTrustedBrowserRequest(req) {
     const targetHost = requestHostname(req);
     return (originHost === targetHost && isPrivateHubHostname(targetHost))
       || (isLoopbackHostname(originHost) && isLoopbackHostname(targetHost));
-  } catch {
-    return false;
-  }
-}
-
-app.use((req, res, next) => {
+  } catch {
+    return false;
+  }
+}
+
+function isSecureHubHttpRequest(req) {
+  return req.socket?.encrypted === true
+    || String(req.headers['x-forwarded-proto'] || '').trim().toLowerCase() === 'https';
+}
+
+function currentBoundHubUserId() {
+  return String(
+    runtimeManager.getSnapshot().userId
+    || readPersistedRuntimeSession()?.user?.id
+    || ''
+  ).trim();
+}
+
+function isPublicHubApiRequest(req) {
+  const method = String(req.method || 'GET').toUpperCase();
+  const path = String(req.path || '');
+  return (method === 'GET' && (path === '/api/health' || path === '/api/runtime/status' || path === '/api/auth/status'))
+    || (method === 'POST' && path === '/api/auth/session');
+}
+
+function isTrustedNativeLoopbackRequest(req) {
+  return isLoopbackAddress(req.socket?.remoteAddress)
+    && !String(req.headers.origin || '').trim()
+    && !String(req.headers['sec-fetch-site'] || '').trim();
+}
+
+function authorizeHubUiRequest(req) {
+  if (process.env.LIVEDESK_TEST_MODE === '1') {
+    return { ok: true, explicitTestMode: true };
+  }
+  if (isTrustedNativeLoopbackRequest(req)) {
+    return { ok: true, nativeLoopback: true };
+  }
+  return hubUiSessionAuthority.authorize(req, currentBoundHubUserId());
+}
+
+app.use((req, res, next) => {
   if (!isTrustedBrowserRequest(req)) {
     res.status(403).json({ ok: false, error: 'untrusted-hub-origin' });
     return;
   }
   const origin = String(req.headers.origin || '').trim();
   if (origin) {
-    res.setHeader('Access-Control-Allow-Origin', origin);
-    res.setHeader('Access-Control-Allow-Private-Network', 'true');
+    res.setHeader('Access-Control-Allow-Origin', origin);
+    res.setHeader('Access-Control-Allow-Credentials', 'true');
+    res.setHeader('Access-Control-Allow-Private-Network', 'true');
     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-LiveDesk-CSRF');
     res.setHeader('Vary', 'Origin, Access-Control-Request-Headers, Access-Control-Request-Private-Network');
   }
   if (req.method === 'OPTIONS') {
@@ -1446,8 +1490,21 @@ app.use((req, res, next) => {
   }
   next();
 });
-app.use(express.json({ limit: '32mb' }));
-app.use((req, res, next) => {
+app.use(express.json({ limit: '32mb' }));
+app.use((req, res, next) => {
+  if (!req.path.startsWith('/api/') || isPublicHubApiRequest(req)) {
+    next();
+    return;
+  }
+  const authorization = authorizeHubUiRequest(req);
+  if (!authorization.ok) {
+    noStore(res);
+    res.status(authorization.status).json({ ok: false, error: authorization.error });
+    return;
+  }
+  next();
+});
+app.use((req, res, next) => {
   if (runtimeRole === 'client' && req.path.startsWith('/api/remote')) {
     res.status(403).json(roleGuardResponse(runtimeRole, 'hub'));
     return;
@@ -4351,10 +4408,19 @@ app.post('/api/auth/session', async (req, res) => {
     res.status(400).json({ ok: false, error: normalized.error });
     return;
   }
-  const { access_token: accessToken, refresh_token: refreshToken, expires_at: expiresAt } = normalized.session;
-  try {
-    const user = await verifySupabaseUser(accessToken);
-    runtimeAccessToken = accessToken;
+  const { access_token: accessToken, refresh_token: refreshToken, expires_at: expiresAt } = normalized.session;
+  try {
+    const user = await verifySupabaseUser(accessToken);
+    const boundUserId = currentBoundHubUserId();
+    if (boundUserId && boundUserId !== user.id) {
+      res.status(403).json({ ok: false, error: 'hub-account-mismatch' });
+      return;
+    }
+    if (!boundUserId && !isLoopbackAddress(req.socket?.remoteAddress)) {
+      res.status(403).json({ ok: false, error: 'hub-first-account-binding-must-be-local' });
+      return;
+    }
+    runtimeAccessToken = accessToken;
     runtimeRefreshToken = refreshToken;
     runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(expiresAt);
     runtimeManager.setAuthenticated(true, user.id);
@@ -4367,10 +4433,25 @@ app.post('/api/auth/session', async (req, res) => {
     const hostTarget = runtimeRole === 'hub'
       ? await publishHubHostTargetWithPendingRoleTakeover('session-received')
       : { ok: true, active: false };
-    if (runtimeRole === 'hub') {
-      startHubHostTargetLeaseRenewal();
-    }
-    res.json({ ok: true, authenticated: true, persisted, userId: user.id, role: runtimeRole, hostTarget });
+    if (runtimeRole === 'hub') {
+      startHubHostTargetLeaseRenewal();
+    }
+    const uiSession = hubUiSessionAuthority.issue(user.id);
+    res.setHeader('Set-Cookie', serializeHubUiSessionCookie(uiSession.sessionId, uiSession.expiresAt, {
+      secure: isSecureHubHttpRequest(req)
+    }));
+    res.json({
+      ok: true,
+      authenticated: true,
+      persisted,
+      userId: user.id,
+      role: runtimeRole,
+      hostTarget,
+      uiSession: {
+        csrfToken: uiSession.csrfToken,
+        expiresAt: uiSession.expiresAt
+      }
+    });
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     const status = authVerificationHttpStatus(message);
@@ -4666,14 +4747,15 @@ function startHubHostTargetLeaseRenewal() {
   hubHostTargetRenewTimer.unref?.();
 }
 
-app.delete('/api/auth/session', async (_req, res) => {
+app.delete('/api/auth/session', async (req, res) => {
   noStore(res);
   const hostTarget = runtimeRole === 'hub'
     ? await clearHubHostTarget('logout')
     : { ok: true, active: false };
-  clearRuntimeSession();
-  res.json({ ok: true, authenticated: false, role: runtimeRole, hostTarget });
-});
+  clearRuntimeSession();
+  res.setHeader('Set-Cookie', clearHubUiSessionCookie({ secure: isSecureHubHttpRequest(req) }));
+  res.json({ ok: true, authenticated: false, role: runtimeRole, hostTarget });
+});
 
 app.get('/api/hub/status', (_req, res) => {
   noStore(res);
@@ -5474,13 +5556,20 @@ if (existsSync(webIndexPath)) {
   });
 }
 
-httpServer.on('upgrade', (req, socket, head) => {
-  if (!isTrustedBrowserRequest(req)) {
-    socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
-    socket.destroy();
-    return;
-  }
-  try {
+httpServer.on('upgrade', (req, socket, head) => {
+  if (!isTrustedBrowserRequest(req)) {
+    socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+    return;
+  }
+  const authorization = authorizeHubUiRequest(req);
+  if (!authorization.ok) {
+    const label = authorization.status === 403 ? 'Forbidden' : 'Unauthorized';
+    socket.write(`HTTP/1.1 ${authorization.status} ${label}\r\nConnection: close\r\n\r\n`);
+    socket.destroy();
+    return;
+  }
+  try {
     const parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
     if (parsed.pathname === '/api/remote/frames/ws') {
       frameWss.handleUpgrade(req, socket, head, ws => frameWss.emit('connection', ws, req));