@meith/web 0.32.0 → 0.33.1

package/app/admin/layout.tsx

@@ -3,12 +3,17 @@ import { notFound } from 'next/navigation'
 
 import { ADMIN_IDLE_MINUTES } from '@meith/admin'
 
-import { AdminSignInForm, AdminSignOutForm } from '@/components/admin/admin-forms'
+import {
+  AdminSecondFactorForm,
+  AdminSignInForm,
+  AdminSignOutForm,
+} from '@/components/admin/admin-forms'
 import { AdminNav } from '@/components/admin/admin-nav'
 import { PanelShell } from '@/components/shell/panel-shell'
-import { askForPassword, resolveAdmin } from '@/server/admin'
+import { askForPassword, pendingAdminSecondFactor, resolveAdmin } from '@/server/admin'
 import { getActor } from '@/server/context'
 import { getTranslator, tr } from '@/server/i18n'
+import { twoFactorState } from '@/server/two-factor'
 import { adminFormsCopy } from '@/view/admin-panel-copy'
 import { buildPanelLinks } from '@/view/shell'
 
@@ -22,18 +27,28 @@ export default async function AdminLayout({ children }: { children: React.ReactN
   if ('denied' in resolved) {
     if (!askForPassword(resolved.denied)) notFound()
 
+    const copy = adminFormsCopy(await getTranslator())
+    const pending = await pendingAdminSecondFactor()
+
     return (
       <main
         id="board-content"
         tabIndex={-1}
         className="flex min-h-screen flex-col items-center justify-center gap-4 px-6 py-12"
       >
-        <AdminSignInForm
-          next="/admin"
-          reason={resolved.denied === 'expired' ? 'expired' : null}
-          idleMinutes={ADMIN_IDLE_MINUTES}
-          copy={adminFormsCopy(await getTranslator())}
-        />
+        {pending === null ? (
+          <AdminSignInForm
+            next="/admin"
+            reason={resolved.denied === 'expired' ? 'expired' : null}
+            idleMinutes={ADMIN_IDLE_MINUTES}
+            copy={copy}
+          />
+        ) : (
+          <AdminSecondFactorForm
+            recoveryCodesLeft={(await twoFactorState(pending.userId)).recoveryCodesLeft}
+            copy={copy}
+          />
+        )}
         <a href="/" className="text-sm text-muted-foreground hover:text-foreground">
           {await tr('adminPanel.cancel')}
         </a>

package/app/admin/system/page.tsx

@@ -53,7 +53,7 @@ export default async function AdminSystemPage() {
     )
   }
 
-  const { mail, scheduler, volumes } = view
+  const { mail, scheduler, volumes, legacyPasswordHashes } = view
 
   return (
     <PanelPage
@@ -252,6 +252,20 @@ export default async function AdminSystemPage() {
         </ul>
       </section>
 
+      {legacyPasswordHashes > 0 && (
+        <section className={PANEL_CARD}>
+          <h2 className="font-heading text-lg font-semibold">
+            {translator.t('adminSystem.legacyPasswords')}
+          </h2>
+          <p className="text-sm">
+            {translator.t('adminSystem.legacyPasswordsCount', { count: legacyPasswordHashes })}
+          </p>
+          <p className="text-sm text-muted-foreground">
+            {translator.t('adminSystem.legacyPasswordsHint')}
+          </p>
+        </section>
+      )}
+
       <section className={PANEL_CARD}>
         <h2 className="font-heading text-lg font-semibold">
           {translator.t('adminSystem.migrations')}

package/app/redirect/page.tsx

@@ -15,12 +15,13 @@ export async function generateMetadata(): Promise<Metadata> {
 export default async function RedirectPage({
   searchParams,
 }: {
-  searchParams: Promise<{ to?: string; message?: string }>
+  searchParams: Promise<{ to?: string; m?: string }>
 }) {
-  const { to, message } = await searchParams
+  const { to, m } = await searchParams
+  const translator = await getTranslator()
   const filtered = await filterView(
     'view.redirect-notice',
-    buildRedirectNotice(to, message),
+    buildRedirectNotice(to, m, translator),
     viewerRef(await getActor()),
   )
   const notice = { ...filtered, targetHref: localHref(filtered.targetHref) }
@@ -36,7 +37,7 @@ export default async function RedirectPage({
       >
         <RedirectNotice
           {...notice}
-          copy={slotCopy(await currentTheme(), 'RedirectNotice', await getTranslator())}
+          copy={slotCopy(await currentTheme(), 'RedirectNotice', translator)}
         />
       </main>
     </>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/web",
-  "version": "0.32.0",
+  "version": "0.33.1",
   "description": "The board itself: the Next.js app, and the forum-web bin that materializes it into an external board workspace.",
   "license": "MIT",
   "repository": {
@@ -43,54 +43,54 @@
     "react-dom": "19.2.8",
     "tailwindcss": "^4.3.3",
     "typescript": "7.0.2",
-    "@meith/accounts": "0.32.0",
-    "@meith/admin": "0.32.0",
-    "@meith/antispam": "0.32.0",
-    "@meith/api": "0.32.0",
-    "@meith/attachments": "0.32.0",
-    "@meith/authorization": "0.32.0",
-    "@meith/avatars": "0.32.0",
-    "@meith/board-digest": "0.32.0",
-    "@meith/core": "0.32.0",
-    "@meith/db": "0.32.0",
-    "@meith/demo": "0.32.0",
-    "@meith/drafts": "0.32.0",
-    "@meith/drivers": "0.32.0",
-    "@meith/events": "0.32.0",
-    "@meith/forums": "0.32.0",
-    "@meith/groups": "0.32.0",
-    "@meith/i18n": "0.32.0",
-    "@meith/import": "0.32.0",
-    "@meith/install": "0.32.0",
-    "@meith/mail": "0.32.0",
-    "@meith/markdown": "0.32.0",
-    "@meith/marketplace": "0.32.0",
-    "@meith/messages": "0.32.0",
-    "@meith/moderation": "0.32.0",
-    "@meith/notifications": "0.32.0",
-    "@meith/plugin-calendar": "0.32.0",
-    "@meith/plugin-dues": "0.32.0",
-    "@meith/plugin-kit": "0.32.0",
-    "@meith/polls": "0.32.0",
-    "@meith/posts": "0.32.0",
-    "@meith/profile-fields": "0.32.0",
-    "@meith/relations": "0.32.0",
-    "@meith/reputation": "0.32.0",
-    "@meith/runtime": "0.32.0",
-    "@meith/search": "0.32.0",
-    "@meith/settings": "0.32.0",
-    "@meith/signatures": "0.32.0",
-    "@meith/subscriptions": "0.32.0",
-    "@meith/tasks": "0.32.0",
-    "@meith/theme-clubhouse": "0.32.0",
-    "@meith/theme-default": "0.32.0",
-    "@meith/theme-kit": "0.32.0",
-    "@meith/theme-midnight": "0.32.0",
-    "@meith/theme-phasebook": "0.32.0",
-    "@meith/theme-raidframe": "0.32.0",
-    "@meith/threads": "0.32.0",
-    "@meith/ui": "0.32.0",
-    "@meith/upgrade": "0.32.0"
+    "@meith/accounts": "0.33.1",
+    "@meith/admin": "0.33.1",
+    "@meith/antispam": "0.33.1",
+    "@meith/api": "0.33.1",
+    "@meith/attachments": "0.33.1",
+    "@meith/authorization": "0.33.1",
+    "@meith/avatars": "0.33.1",
+    "@meith/board-digest": "0.33.1",
+    "@meith/core": "0.33.1",
+    "@meith/db": "0.33.1",
+    "@meith/demo": "0.33.1",
+    "@meith/drafts": "0.33.1",
+    "@meith/drivers": "0.33.1",
+    "@meith/events": "0.33.1",
+    "@meith/forums": "0.33.1",
+    "@meith/groups": "0.33.1",
+    "@meith/i18n": "0.33.1",
+    "@meith/import": "0.33.1",
+    "@meith/install": "0.33.1",
+    "@meith/mail": "0.33.1",
+    "@meith/markdown": "0.33.1",
+    "@meith/marketplace": "0.33.1",
+    "@meith/messages": "0.33.1",
+    "@meith/moderation": "0.33.1",
+    "@meith/notifications": "0.33.1",
+    "@meith/plugin-calendar": "0.33.1",
+    "@meith/plugin-dues": "0.33.1",
+    "@meith/plugin-kit": "0.33.1",
+    "@meith/polls": "0.33.1",
+    "@meith/posts": "0.33.1",
+    "@meith/profile-fields": "0.33.1",
+    "@meith/relations": "0.33.1",
+    "@meith/reputation": "0.33.1",
+    "@meith/runtime": "0.33.1",
+    "@meith/search": "0.33.1",
+    "@meith/settings": "0.33.1",
+    "@meith/signatures": "0.33.1",
+    "@meith/subscriptions": "0.33.1",
+    "@meith/tasks": "0.33.1",
+    "@meith/theme-clubhouse": "0.33.1",
+    "@meith/theme-default": "0.33.1",
+    "@meith/theme-kit": "0.33.1",
+    "@meith/theme-midnight": "0.33.1",
+    "@meith/theme-phasebook": "0.33.1",
+    "@meith/theme-raidframe": "0.33.1",
+    "@meith/threads": "0.33.1",
+    "@meith/ui": "0.33.1",
+    "@meith/upgrade": "0.33.1"
   },
   "scripts": {
     "dev": "next dev",

package/src/components/admin/admin-forms.tsx

@@ -2,7 +2,12 @@
 
 import { useActionState } from 'react'
 
-import { adminSignInAction, adminSignOutAction } from '@/server/admin-actions'
+import {
+  adminAbandonSecondFactorAction,
+  adminSignInAction,
+  adminSignOutAction,
+  adminVerifySecondFactorAction,
+} from '@/server/admin-actions'
 import { EMPTY_STATE } from '@/server/auth-form-state'
 
 import { FormError, PendingButton } from '../auth/form-controls'
@@ -51,14 +56,6 @@ export function AdminSignInForm({
         />
       </label>
 
-      <OtpField
-        label={fromCopy(copy, 'adminPanel.twoFactorCode')}
-        name="code"
-        required={false}
-        hint={fromCopy(copy, 'adminPanel.twoFactorCodeHint')}
-        recovery={otpRecoveryFromCopy(copy)}
-      />
-
       <PendingButton
         showWorking
         className="inline-flex h-10 items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground hover:opacity-90 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-ring"
@@ -73,6 +70,57 @@ export function AdminSignInForm({
   )
 }
 
+export function AdminSecondFactorForm({
+  recoveryCodesLeft,
+  copy,
+}: {
+  recoveryCodesLeft: number
+  copy: Copy
+}) {
+  const [state, action] = useActionState(adminVerifySecondFactorAction, EMPTY_STATE)
+
+  return (
+    <div className="flex w-full max-w-sm flex-col gap-4 rounded-lg border border-border bg-card p-6">
+      <h1 className="text-xl font-semibold tracking-tight">
+        {fromCopy(copy, 'adminPanel.twoFactor.title')}
+      </h1>
+
+      <p className="text-sm text-muted-foreground">{fromCopy(copy, 'adminPanel.twoFactor.lede')}</p>
+
+      <form action={action} className="flex flex-col gap-4" noValidate>
+        <FormError message={state.error} />
+
+        <OtpField
+          label={fromCopy(copy, 'adminPanel.twoFactorCode')}
+          name="code"
+          hint={
+            recoveryCodesLeft > 0
+              ? fromCopy(copy, 'adminPanel.twoFactor.recoveryHint')
+              : fromCopy(copy, 'adminPanel.twoFactor.recoveryHintExhausted')
+          }
+          recovery={otpRecoveryFromCopy(copy)}
+        />
+
+        <PendingButton
+          showWorking
+          className="inline-flex h-10 items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground hover:opacity-90 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-ring"
+        >
+          {fromCopy(copy, 'adminPanel.twoFactor.submit')}
+        </PendingButton>
+      </form>
+
+      <form action={adminAbandonSecondFactorAction}>
+        <PendingButton
+          showWorking
+          className="text-sm text-muted-foreground hover:text-foreground focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-ring"
+        >
+          {fromCopy(copy, 'adminPanel.twoFactor.cancel')}
+        </PendingButton>
+      </form>
+    </div>
+  )
+}
+
 export function AdminSignOutForm({ copy }: { copy: Copy }) {
   return (
     <form action={adminSignOutAction}>

package/src/components/admin/theme-forms.tsx

@@ -507,7 +507,7 @@ export function ThemeEditorForm({
             <p className="text-xs text-muted-foreground">
               {fromCopy(copy, 'adminTheme.validated.blurb')}
             </p>
-            <style dangerouslySetInnerHTML={{ __html: state.preview }} />
+            <style>{state.preview}</style>
             <ValidatedSample copy={copy} />
           </section>
         )}

package/src/components/shell/view-tabs.tsx

@@ -35,7 +35,7 @@ export function ViewTabs({
                 'inline-flex h-8 items-center gap-1.5 rounded-md px-3 text-sm whitespace-nowrap transition-colors',
                 'focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-ring',
                 tab.isCurrent
-                  ? 'bg-card font-semibold text-foreground shadow-sm'
+                  ? 'bg-card font-semibold text-primary shadow-sm'
                   : 'font-medium text-muted-foreground hover:text-foreground',
               )}
             >

package/src/server/admin-actions.ts

@@ -3,11 +3,20 @@
 import { redirect } from 'next/navigation'
 
 import { generateToken, hashToken, verifyPassword } from '@meith/accounts'
-import { ipAllowed } from '@meith/admin'
+import { type AdminService, ipAllowed } from '@meith/admin'
 import { ForbiddenError, logger, ValidationError } from '@meith/core'
 import { msg } from '@meith/i18n'
 
-import { adminAllowlist, adminService, recordAdminAction, resolveAdmin } from './admin'
+import {
+  abandonAdminSecondFactor,
+  adminAllowlist,
+  adminService,
+  holdAdminSecondFactor,
+  pendingAdminSecondFactor,
+  recordAdminAction,
+  redeemAdminSecondFactor,
+  resolveAdmin,
+} from './admin'
 import { boardAuthConfig } from './auth-config'
 import type { FormState } from './auth-form-state'
 import { getContainer } from './container'
@@ -71,31 +80,21 @@ export async function adminSignInAction(_prev: FormState, form: FormData): Promi
       throw new ForbiddenError(msg('error.app.password-right'))
     }
 
-    try {
-      await assertSecondFactorGiven({ userId: actor.userId, form })
-    } catch (err) {
-      await failAttempt()
-      throw err
-    }
+    const next = safeAdminReturn(text(form, 'next'))
+    const twoFactor = twoFactorService()
 
-    await accountStore.loginAttempts.clear(attemptBucket)
-
-    const existing = await resolveAdmin()
-    if ('context' in existing) {
-      await service.markReauthenticated(existing.context.session.id)
-      await recordAdminAction({ action: 'admin.reauthenticated' })
+    if (twoFactor !== null && (await twoFactor.isEnrolled(actor.userId))) {
+      await holdAdminSecondFactor(actor.userId, next)
+      target = '/admin'
     } else {
-      const token = generateToken()
-      const session = await service.start({
-        userId: actor.userId,
-        tokenHash: await hashToken(token),
-        ipPrefix: await retainedIpPrefix(),
-      })
-      await setAdminCookie(token, session.expiresAt)
-      await recordAdminAction({ action: 'admin.signed_in' })
-    }
+      if (twoFactor !== null && (await twoFactorRequiredForStaff())) {
+        await failAttempt()
+        throw new ForbiddenError(msg('adminAction.twoFactorRequired'))
+      }
 
-    target = safeAdminReturn(text(form, 'next'))
+      await accountStore.loginAttempts.clear(attemptBucket)
+      target = await startAdminSession(service, actor.userId, next)
+    }
   } catch (err) {
     return toFormState(err)
   }
@@ -103,39 +102,109 @@ export async function adminSignInAction(_prev: FormState, form: FormData): Promi
   redirect(target)
 }
 
-async function adminReauthenticationBucket(userId: number): Promise<string> {
-  const prefix = await retainedIpPrefix()
-  return prefix === null ? `admin-reauth:${userId}` : `admin-reauth:${userId}@${prefix}`
-}
+export async function adminVerifySecondFactorAction(
+  _prev: FormState,
+  form: FormData,
+): Promise<FormState> {
+  let target: string
 
-async function assertSecondFactorGiven(input: {
-  readonly userId: number
-  readonly form: FormData
-}): Promise<void> {
-  const service = twoFactorService()
-  if (service === null) return
+  try {
+    if (!ipAllowed(await remoteAddress(), await adminAllowlist())) {
+      throw new ForbiddenError(msg('error.app.control-panel-available-from-address'))
+    }
 
-  const enrolled = await service.isEnrolled(input.userId)
+    const service = adminService()
+    if (service === null) {
+      throw new ForbiddenError(msg('error.app.board-running-in-memory-sample-data-25'))
+    }
 
-  if (!enrolled) {
-    if (await twoFactorRequiredForStaff()) {
-      throw new ForbiddenError(msg('adminAction.twoFactorRequired'))
+    const actor = await getActor()
+    const { authorizer, accountStore } = getContainer()
+    if (actor.userId === null || !authorizer.can(actor, 'admincp.access')) {
+      throw new ForbiddenError(msg('error.app.reach-control-panel'))
     }
-    return
-  }
 
-  const code = text(input.form, 'code')
-  if (code === '') {
-    throw new ValidationError(msg('error.app.enter-code-from-authenticator-app'))
-  }
+    const twoFactor = twoFactorService()
+    const pending = await pendingAdminSecondFactor()
+    if (twoFactor === null || pending === null) {
+      throw new ForbiddenError(msg('adminAction.twoFactorExpired'))
+    }
+
+    const config = await boardAuthConfig()
+    const attemptBucket = await adminReauthenticationBucket(actor.userId)
+    const attemptSince = new Date(Date.now() - config.lockoutMinutes * 60_000)
+    if (
+      config.maxLoginAttempts > 0 &&
+      (await accountStore.loginAttempts.countFailuresSince(attemptBucket, attemptSince)) >=
+        config.maxLoginAttempts
+    ) {
+      throw new ForbiddenError(msg('error.accounts.too-many-failed-attempts-please'))
+    }
 
-  const outcome = await service.verify({ userId: input.userId, code })
-  if (outcome.status !== 'ok') {
-    if (outcome.status === 'replayed') {
-      throw new ForbiddenError(msg('adminAction.codeReplayed'))
+    const failAttempt = async (): Promise<void> => {
+      await accountStore.loginAttempts.record(attemptBucket, false, new Date())
+      await recordAdminAction({ action: 'admin.signin_failed' })
     }
-    throw new ForbiddenError(msg('adminAction.codeWrong'))
+
+    const code = text(form, 'code')
+    if (code === '') {
+      await failAttempt()
+      throw new ValidationError(msg('error.app.enter-code-from-authenticator-app'))
+    }
+
+    const outcome = await twoFactor.verify({ userId: pending.userId, code })
+    if (outcome.status !== 'ok') {
+      await failAttempt()
+      throw new ForbiddenError(
+        msg(outcome.status === 'replayed' ? 'adminAction.codeReplayed' : 'adminAction.codeWrong'),
+      )
+    }
+
+    const redeemed = await redeemAdminSecondFactor()
+    if (redeemed === null) {
+      throw new ForbiddenError(msg('adminAction.twoFactorExpired'))
+    }
+
+    await accountStore.loginAttempts.clear(attemptBucket)
+    target = await startAdminSession(service, pending.userId, safeAdminReturn(redeemed.next))
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  redirect(target)
+}
+
+export async function adminAbandonSecondFactorAction(): Promise<void> {
+  await abandonAdminSecondFactor()
+  redirect('/admin')
+}
+
+async function startAdminSession(
+  service: AdminService,
+  userId: number,
+  target: string,
+): Promise<string> {
+  const existing = await resolveAdmin()
+  if ('context' in existing) {
+    await service.markReauthenticated(existing.context.session.id)
+    await recordAdminAction({ action: 'admin.reauthenticated' })
+  } else {
+    const token = generateToken()
+    const session = await service.start({
+      userId,
+      tokenHash: await hashToken(token),
+      ipPrefix: await retainedIpPrefix(),
+    })
+    await setAdminCookie(token, session.expiresAt)
+    await recordAdminAction({ action: 'admin.signed_in' })
   }
+
+  return target
+}
+
+async function adminReauthenticationBucket(userId: number): Promise<string> {
+  const prefix = await retainedIpPrefix()
+  return prefix === null ? `admin-reauth:${userId}` : `admin-reauth:${userId}@${prefix}`
 }
 
 export async function adminSignOutAction(): Promise<void> {

package/src/server/admin.ts

@@ -4,14 +4,20 @@ import 'server-only'
 import { notFound } from 'next/navigation'
 import { cache } from 'react'
 
-import { hashToken } from '@meith/accounts'
+import { generateToken, hashToken } from '@meith/accounts'
 import { type AdminContext, AdminService, ipAllowed, parseAllowlist } from '@meith/admin'
 import { env, ForbiddenError } from '@meith/core'
 
 import { getContainer } from './container'
 import { getActor } from './context'
+import { ADMIN_SECOND_FACTOR_MINUTES } from './cookies'
 import { remoteAddress, retainedIpPrefix } from './request-fingerprint'
-import { readAdminToken } from './session-cookies'
+import {
+  clearAdminSecondFactorCookie,
+  readAdminSecondFactorToken,
+  readAdminToken,
+  setAdminSecondFactorCookie,
+} from './session-cookies'
 
 export type AdminDenial = 'address' | 'permission' | 'signin' | 'expired' | 'unavailable'
 
@@ -69,6 +75,68 @@ export function askForPassword(denied: AdminDenial): boolean {
   return denied === 'signin' || denied === 'expired'
 }
 
+export interface AdminSecondFactorHold {
+  readonly userId: number
+  readonly next: string
+}
+
+export async function holdAdminSecondFactor(userId: number, next: string): Promise<void> {
+  const { tokens } = getContainer().accountStore
+  await tokens.revokeAllForUser(userId, 'admin_second_factor')
+
+  const token = generateToken()
+  const expiresAt = new Date(Date.now() + ADMIN_SECOND_FACTOR_MINUTES * 60_000)
+  await tokens.issue({
+    tokenHash: await hashToken(token),
+    userId,
+    purpose: 'admin_second_factor',
+    payload: next,
+    expiresAt,
+  })
+
+  await setAdminSecondFactorCookie(token, expiresAt)
+}
+
+export async function pendingAdminSecondFactor(): Promise<AdminSecondFactorHold | null> {
+  const token = await readAdminSecondFactorToken()
+  if (token === null || token === '') return null
+
+  const held = await getContainer().accountStore.tokens.peek(
+    await hashToken(token),
+    'admin_second_factor',
+    new Date(),
+  )
+  if (held === null) return null
+
+  const actor = await getActor()
+  if (actor.userId === null || held.userId !== actor.userId) return null
+
+  return { userId: held.userId, next: held.payload ?? '/admin' }
+}
+
+export async function redeemAdminSecondFactor(): Promise<AdminSecondFactorHold | null> {
+  const token = await readAdminSecondFactorToken()
+  await clearAdminSecondFactorCookie()
+  if (token === null || token === '') return null
+
+  const redeemed = await getContainer().accountStore.tokens.consume(
+    await hashToken(token),
+    'admin_second_factor',
+    new Date(),
+  )
+  if (redeemed === null) return null
+
+  return { userId: redeemed.userId, next: redeemed.payload ?? '/admin' }
+}
+
+export async function abandonAdminSecondFactor(): Promise<void> {
+  const actor = await getActor()
+  if (actor.userId !== null) {
+    await getContainer().accountStore.tokens.revokeAllForUser(actor.userId, 'admin_second_factor')
+  }
+  await clearAdminSecondFactorCookie()
+}
+
 export async function adminPageContext(): Promise<AdminContext | null> {
   const resolved = await resolveAdmin()
   if ('context' in resolved) return resolved.context

package/src/server/cookies.ts

@@ -11,6 +11,9 @@ export const GUEST_COOKIE_DAYS = 1
 export const ADMIN_COOKIE = 'fs_admin'
 export const ADMIN_COOKIE_PATH = '/admin'
 
+export const ADMIN_SECOND_FACTOR_COOKIE = 'fs_admin_2fa'
+export const ADMIN_SECOND_FACTOR_MINUTES = 10
+
 export const SSO_COOKIE = '__Host-fs_sso'
 export const DEV_SSO_COOKIE = 'fs_sso'
 
@@ -80,6 +83,21 @@ export function clearedAdminCookie(secure: boolean): CookieAttrs {
   }
 }
 
+export function adminSecondFactorCookie(expires: Date, secure: boolean): CookieAttrs {
+  return { httpOnly: true, secure, sameSite: 'strict', path: ADMIN_COOKIE_PATH, expires }
+}
+
+export function clearedAdminSecondFactorCookie(secure: boolean): CookieAttrs {
+  return {
+    httpOnly: true,
+    secure,
+    sameSite: 'strict',
+    path: ADMIN_COOKIE_PATH,
+    expires: new Date(0),
+    maxAge: 0,
+  }
+}
+
 export function clearedCookie(secure: boolean): CookieAttrs {
   return { ...base(secure), expires: new Date(0), maxAge: 0 }
 }

package/src/server/image-upload.ts

@@ -46,6 +46,31 @@ export function sniff(bytes: Uint8Array): ImageFormat | null {
   return null
 }
 
+const DANGEROUS_TAG = /<\s*(script|foreignobject|iframe|embed|object|set|animate\w*)\b/i
+const EVENT_HANDLER_OR_SCRIPT_SCHEME = /\son\w+\s*=|javascript:|vbscript:/i
+const REFERENCING_TAG = /<\s*(use|image|feimage)\b([^>]*)>/gi
+const HREF_ATTRIBUTE = /(?:xlink:href|href)\s*=\s*(\x22|\x27)([\s\S]*?)\1/i
+
+function decodeEntities(value: string): string {
+  return value.replace(/&(#\d+|#x[0-9a-f]+|amp|lt|gt|quot|apos);/gi, (match, entity: string) => {
+    if (entity.startsWith('#')) {
+      const isHex = entity[1] === 'x' || entity[1] === 'X'
+      const code = Number.parseInt(entity.slice(isHex ? 2 : 1), isHex ? 16 : 10)
+      return Number.isFinite(code) ? String.fromCodePoint(code) : match
+    }
+    const named: Record<string, string> = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" }
+    return named[entity.toLowerCase()] ?? match
+  })
+}
+
+function hasExternalReference(decoded: string): boolean {
+  for (const match of decoded.matchAll(REFERENCING_TAG)) {
+    const href = HREF_ATTRIBUTE.exec(match[2] ?? '')?.[2]?.trim()
+    if (href !== undefined && href !== '' && !href.startsWith('#')) return true
+  }
+  return false
+}
+
 function isSvg(bytes: Uint8Array): boolean {
   const decoder = new TextDecoder('utf-8', { fatal: false })
   const head = decoder
@@ -56,9 +81,14 @@ function isSvg(bytes: Uint8Array): boolean {
   const looksSvg = head.startsWith('<svg') || /^<\?xml[\s\S]{0,512}?<svg/i.test(head)
   if (!looksSvg) return false
 
-  if (/<script|<foreignObject|\son\w+\s*=|javascript:/i.test(decoder.decode(bytes))) {
+  const decoded = decodeEntities(decoder.decode(bytes))
+
+  if (DANGEROUS_TAG.test(decoded) || EVENT_HANDLER_OR_SCRIPT_SCHEME.test(decoded)) {
     throw new ValidationError(msg('error.app.svg-contains-script-event-handler'))
   }
+  if (hasExternalReference(decoded)) {
+    throw new ValidationError(msg('error.app.svg-contains-external-reference'))
+  }
   return true
 }
 

package/src/server/push-actions.ts

@@ -15,6 +15,8 @@ const toFormState = formStateReporter('push-actions', 'unexpected error in web p
 
 const ENDPOINT_MAX = 1000
 
+const SUBSCRIPTIONS_PER_USER_MAX = 20
+
 const BASE64URL = /^[A-Za-z0-9_-]+$/
 
 const IP_LITERAL = /^\[|^\d+\.\d+\.\d+\.\d+$/
@@ -77,6 +79,13 @@ export async function subscribeToPushAction(input: PushSubscriptionInput): Promi
     }
 
     const { service, userId } = await requirePushCentre()
+
+    const existing = await service.pushSubscriptions(userId)
+    const known = existing.some((subscription) => subscription.endpoint === input.endpoint)
+    if (!known && existing.length >= SUBSCRIPTIONS_PER_USER_MAX) {
+      return { error: await tr('notice.app.push-subscription-limit') }
+    }
+
     await service.subscribeToPush({
       userId,
       endpoint: input.endpoint,

package/src/server/session-cookies.ts

@@ -6,8 +6,11 @@ import { env } from '@meith/core'
 
 import {
   ADMIN_COOKIE,
+  ADMIN_SECOND_FACTOR_COOKIE,
   adminCookie,
+  adminSecondFactorCookie,
   clearedAdminCookie,
+  clearedAdminSecondFactorCookie,
   clearedCookie,
   passkeyCookie,
   passkeyCookieName,
@@ -55,6 +58,21 @@ export async function readAdminToken(): Promise<string | null> {
   return jar.get(ADMIN_COOKIE)?.value ?? null
 }
 
+export async function setAdminSecondFactorCookie(token: string, expiresAt: Date): Promise<void> {
+  const jar = await cookies()
+  jar.set(ADMIN_SECOND_FACTOR_COOKIE, token, adminSecondFactorCookie(expiresAt, secure()))
+}
+
+export async function readAdminSecondFactorToken(): Promise<string | null> {
+  const jar = await cookies()
+  return jar.get(ADMIN_SECOND_FACTOR_COOKIE)?.value ?? null
+}
+
+export async function clearAdminSecondFactorCookie(): Promise<void> {
+  const jar = await cookies()
+  jar.set(ADMIN_SECOND_FACTOR_COOKIE, '', clearedAdminSecondFactorCookie(secure()))
+}
+
 export async function clearSessionCookies(): Promise<void> {
   const jar = await cookies()
   const isSecure = secure()

package/src/server/system-admin.ts

@@ -50,6 +50,7 @@ export interface SystemHealthView {
   readonly recount: readonly RecountStateRow[]
   readonly volumes: BoardVolumes
   readonly prunableSessions: number
+  readonly legacyPasswordHashes: number
 }
 
 export async function buildSystemHealthView(now: Date): Promise<SystemHealthView | null> {
@@ -57,15 +58,17 @@ export async function buildSystemHealthView(now: Date): Promise<SystemHealthView
   if (repository === null) return null
 
   const maintenance = new PostgresMaintenanceRepository(getDb())
-  const [tasks, runs, recount, volumes, prunableSessions, searchIndex, mail] = await Promise.all([
-    repository.taskHealth(),
-    repository.recentRuns(20),
-    repository.recountState(),
-    repository.volumes(),
-    maintenance.countPrunableSessions(now),
-    new PostgresSearchRepository(getDb()).indexProgress(),
-    assessMailReadiness(),
-  ])
+  const [tasks, runs, recount, volumes, prunableSessions, searchIndex, mail, legacyPasswordHashes] =
+    await Promise.all([
+      repository.taskHealth(),
+      repository.recentRuns(20),
+      repository.recountState(),
+      repository.volumes(),
+      maintenance.countPrunableSessions(now),
+      new PostgresSearchRepository(getDb()).indexProgress(),
+      assessMailReadiness(),
+      repository.legacyPasswordHashes(),
+    ])
 
   const scheduler = assessScheduler(tasks, now)
   const taskMessages = new Map(
@@ -86,5 +89,6 @@ export async function buildSystemHealthView(now: Date): Promise<SystemHealthView
     recount,
     volumes,
     prunableSessions,
+    legacyPasswordHashes,
   }
 }

package/src/server/upgrade-notice.ts

@@ -16,7 +16,7 @@ import { planUpgrade, type UpgradeState, upgradeNotice } from '@meith/upgrade'
 
 import { activeDefinitions } from './plugin-host'
 
-export const CODE_VERSION = '0.32.0'
+export const CODE_VERSION = '0.33.1'
 
 export interface UpgradeApplied {
   readonly plugins: readonly string[]

package/src/styles/globals.css

@@ -666,7 +666,7 @@
   /* `em`, so a quote inside a heading scales with the text it is in. */
   margin-block: 0.85em;
   padding: 0.55em 0.85em;
-  border-inline-start: 3px solid var(--border);
+  border-inline-start: 3px solid color-mix(in srgb, var(--primary) 55%, transparent);
   background-color: var(--muted);
   border-start-end-radius: var(--radius);
   border-end-end-radius: var(--radius);

package/src/view/admin-panel-copy.ts

@@ -15,7 +15,12 @@ export function adminFormsCopy(t: Translator = untranslated()): Readonly<Record<
         'adminPanel.reason.default',
         'adminPanel.password',
         'adminPanel.twoFactorCode',
-        'adminPanel.twoFactorCodeHint',
+        'adminPanel.twoFactor.title',
+        'adminPanel.twoFactor.lede',
+        'adminPanel.twoFactor.recoveryHint',
+        'adminPanel.twoFactor.recoveryHintExhausted',
+        'adminPanel.twoFactor.submit',
+        'adminPanel.twoFactor.cancel',
         'adminPanel.enter',
         'adminPanel.leave',
       ],

package/src/view/redirect-notice.ts

@@ -1,7 +1,19 @@
+import type { Translator } from '@meith/i18n'
 import type { RedirectNoticeModel } from '@meith/theme-kit'
 
+import { untranslated } from './time'
+
 export const REDIRECT_DELAY_SECONDS = 2
 
+const DEFAULT_MESSAGE_KEY = 'redirectNotice.continuing'
+
+const REDIRECT_MESSAGE_KEYS: Readonly<Record<string, string>> = {
+  continuing: DEFAULT_MESSAGE_KEY,
+  'signed-out': 'redirectNotice.signedOut',
+  saved: 'redirectNotice.saved',
+  posted: 'redirectNotice.posted',
+}
+
 export function localHref(value: string | undefined): string {
   if (value === undefined || !value.startsWith('/')) return '/'
   const origin = 'https://forum.invalid'
@@ -11,11 +23,16 @@ export function localHref(value: string | undefined): string {
 
 export function buildRedirectNotice(
   target: string | undefined,
-  message: string | undefined,
+  messageKey: string | undefined,
+  t: Translator = untranslated(),
 ): RedirectNoticeModel {
+  const key =
+    (messageKey !== undefined ? REDIRECT_MESSAGE_KEYS[messageKey] : undefined) ??
+    DEFAULT_MESSAGE_KEY
+
   return {
     targetHref: localHref(target),
-    message: message?.trim() || 'Continuing…',
+    message: t.t(key),
     delaySeconds: REDIRECT_DELAY_SECONDS,
   }
 }