@livedesk/hub 0.1.58 → 0.1.59

package/src/console-direct.test.mjs

@@ -8,6 +8,7 @@ import {
   encodeDirectConsoleWireMessage
 } from '../../runtime-core/src/console-direct-wire.js';
 import { consoleDirectContract, createHubConsoleDirect } from './console-direct.js';
+import { workspaceRoleCanRequest } from './auth/workspace-access.js';
 
 assert.equal(consoleDirectContract.maxDefaultRetryDelayMs, 20_000);
 assert.equal(consoleDirectContract.peerDisconnectedTimeoutMs, 5_000);
@@ -23,6 +24,10 @@ const CONNECTION_ONE = '33333333-3333-4333-8333-333333333333';
 const CONNECTION_TWO = '44444444-4444-4444-8444-444444444444';
 const CHANNEL_ID = '55555555-5555-4555-8555-555555555555';
 const REQUEST_ID = '66666666-6666-4666-8666-666666666666';
+const TEAM_WORKSPACE_ID = '88888888-8888-4888-8888-888888888888';
+const TEAM_OWNER_USER_ID = '99999999-9999-4999-8999-999999999999';
+const TEAM_OPERATOR_USER_ID = 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa';
+const CONSOLE_PROXY_TOKEN = 'test-console-proxy-token';
 
 class FakeSocket extends EventEmitter {
   static CONNECTING = 0;
@@ -225,6 +230,8 @@ async function connectedDirect(options = {}) {
     httpBaseUrl: 'http://127.0.0.1:5179',
     stunUrls: options.stunUrls || ['stun:stun.example.test:3478'],
     getAccessToken: async () => 'access-token',
+    ...(options.workspaceAccess ? { getWorkspaceAccess: () => options.workspaceAccess } : {}),
+    ...(options.consoleProxyToken ? { consoleProxyToken: options.consoleProxyToken } : {}),
     SignalingWebSocketImpl: FakeSignalSocket,
     LocalWebSocketImpl: FakeLocalSocket,
     createPeerConnection: (name, config) => new FakePeerConnection(name, config),
@@ -263,18 +270,23 @@ async function connectedDirect(options = {}) {
     type: 'signal-ready',
     role: 'hub',
     deviceId: 'hub-device',
-    hubEpoch: HUB_EPOCH
+    hubEpoch: HUB_EPOCH,
+    ...(options.workspaceAccess ? {
+      workspaceId: options.workspaceAccess.workspaceId,
+      workspaceKind: options.workspaceAccess.workspaceKind
+    } : {})
   }), false);
   return { direct, signal };
 }
 
-function offer(signal, connectionId = CONNECTION_ONE, sdp = 'v=0\r\na=fake-offer\r\n') {
+function offer(signal, connectionId = CONNECTION_ONE, sdp = 'v=0\r\na=fake-offer\r\n', extra = {}) {
   signal.receive(JSON.stringify({
     type: 'rtc-offer',
     consoleId: CONSOLE_ID,
     connectionId,
     hubEpoch: HUB_EPOCH,
-    description: { type: 'offer', sdp }
+    description: { type: 'offer', sdp },
+    ...extra
   }), false);
   return FakePeerConnection.instances.at(-1);
 }
@@ -615,6 +627,323 @@ test('reliable control channel bridges bounded HTTP over fragmented wire message
   direct.close();
 });
 
+test('Team Operator can use Wall and Control but cannot mutate the Hub owner runtime', async () => {
+  const teamWorkspaceAccess = {
+    workspaceId: TEAM_WORKSPACE_ID,
+    workspaceKind: 'team',
+    role: 'owner',
+    membershipRevision: 7
+  };
+  const fetched = [];
+  const { direct, signal } = await connectedDirect({
+    workspaceAccess: teamWorkspaceAccess,
+    consoleProxyToken: CONSOLE_PROXY_TOKEN,
+    fetchImpl: async (url, init) => {
+      fetched.push({ url: String(url), init });
+      return new Response('{"ok":true}', {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' }
+      });
+    }
+  });
+  assert.equal(new URL(signal.url).searchParams.get('workspaceId'), TEAM_WORKSPACE_ID);
+  const hubChallengeNonce = 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb';
+  signal.receive(JSON.stringify({
+    type: 'workspace-reauth-required',
+    workspaceId: TEAM_WORKSPACE_ID,
+    challengeNonce: hubChallengeNonce,
+    deadlineAt: Date.now() + 15_000
+  }), false);
+  await waitFor(() => fetched.some(call => call.url.endsWith('/v2/rtc/reauth')));
+  const hubReauth = fetched.find(call => call.url.endsWith('/v2/rtc/reauth'));
+  assert.equal(hubReauth.init.headers.Authorization, 'Bearer access-token');
+  assert.deepEqual(JSON.parse(hubReauth.init.body), {
+    workspaceId: TEAM_WORKSPACE_ID,
+    challengeNonce: hubChallengeNonce
+  });
+  assert.equal(
+    signalingMessages(signal).some(message => JSON.stringify(message).includes('access-token')),
+    false,
+    'A bearer token must never be sent through the signaling WebSocket.'
+  );
+  fetched.length = 0;
+  const accessExpiresAt = Date.now() + 60_000;
+  const peer = offer(signal, CONNECTION_ONE, 'v=0\r\na=fake-offer\r\n', {
+    workspaceId: TEAM_WORKSPACE_ID,
+    workspaceKind: 'team',
+    memberUserId: TEAM_OPERATOR_USER_ID,
+    memberRole: 'operator',
+    membershipRevision: 7,
+    accessExpiresAt
+  });
+  assert.ok(peer);
+  const control = new FakeDataChannel('livedesk-control-v1');
+  peer.emitDataChannel(control);
+  control.open();
+
+  sendWire(control, {
+    type: 'http-request',
+    requestId: CHANNEL_ID,
+    method: 'POST',
+    path: '/api/auth/session',
+    headers: { 'content-type': 'application/json' },
+    bodyBase64: Buffer.from(JSON.stringify({ workspaceId: TEAM_WORKSPACE_ID })).toString('base64')
+  }, { messageId: 30 });
+  await settle();
+  assert.equal(fetched.length, 1);
+  assert.equal(fetched[0].url, 'http://127.0.0.1:5179/api/auth/session');
+  assert.deepEqual(JSON.parse(Buffer.from(fetched[0].init.body).toString('utf8')), {
+    workspaceId: TEAM_WORKSPACE_ID
+  });
+  assert.equal(fetched[0].init.headers.Authorization, undefined);
+  fetched.length = 0;
+
+  sendWire(control, {
+    type: 'http-request',
+    requestId: REQUEST_ID,
+    method: 'POST',
+    path: '/api/update/apply'
+  }, { messageId: 31 });
+  await settle();
+  let responses = decodeWireMessages(control.sent).map(message => JSON.parse(message.data));
+  const forbidden = responses.find(message => message.requestId === REQUEST_ID);
+  assert.equal(forbidden?.status, 403);
+  assert.equal(forbidden?.error, 'workspace-owner-required');
+  assert.equal(fetched.length, 0, 'A denied Operator request must never reach the local Hub API.');
+
+  sendWire(control, {
+    type: 'http-request',
+    requestId: HUB_EPOCH_TWO,
+    method: 'POST',
+    path: '/api/remote/devices/client-1/input',
+    headers: { 'content-type': 'application/json' },
+    bodyBase64: Buffer.from('{"type":"pointermove"}').toString('base64')
+  }, { messageId: 32 });
+  await settle();
+  assert.equal(fetched.length, 1);
+  assert.equal(fetched[0].url, 'http://127.0.0.1:5179/api/remote/devices/client-1/input');
+  assert.equal(fetched[0].init.headers['X-LiveDesk-Console-Proxy'], CONSOLE_PROXY_TOKEN);
+  assert.equal(fetched[0].init.headers['X-LiveDesk-Workspace-Id'], TEAM_WORKSPACE_ID);
+  assert.equal(fetched[0].init.headers['X-LiveDesk-Workspace-User-Id'], TEAM_OPERATOR_USER_ID);
+  assert.equal(fetched[0].init.headers['X-LiveDesk-Workspace-Role'], 'operator');
+  responses = decodeWireMessages(control.sent).map(message => JSON.parse(message.data));
+  assert.equal(responses.find(message => message.requestId === HUB_EPOCH_TWO)?.status, 200);
+
+  signal.receive(JSON.stringify({
+    type: 'workspace-access-refreshed',
+    consoleId: CONSOLE_ID,
+    connectionId: CONNECTION_ONE,
+    hubEpoch: HUB_EPOCH,
+    workspaceId: TEAM_WORKSPACE_ID,
+    workspaceKind: 'team',
+    memberUserId: TEAM_OPERATOR_USER_ID,
+    memberRole: 'operator',
+    membershipRevision: 8,
+    accessExpiresAt: Date.now() + 60_000
+  }), false);
+  assert.equal(direct.inspect().peerConnections, 1, 'A successful Team reauth must preserve the healthy P2P peer.');
+  assert.equal(direct.revokeWorkspaceMember(TEAM_WORKSPACE_ID, TEAM_OPERATOR_USER_ID), 1);
+  assert.equal(peer.closed, true);
+  assert.equal(direct.inspect().peerConnections, 0);
+  assert.equal(direct.inspect().controlChannels, 0);
+  const peerCountBeforeReoffer = FakePeerConnection.instances.length;
+  offer(signal, CONNECTION_TWO, 'v=0\r\na=fake-offer\r\n', {
+    workspaceId: TEAM_WORKSPACE_ID,
+    workspaceKind: 'team',
+    memberUserId: TEAM_OPERATOR_USER_ID,
+    memberRole: 'operator',
+    membershipRevision: 8,
+    accessExpiresAt: Date.now() + 60_000
+  });
+  assert.equal(FakePeerConnection.instances.length, peerCountBeforeReoffer);
+  assert.equal(direct.inspect().peerConnections, 0);
+  assert.equal(direct.inspect().revokedMemberFences, 1);
+  assert.equal(signalingMessages(signal).at(-1).reason, 'workspace-member-revoked');
+  direct.close();
+  assert.equal(direct.inspect().resourceTimers, 0);
+});
+
+test('Team peer access refresh replaces the exact deadline and signaling loss cannot extend access', async () => {
+  const { direct, signal } = await connectedDirect({
+    retryDelaysMs: [60_000],
+    workspaceAccess: {
+      workspaceId: TEAM_WORKSPACE_ID,
+      workspaceKind: 'team',
+      role: 'owner',
+      membershipRevision: 7
+    }
+  });
+  const peer = offer(signal, CONNECTION_ONE, 'v=0\r\na=fake-offer\r\n', {
+    workspaceId: TEAM_WORKSPACE_ID,
+    workspaceKind: 'team',
+    memberUserId: TEAM_OPERATOR_USER_ID,
+    memberRole: 'operator',
+    membershipRevision: 7,
+    accessExpiresAt: Date.now() + 30
+  });
+  const control = new FakeDataChannel('livedesk-control-v1');
+  peer.emitDataChannel(control);
+  control.open();
+  signal.receive(JSON.stringify({
+    type: 'workspace-access-refreshed',
+    consoleId: CONSOLE_ID,
+    connectionId: CONNECTION_ONE,
+    hubEpoch: HUB_EPOCH,
+    workspaceId: TEAM_WORKSPACE_ID,
+    workspaceKind: 'team',
+    memberUserId: TEAM_OPERATOR_USER_ID,
+    memberRole: 'operator',
+    membershipRevision: 8,
+    accessExpiresAt: Date.now() + 100
+  }), false);
+  signal.close(1012, 'signaling-temporarily-offline');
+  await new Promise(resolve => setTimeout(resolve, 45));
+  assert.equal(peer.closed, false, 'The stale pre-refresh deadline must not close a refreshed peer.');
+  assert.equal(direct.inspect().peerConnections, 1);
+  await waitFor(() => peer.closed, 150);
+  assert.equal(direct.inspect().peerConnections, 0, 'A lost signaling socket must not extend Team access past its verified deadline.');
+  assert.equal(direct.inspect().localWebSocketChannels, 0);
+  direct.close();
+  assert.equal(direct.inspect().resourceTimers, 0);
+});
+
+test('verified Personal Owner, Team Owner and Team Operator auth bootstrap discards every caller credential', async () => {
+  for (const scenario of [
+    {
+      workspaceId: TEAM_WORKSPACE_ID,
+      workspaceKind: 'team',
+      userId: TEAM_OWNER_USER_ID,
+      role: 'owner',
+      accessExpiresAt: Date.now() + 60_000
+    },
+    {
+      workspaceId: TEAM_WORKSPACE_ID,
+      workspaceKind: 'team',
+      userId: TEAM_OPERATOR_USER_ID,
+      role: 'operator',
+      accessExpiresAt: Date.now() + 60_000
+    },
+    {
+      workspaceId: TEAM_OWNER_USER_ID,
+      workspaceKind: 'personal',
+      userId: TEAM_OWNER_USER_ID,
+      role: 'owner',
+      accessExpiresAt: 0
+    }
+  ]) {
+    const fetched = [];
+    const { direct, signal } = await connectedDirect({
+      workspaceAccess: {
+        workspaceId: scenario.workspaceId,
+        workspaceKind: scenario.workspaceKind,
+        role: 'owner',
+        membershipRevision: 3
+      },
+      consoleProxyToken: CONSOLE_PROXY_TOKEN,
+      fetchImpl: async (url, init) => {
+        fetched.push({ url: String(url), init });
+        return new Response('{"ok":true}', { headers: { 'Content-Type': 'application/json' } });
+      }
+    });
+    const peer = offer(signal, CONNECTION_ONE, 'v=0\r\na=fake-offer\r\n', {
+      workspaceId: scenario.workspaceId,
+      workspaceKind: scenario.workspaceKind,
+      memberUserId: scenario.userId,
+      memberRole: scenario.role,
+      membershipRevision: 3,
+      accessExpiresAt: scenario.accessExpiresAt
+    });
+    const control = new FakeDataChannel('livedesk-control-v1');
+    peer.emitDataChannel(control);
+    control.open();
+    sendWire(control, {
+      type: 'http-request',
+      requestId: REQUEST_ID,
+      method: 'POST',
+      path: '/api/auth/session',
+      headers: {
+        accept: 'application/attacker-controlled',
+        'content-type': 'text/plain',
+        'if-match': 'attacker-etag',
+        range: 'bytes=0-999',
+        'x-livedesk-csrf': 'attacker-csrf'
+      },
+      bodyBase64: Buffer.from(JSON.stringify({
+        workspaceId: HUB_EPOCH_TWO,
+        accessToken: 'attacker-access-token',
+        refreshToken: 'attacker-refresh-token',
+        user: { id: HUB_EPOCH_TWO },
+        userId: HUB_EPOCH_TWO,
+        expiresAt: 9_999_999_999
+      })).toString('base64')
+    });
+    await settle();
+    assert.equal(fetched.length, 1);
+    assert.equal(fetched[0].init.headers.Authorization, undefined);
+    assert.equal(fetched[0].init.headers['X-LiveDesk-Workspace-Role'], scenario.role);
+    assert.equal(fetched[0].init.headers['X-LiveDesk-Workspace-Kind'], scenario.workspaceKind);
+    assert.equal(fetched[0].init.headers['content-type'], 'application/json');
+    assert.equal(fetched[0].init.headers.accept, undefined);
+    assert.equal(fetched[0].init.headers['if-match'], undefined);
+    assert.equal(fetched[0].init.headers.range, undefined);
+    assert.equal(fetched[0].init.headers['x-livedesk-csrf'], undefined);
+    assert.deepEqual(JSON.parse(Buffer.from(fetched[0].init.body).toString('utf8')), {
+      workspaceId: scenario.workspaceId
+    });
+    direct.close();
+  }
+});
+
+test('cross-workspace Worker claims are rejected before allocating a P2P peer', async () => {
+  const { direct, signal } = await connectedDirect({
+    workspaceAccess: {
+      workspaceId: TEAM_WORKSPACE_ID,
+      workspaceKind: 'team',
+      role: 'owner',
+      membershipRevision: 1
+    }
+  });
+  offer(signal, CONNECTION_ONE, 'v=0\r\na=fake-offer\r\n', {
+    workspaceId: HUB_EPOCH_TWO,
+    workspaceKind: 'team',
+    memberUserId: TEAM_OPERATOR_USER_ID,
+    memberRole: 'operator',
+    membershipRevision: 1,
+    accessExpiresAt: Date.now() + 60_000
+  });
+  assert.equal(direct.inspect().peerConnections, 0);
+  assert.equal(signalingMessages(signal).some(message => (
+    message.type === 'rtc-close'
+      && message.reason === 'console-workspace-access-invalid'
+  )), true);
+  direct.close();
+});
+
+test('Operator request policy is limited to Wall, Control, audio and self sign-out', () => {
+  assert.equal(workspaceRoleCanRequest('operator', 'GET', '/api/hub/devices'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'GET', '/api/remote/devices/client-1/thumbnail'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'POST', '/api/remote/devices/client-1/thumbnail/request'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'GET', '/api/remote/devices/client-1/live/frame'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'POST', '/api/remote/devices/client-1/live/start'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'POST', '/api/remote/devices/client-1/input'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'POST', '/api/remote/devices/client-1/audio/start'), true);
+  assert.equal(workspaceRoleCanRequest('operator', 'DELETE', '/api/auth/session'), true);
+  for (const [method, path] of [
+    ['POST', '/api/runtime/restart'],
+    ['POST', '/api/runtime/shutdown'],
+    ['POST', '/api/runtime/role'],
+    ['POST', '/api/hub/sync'],
+    ['POST', '/api/update/apply'],
+    ['PATCH', '/api/settings/profile'],
+    ['POST', '/api/files/upload'],
+    ['POST', '/api/tasks'],
+    ['POST', `/api/remote/workspace/members/${TEAM_OWNER_USER_ID}/revoke`]
+  ]) {
+    assert.equal(workspaceRoleCanRequest('operator', method, path), false, `${method} ${path}`);
+  }
+  assert.equal(workspaceRoleCanRequest('owner', 'POST', '/api/update/apply'), true);
+});
+
 test('canonical HTTP routing rejects encoded, backslash, duplicate-slash, and external-origin bypasses', async () => {
   const fetchedUrls = [];
   const { direct, signal } = await connectedDirect({

package/src/http/hub-ui-session.js

@@ -34,33 +34,97 @@ function randomToken() {
   return crypto.randomBytes(32).toString('base64url');
 }
 
-export function createHubUiSessionAuthority({
-  ttlMs = HUB_UI_SESSION_TTL_MS,
-  maxSessions = 32,
-  now = () => Date.now()
-} = {}) {
-  const sessions = new Map();
+export function createHubUiSessionAuthority({
+  ttlMs = HUB_UI_SESSION_TTL_MS,
+  maxSessions = 32,
+  now = () => Date.now(),
+  onRevoke = () => {}
+} = {}) {
+  const sessions = new Map();
+
+  function dropSession(sessionId, reason) {
+    const session = sessions.get(sessionId);
+    if (!session) return null;
+    sessions.delete(sessionId);
+    try {
+      onRevoke({ sessionId, ...session }, String(reason || 'hub-ui-session-revoked'));
+    } catch {
+      // Revocation remains authoritative even if a best-effort socket cleanup
+      // listener fails. The next protected request still fails closed.
+    }
+    return session;
+  }
 
   function purgeExpired() {
-    const current = now();
-    for (const [sessionId, session] of sessions) {
-      if (session.expiresAt <= current) sessions.delete(sessionId);
-    }
-    while (sessions.size >= maxSessions) {
-      sessions.delete(sessions.keys().next().value);
+    const current = now();
+    for (const [sessionId, session] of sessions) {
+      if (session.expiresAt <= current
+        || (session.accessExpiresAt > 0 && session.accessExpiresAt <= current)) {
+        dropSession(sessionId, 'hub-ui-session-expired');
+      }
+    }
+    while (sessions.size >= maxSessions) {
+      dropSession(sessions.keys().next().value, 'hub-ui-session-capacity-evicted');
     }
   }
 
-  function issue(userId) {
-    const normalizedUserId = String(userId || '').trim();
-    if (!normalizedUserId) throw new Error('hub-ui-session-user-required');
-    purgeExpired();
-    const sessionId = randomToken();
-    const csrfToken = randomToken();
-    const expiresAt = now() + ttlMs;
-    sessions.set(sessionId, { userId: normalizedUserId, csrfToken, expiresAt });
-    return { sessionId, csrfToken, expiresAt };
-  }
+  function normalizedSessionAccess(userId, access = {}) {
+    const normalizedUserId = String(userId || '').trim();
+    if (!normalizedUserId) throw new Error('hub-ui-session-user-required');
+    const workspaceId = String(access.workspaceId || '').trim();
+    const workspaceKind = String(access.workspaceKind || 'personal').trim().toLowerCase();
+    const role = String(access.role || 'owner').trim().toLowerCase();
+    const entitlementStatus = String(access.entitlementStatus || 'active').trim().toLowerCase();
+    const membershipRevision = Math.max(0, Number(access.membershipRevision || 0));
+    const accessExpiresAt = Math.max(0, Number(access.accessExpiresAt || 0));
+    if (workspaceId && !['owner', 'operator'].includes(role)) {
+      throw new Error('hub-ui-session-workspace-role-invalid');
+    }
+    return {
+      userId: normalizedUserId,
+      workspaceId,
+      workspaceKind,
+      role,
+      plan: String(access.plan || 'free').trim().toLowerCase(),
+      entitlementStatus,
+      membershipRevision,
+      accessExpiresAt
+    };
+  }
+
+  function issue(userId, access = {}) {
+    const normalized = normalizedSessionAccess(userId, access);
+    purgeExpired();
+    const sessionId = randomToken();
+    const csrfToken = randomToken();
+    const expiresAt = now() + ttlMs;
+    sessions.set(sessionId, {
+      ...normalized,
+      csrfToken,
+      expiresAt
+    });
+    return { sessionId, csrfToken, expiresAt };
+  }
+
+  function renew(req, userId, access = {}) {
+    purgeExpired();
+    const sessionId = parseCookies(req?.headers?.cookie).get(HUB_UI_SESSION_COOKIE) || '';
+    const session = sessions.get(sessionId);
+    const normalized = normalizedSessionAccess(userId, access);
+    if (!session
+      || session.userId !== normalized.userId
+      || session.workspaceId !== normalized.workspaceId
+      || session.role !== normalized.role) {
+      return issue(userId, access);
+    }
+    const expiresAt = now() + ttlMs;
+    sessions.set(sessionId, {
+      ...session,
+      ...normalized,
+      expiresAt
+    });
+    return { sessionId, csrfToken: session.csrfToken, expiresAt, renewed: true };
+  }
 
   function authorize(req, currentUserId, {
     requireCsrf = !SAFE_HTTP_METHODS.has(String(req.method || 'GET').toUpperCase())
@@ -74,23 +138,82 @@ export function createHubUiSessionAuthority({
     if (!session) {
       return { ok: false, status: 401, error: 'hub-ui-session-expired' };
     }
-    const normalizedUserId = String(currentUserId || '').trim();
-    if (!normalizedUserId || session.userId !== normalizedUserId) {
-      sessions.delete(sessionId);
-      return { ok: false, status: 403, error: 'hub-ui-session-account-mismatch' };
+    const expected = currentUserId && typeof currentUserId === 'object'
+      ? currentUserId
+      : { userId: currentUserId };
+    const normalizedUserId = String(expected.userId || '').trim();
+    const expectedWorkspaceId = String(expected.workspaceId || '').trim();
+    const allowedRoles = new Set(Array.isArray(expected.allowedRoles)
+      ? expected.allowedRoles.map(role => String(role || '').trim().toLowerCase())
+      : ['owner', 'operator']);
+    const identityMismatch = expectedWorkspaceId
+      ? session.workspaceId !== expectedWorkspaceId || !allowedRoles.has(session.role)
+      : !normalizedUserId || session.userId !== normalizedUserId;
+    if (identityMismatch || (session.accessExpiresAt > 0 && session.accessExpiresAt <= now())) {
+      dropSession(sessionId, 'hub-ui-session-account-mismatch');
+      return { ok: false, status: 403, error: 'hub-ui-session-account-mismatch' };
     }
     if (requireCsrf && !secureEqual(req.headers?.['x-livedesk-csrf'], session.csrfToken)) {
       return { ok: false, status: 403, error: 'hub-ui-csrf-invalid' };
     }
-    return { ok: true, sessionId, userId: session.userId, expiresAt: session.expiresAt };
+    return {
+      ok: true,
+      sessionId,
+      userId: session.userId,
+      workspaceId: session.workspaceId,
+      workspaceKind: session.workspaceKind,
+      role: session.role,
+      plan: session.plan,
+      entitlementStatus: session.entitlementStatus,
+      membershipRevision: session.membershipRevision,
+      accessExpiresAt: session.accessExpiresAt,
+      expiresAt: session.expiresAt
+    };
   }
 
   return {
-    issue,
-    authorize,
-    revokeAll() {
-      sessions.clear();
-    },
+    issue,
+    renew,
+    authorize,
+    sessionDeadline(sessionId) {
+      purgeExpired();
+      const session = sessions.get(String(sessionId || ''));
+      if (!session) return 0;
+      return session.accessExpiresAt > 0
+        ? Math.min(session.expiresAt, session.accessExpiresAt)
+        : session.expiresAt;
+    },
+    revokeAll(reason = 'hub-ui-session-revoked-all') {
+      let revoked = 0;
+      for (const sessionId of [...sessions.keys()]) {
+        if (dropSession(sessionId, reason)) revoked += 1;
+      }
+      return revoked;
+    },
+    revokeWorkspaceMember(workspaceId, userId) {
+      const normalizedWorkspaceId = String(workspaceId || '').trim();
+      const normalizedUserId = String(userId || '').trim();
+      let revoked = 0;
+      for (const [sessionId, session] of sessions) {
+        if (session.workspaceId !== normalizedWorkspaceId || session.userId !== normalizedUserId) continue;
+        if (dropSession(sessionId, 'workspace-member-revoked')) revoked += 1;
+      }
+      return revoked;
+    },
+    revoke(req) {
+      const sessionId = parseCookies(req?.headers?.cookie).get(HUB_UI_SESSION_COOKIE) || '';
+      if (!sessionId) return null;
+      const session = dropSession(sessionId, 'hub-ui-session-signed-out');
+      return session ? {
+        sessionId,
+        userId: session.userId,
+        workspaceId: session.workspaceId,
+        workspaceKind: session.workspaceKind,
+        role: session.role,
+        plan: session.plan,
+        entitlementStatus: session.entitlementStatus
+      } : null;
+    },
     sessionCount: () => sessions.size
   };
 }