@meith/web 0.34.0 → 0.35.1

package/app/(board)/subscriptions/page.tsx

@@ -34,8 +34,8 @@ export default async function SubscriptionsPage({
 
   if (actor.userId === null || subscriptions === null) notFound()
 
-  const visibleForumIds = await authorizer.visibleForumIds(actor)
-  const rows = await new SubscriptionService({ subscriptions }).list(actor.userId, visibleForumIds)
+  const audience = await authorizer.threadAudience(actor)
+  const rows = await new SubscriptionService({ subscriptions }).list(actor.userId, audience)
 
   const translator = await getTranslator()
 

package/app/(board)/thread/[slug]/reply/page.tsx

@@ -55,7 +55,11 @@ export default async function ReplyPage({
     forum: await authorizer.forumMatrix(actor, target.forum.id),
     allowsAttachments: target.forum.allowAttachments,
   }
-  if (!authorizer.can(actor, 'thread.view', scope)) notFound()
+  const threadViewTarget = {
+    ...(await authorizer.moderatorTargetIn(actor, target.forum.id, scope.forum)),
+    threadAuthorId: target.authorUserId,
+  }
+  if (!authorizer.can(actor, 'thread.view', threadViewTarget)) notFound()
   if (!authorizer.can(actor, 'reply.post', scope)) notFound()
 
   const moderates = authorizer.can(actor, 'content.viewUnapproved', scope)

package/app/auth/passkey/verify/route.ts

@@ -1,7 +1,9 @@
 import type { NextRequest } from 'next/server'
 
+import { RateLimiter } from '@meith/antispam'
 import { logger, statusForError, toPublicError } from '@meith/core'
 
+import { rateLimitStore } from '@/server/antispam'
 import { recordAuthEvent } from '@/server/auth-events'
 import { configuredIdentity, configuredSessions } from '@/server/container'
 import { getActor } from '@/server/context'
@@ -16,7 +18,11 @@ import {
   relyingParty,
 } from '@/server/federation'
 import { tr } from '@/server/i18n'
-import { type PasskeyPurpose, unpackChallenge } from '@/server/passkey-challenge'
+import {
+  PASSKEY_CHALLENGE_TTL_SECONDS,
+  type PasskeyPurpose,
+  unpackChallenge,
+} from '@/server/passkey-challenge'
 import { retainedIpPrefix } from '@/server/request-fingerprint'
 import { isSafeLocalPath } from '@/server/safe-path'
 import { crossOriginRefusal, isSameOrigin } from '@/server/same-origin'
@@ -59,6 +65,26 @@ function text(value: unknown): string | null {
   return typeof value === 'string' && value !== '' ? value : null
 }
 
+async function consumeChallengeOnce(challenge: string): Promise<boolean> {
+  const store = rateLimitStore()
+  if (store === null) return true
+
+  try {
+    const outcome = await new RateLimiter(store).consume({
+      scope: 'passkey',
+      subject: challenge,
+      rule: { max: 1, windowSeconds: PASSKEY_CHALLENGE_TTL_SECONDS },
+    })
+    return outcome.allowed
+  } catch (error) {
+    logger({ module: 'passkeys' }).warn(
+      { err: String(error) },
+      'could not enforce single-use on a passkey challenge',
+    )
+    return true
+  }
+}
+
 export async function POST(request: NextRequest): Promise<Response> {
   if (!isSameOrigin(request)) return crossOriginRefusal()
 
@@ -86,6 +112,10 @@ export async function POST(request: NextRequest): Promise<Response> {
     return problem(await tr('authRoute.passkey.attemptExpired'), 400)
   }
 
+  if (!(await consumeChallengeOnce(challengeState.challenge))) {
+    return problem(await tr('authRoute.passkey.attemptExpired'), 400)
+  }
+
   const clientDataJSON = text(body.clientDataJSON)
   if (clientDataJSON === null) {
     return problem(await tr('authRoute.passkey.responseIncomplete'), 400)
@@ -183,7 +213,7 @@ export async function POST(request: NextRequest): Promise<Response> {
         return problem(await tr('authRoute.passkey.signInExpired'), 403)
       }
 
-      await identity.assertSecondFactorAttemptsLeft(pending.userId)
+      await identity.spendSecondFactorAttempt(pending.userId)
 
       const proved = await service.proveOwnership({
         userId: pending.userId,
@@ -194,7 +224,6 @@ export async function POST(request: NextRequest): Promise<Response> {
       })
 
       if (!proved) {
-        await identity.recordSecondFactorFailure(pending.userId)
         await recordAuthEvent({ userId: pending.userId, kind: 'second_factor_failed' })
         return problem(await tr('authRoute.passkey.notForAccount'), 403)
       }
@@ -209,7 +238,7 @@ export async function POST(request: NextRequest): Promise<Response> {
       await setSessionCookie(login.sessionToken, login.expiresAt)
 
       if (pending.remember) {
-        const remembered = await (await configuredSessions()).startRemembered(pending.userId)
+        const remembered = await (await configuredSessions()).issueRemember(pending.userId)
         await setRememberCookie(remembered.rememberToken, remembered.rememberExpiresAt)
       }
 

package/app/install/page.tsx

@@ -17,9 +17,11 @@ import { Alert, AlertDescription, AlertTitle, Disclosure } from '@meith/ui'
 
 import { InstallForm } from '@/components/install/install-form'
 import { InstallRestoreForm } from '@/components/install/restore-form'
+import { InstallUnlockForm } from '@/components/install/unlock-form'
 import { getTranslator, tr } from '@/server/i18n'
 import { gatherPreflight, installerIsSealed, probeMail } from '@/server/install'
 import { installRestoreView } from '@/server/install-restore'
+import { installUnlocked } from '@/server/install-unlock'
 import { formatBytes } from '@/view/attachments'
 import { installFormCopy, installRestoreCopy } from '@/view/install-copy'
 import { formatTime } from '@/view/time'
@@ -77,9 +79,10 @@ export default async function InstallPage() {
 
   const checks = await gatherPreflight()
   const ready = canProceed(checks)
+  const unlocked = ready && (await installUnlocked())
   const mail = await probeMail()
   const suggestedBoardUrl = await suggestBoardUrl()
-  const restore = ready ? await installRestoreView() : null
+  const restore = unlocked ? await installRestoreView() : null
   const now = new Date()
 
   return (
@@ -93,6 +96,18 @@ export default async function InstallPage() {
 
       <Preflight checks={checks} />
 
+      {ready && !unlocked && (
+        <InstallUnlockForm
+          copy={{
+            title: t.t('installUnlock.title'),
+            lede: t.t('installUnlock.lede'),
+            label: t.t('installUnlock.label'),
+            button: t.t('installUnlock.button'),
+            pending: t.t('installUnlock.pending'),
+          }}
+        />
+      )}
+
       {restore?.possible && (
         <InstallRestoreForm
           candidates={restore.candidates.map((candidate) => ({
@@ -115,7 +130,7 @@ export default async function InstallPage() {
         />
       )}
 
-      {ready && (
+      {unlocked && (
         <InstallForm
           presets={MAIL_PRESETS.map((preset) => ({
             ...preset,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/web",
-  "version": "0.34.0",
+  "version": "0.35.1",
   "description": "The board itself: the Next.js app, and the forum-web bin that materializes it into an external board workspace.",
   "license": "MIT",
   "repository": {
@@ -43,55 +43,55 @@
     "react-dom": "19.2.8",
     "tailwindcss": "^4.3.3",
     "typescript": "7.0.2",
-    "@meith/accounts": "0.34.0",
-    "@meith/admin": "0.34.0",
-    "@meith/antispam": "0.34.0",
-    "@meith/api": "0.34.0",
-    "@meith/attachments": "0.34.0",
-    "@meith/authorization": "0.34.0",
-    "@meith/avatars": "0.34.0",
-    "@meith/backup": "0.34.0",
-    "@meith/board-digest": "0.34.0",
-    "@meith/core": "0.34.0",
-    "@meith/db": "0.34.0",
-    "@meith/demo": "0.34.0",
-    "@meith/drafts": "0.34.0",
-    "@meith/drivers": "0.34.0",
-    "@meith/events": "0.34.0",
-    "@meith/forums": "0.34.0",
-    "@meith/groups": "0.34.0",
-    "@meith/i18n": "0.34.0",
-    "@meith/import": "0.34.0",
-    "@meith/install": "0.34.0",
-    "@meith/mail": "0.34.0",
-    "@meith/markdown": "0.34.0",
-    "@meith/marketplace": "0.34.0",
-    "@meith/messages": "0.34.0",
-    "@meith/moderation": "0.34.0",
-    "@meith/notifications": "0.34.0",
-    "@meith/plugin-calendar": "0.34.0",
-    "@meith/plugin-dues": "0.34.0",
-    "@meith/plugin-kit": "0.34.0",
-    "@meith/polls": "0.34.0",
-    "@meith/posts": "0.34.0",
-    "@meith/profile-fields": "0.34.0",
-    "@meith/relations": "0.34.0",
-    "@meith/reputation": "0.34.0",
-    "@meith/runtime": "0.34.0",
-    "@meith/search": "0.34.0",
-    "@meith/settings": "0.34.0",
-    "@meith/signatures": "0.34.0",
-    "@meith/subscriptions": "0.34.0",
-    "@meith/tasks": "0.34.0",
-    "@meith/theme-clubhouse": "0.34.0",
-    "@meith/theme-default": "0.34.0",
-    "@meith/theme-kit": "0.34.0",
-    "@meith/theme-midnight": "0.34.0",
-    "@meith/theme-phasebook": "0.34.0",
-    "@meith/theme-raidframe": "0.34.0",
-    "@meith/threads": "0.34.0",
-    "@meith/ui": "0.34.0",
-    "@meith/upgrade": "0.34.0"
+    "@meith/accounts": "0.35.1",
+    "@meith/admin": "0.35.1",
+    "@meith/antispam": "0.35.1",
+    "@meith/api": "0.35.1",
+    "@meith/attachments": "0.35.1",
+    "@meith/authorization": "0.35.1",
+    "@meith/avatars": "0.35.1",
+    "@meith/backup": "0.35.1",
+    "@meith/board-digest": "0.35.1",
+    "@meith/core": "0.35.1",
+    "@meith/db": "0.35.1",
+    "@meith/demo": "0.35.1",
+    "@meith/drafts": "0.35.1",
+    "@meith/drivers": "0.35.1",
+    "@meith/events": "0.35.1",
+    "@meith/forums": "0.35.1",
+    "@meith/groups": "0.35.1",
+    "@meith/i18n": "0.35.1",
+    "@meith/import": "0.35.1",
+    "@meith/install": "0.35.1",
+    "@meith/mail": "0.35.1",
+    "@meith/markdown": "0.35.1",
+    "@meith/marketplace": "0.35.1",
+    "@meith/messages": "0.35.1",
+    "@meith/moderation": "0.35.1",
+    "@meith/notifications": "0.35.1",
+    "@meith/plugin-calendar": "0.35.1",
+    "@meith/plugin-dues": "0.35.1",
+    "@meith/plugin-kit": "0.35.1",
+    "@meith/polls": "0.35.1",
+    "@meith/posts": "0.35.1",
+    "@meith/profile-fields": "0.35.1",
+    "@meith/relations": "0.35.1",
+    "@meith/reputation": "0.35.1",
+    "@meith/runtime": "0.35.1",
+    "@meith/search": "0.35.1",
+    "@meith/settings": "0.35.1",
+    "@meith/signatures": "0.35.1",
+    "@meith/subscriptions": "0.35.1",
+    "@meith/tasks": "0.35.1",
+    "@meith/theme-clubhouse": "0.35.1",
+    "@meith/theme-default": "0.35.1",
+    "@meith/theme-kit": "0.35.1",
+    "@meith/theme-midnight": "0.35.1",
+    "@meith/theme-phasebook": "0.35.1",
+    "@meith/theme-raidframe": "0.35.1",
+    "@meith/threads": "0.35.1",
+    "@meith/ui": "0.35.1",
+    "@meith/upgrade": "0.35.1"
   },
   "scripts": {
     "dev": "next dev",

package/src/components/install/unlock-form.tsx

@@ -0,0 +1,65 @@
+'use client'
+
+import { useActionState } from 'react'
+
+import {
+  Alert,
+  AlertDescription,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from '@meith/ui'
+import { Button } from '@meith/ui/button'
+
+import { useFocusOnFail } from '@/components/auth/form-controls'
+import { type InstallUnlockState, installUnlockAction } from '@/server/install-actions'
+
+const EMPTY: InstallUnlockState = {}
+
+export interface InstallUnlockCopy {
+  readonly title: string
+  readonly lede: string
+  readonly label: string
+  readonly button: string
+  readonly pending: string
+}
+
+export function InstallUnlockForm({ copy }: { copy: InstallUnlockCopy }) {
+  const [state, submit, pending] = useActionState(installUnlockAction, EMPTY)
+  const errorRef = useFocusOnFail<HTMLDivElement>(state.error !== undefined)
+
+  return (
+    <Card aria-labelledby="install-unlock">
+      <CardHeader>
+        <CardTitle id="install-unlock">{copy.title}</CardTitle>
+        <CardDescription>{copy.lede}</CardDescription>
+      </CardHeader>
+      <CardContent>
+        <form action={submit} className="flex flex-col gap-4">
+          {state.error !== undefined && (
+            <Alert tone="error" ref={errorRef} tabIndex={-1}>
+              <AlertDescription>{state.error}</AlertDescription>
+            </Alert>
+          )}
+          <label className="flex flex-col gap-1 text-sm font-medium">
+            {copy.label}
+            <input
+              type="password"
+              name="secret"
+              required
+              autoComplete="off"
+              className="rounded-md border border-border bg-background px-3 py-2 font-mono text-sm"
+            />
+          </label>
+          <div>
+            <Button type="submit" size="lg" disabled={pending}>
+              {pending ? copy.pending : copy.button}
+            </Button>
+          </div>
+        </form>
+      </CardContent>
+    </Card>
+  )
+}

package/src/server/admin-actions.ts

@@ -55,28 +55,33 @@ export async function adminSignInAction(_prev: FormState, form: FormData): Promi
     const config = await boardAuthConfig()
     const attemptBucket = await adminReauthenticationBucket(actor.userId)
     const attemptSince = new Date(Date.now() - config.lockoutMinutes * 60_000)
-    if (
-      config.maxLoginAttempts > 0 &&
-      (await accountStore.loginAttempts.countFailuresSince(attemptBucket, attemptSince)) >=
-        config.maxLoginAttempts
-    ) {
-      throw new ForbiddenError(msg('error.accounts.too-many-failed-attempts-please'))
+
+    let attemptId: number | null = null
+    if (config.maxLoginAttempts > 0) {
+      const spent = await accountStore.loginAttempts.recordFailureAndCount(
+        attemptBucket,
+        attemptSince,
+        new Date(),
+      )
+      attemptId = spent.id
+      if (spent.count > config.maxLoginAttempts) {
+        throw new ForbiddenError(msg('error.accounts.too-many-failed-attempts-please'))
+      }
     }
 
-    const failAttempt = async (): Promise<void> => {
-      await accountStore.loginAttempts.record(attemptBucket, false, new Date())
+    const auditFailure = async (): Promise<void> => {
       await recordAdminAction({ action: 'admin.signin_failed' })
     }
 
     const password = text(form, 'password')
     if (password === '') {
-      await failAttempt()
+      await auditFailure()
       throw new ValidationError(msg('error.app.enter-password'))
     }
 
     const ok = await verifyPassword(password, account.passwordHash)
     if (!ok) {
-      await failAttempt()
+      await auditFailure()
       throw new ForbiddenError(msg('error.app.password-right'))
     }
 
@@ -84,11 +89,12 @@ export async function adminSignInAction(_prev: FormState, form: FormData): Promi
     const twoFactor = twoFactorService()
 
     if (twoFactor !== null && (await twoFactor.isEnrolled(actor.userId))) {
+      if (attemptId !== null) await accountStore.loginAttempts.removeAttempt(attemptId)
       await holdAdminSecondFactor(actor.userId, next)
       target = '/admin'
     } else {
       if (twoFactor !== null && (await twoFactorRequiredForStaff())) {
-        await failAttempt()
+        await auditFailure()
         throw new ForbiddenError(msg('adminAction.twoFactorRequired'))
       }
 
@@ -133,28 +139,31 @@ export async function adminVerifySecondFactorAction(
     const config = await boardAuthConfig()
     const attemptBucket = await adminReauthenticationBucket(actor.userId)
     const attemptSince = new Date(Date.now() - config.lockoutMinutes * 60_000)
-    if (
-      config.maxLoginAttempts > 0 &&
-      (await accountStore.loginAttempts.countFailuresSince(attemptBucket, attemptSince)) >=
-        config.maxLoginAttempts
-    ) {
-      throw new ForbiddenError(msg('error.accounts.too-many-failed-attempts-please'))
+
+    if (config.maxLoginAttempts > 0) {
+      const spent = await accountStore.loginAttempts.recordFailureAndCount(
+        attemptBucket,
+        attemptSince,
+        new Date(),
+      )
+      if (spent.count > config.maxLoginAttempts) {
+        throw new ForbiddenError(msg('error.accounts.too-many-failed-attempts-please'))
+      }
     }
 
-    const failAttempt = async (): Promise<void> => {
-      await accountStore.loginAttempts.record(attemptBucket, false, new Date())
+    const auditFailure = async (): Promise<void> => {
       await recordAdminAction({ action: 'admin.signin_failed' })
     }
 
     const code = text(form, 'code')
     if (code === '') {
-      await failAttempt()
+      await auditFailure()
       throw new ValidationError(msg('error.app.enter-code-from-authenticator-app'))
     }
 
     const outcome = await twoFactor.verify({ userId: pending.userId, code })
     if (outcome.status !== 'ok') {
-      await failAttempt()
+      await auditFailure()
       throw new ForbiddenError(
         msg(outcome.status === 'replayed' ? 'adminAction.codeReplayed' : 'adminAction.codeWrong'),
       )

package/src/server/antispam.ts

@@ -125,6 +125,8 @@ export function dailyLimitMessage(
     : `You have used your allowance of ${noun} for today. It resets in ${hours} hours.`
 }
 
+const CREDENTIAL_PROOF_PER_HOUR = 10
+
 type AuthLimitSetting =
   | 'antispam.register_ip_per_hour'
   | 'antispam.reset_per_hour'
@@ -173,6 +175,22 @@ export async function spendResetLimits(
   ]
 }
 
+export async function spendCredentialProofLimit(userId: number): Promise<RateLimitOutcome | null> {
+  const store = rateLimitStore()
+  if (store === null) return null
+
+  try {
+    return await new RateLimiter(store).consume({
+      scope: 'credential_proof',
+      subject: `u:${userId}`,
+      rule: { max: CREDENTIAL_PROOF_PER_HOUR, windowSeconds: HOUR },
+    })
+  } catch (error) {
+    logger().warn({ err: String(error) }, 'credential-proof rate limit unavailable')
+    return null
+  }
+}
+
 export async function spendRegisterLimit(): Promise<RateLimitOutcome | null> {
   const prefix = await countingPrefix()
 

package/src/server/api/content.ts

@@ -52,8 +52,11 @@ async function threadScope(actor: Actor, threadId: number): Promise<ThreadScope
     return null
   }
 
+  const scope = authorizer.contentScope(actor, target)
+  if (!scope.states.includes(located.visibility)) return null
+
   return {
-    scope: authorizer.contentScope(actor, target),
+    scope,
     authors: authorizer.authorFilter(actor, target),
   }
 }

package/src/server/api/subscriptions.ts

@@ -49,8 +49,8 @@ export const SUBSCRIPTION_HANDLERS: ApiRoutes = [
     '/subscriptions',
     async ({ actor }): Promise<ApiResult> => {
       const userId = requireUserId(actor)
-      const visibleForumIds = await getContainer().authorizer.visibleForumIds(actor)
-      const rows = await requireSubscriptions().list(userId, visibleForumIds)
+      const audience = await getContainer().authorizer.threadAudience(actor)
+      const rows = await requireSubscriptions().list(userId, audience)
       const wordFilter = await activeWordFilter()
 
       return {

package/src/server/attachment-upload-actions.ts

@@ -4,6 +4,7 @@ import { ForbiddenError, ValidationError } from '@meith/core'
 import { msg } from '@meith/i18n'
 
 import { attachmentHref, attachmentModel } from '../view/attachments'
+import { limitMessage, spendLimit } from './antispam'
 import { acceptSingleFile, attachmentLimits, attachmentService, canAttach } from './attachments'
 import { getContainer } from './container'
 import { getActor } from './context'
@@ -42,6 +43,9 @@ export async function uploadInlineAttachmentAction(
 
     if (!canAttach(actor, scope)) throw new ForbiddenError(msg('error.app.attach-files-forum'))
 
+    const limited = await spendLimit({ scope: 'upload', actor })
+    if (limited !== null && !limited.allowed) throw new ValidationError(limitMessage(limited))
+
     const accepted = await acceptSingleFile(form, attachmentLimits(scope))
 
     const objections = await filterView('attachment.upload.validate', [], {

package/src/server/auth-actions.ts

@@ -1,6 +1,7 @@
 'use server'
 
 import { redirect } from 'next/navigation'
+import { after } from 'next/server'
 
 import { type AuthConfig, foldIdentifier, hashToken, type LoginBucket } from '@meith/accounts'
 import { env, logger } from '@meith/core'
@@ -24,6 +25,7 @@ import { revokeFeedToken } from './feed-token'
 import { formStateReporter } from './form-state-reporter'
 import { getTranslator, tr } from './i18n'
 import { termsAcceptance } from './legal'
+import { notificationService } from './notifications'
 import { emitEvent, filterView } from './plugin-view'
 import { profileFieldService, registrationFieldContext, submittedFields } from './profile-fields'
 import {
@@ -297,7 +299,7 @@ async function completeSignIn(
 
   if (remember) {
     const sessions = await configuredSessions()
-    const remembered = await sessions.startRemembered(login.account.id, await deviceContext())
+    const remembered = await sessions.issueRemember(login.account.id)
     await setRememberCookie(remembered.rememberToken, remembered.rememberExpiresAt)
   }
 
@@ -343,12 +345,11 @@ export async function verifySecondFactorAction(
   if (service === null) return { error: await tr('authAction.secondFactorExpired') }
 
   try {
-    await identity.assertSecondFactorAttemptsLeft(pending.userId)
+    await identity.spendSecondFactorAttempt(pending.userId)
 
     const outcome = await service.verify({ userId: pending.userId, code })
 
     if (outcome.status !== 'ok') {
-      await identity.recordSecondFactorFailure(pending.userId)
       await recordAuthEvent({ userId: pending.userId, kind: 'second_factor_failed' })
       return {
         error: await tr(
@@ -439,9 +440,10 @@ export async function requestResetAction(_prev: FormState, form: FormData): Prom
     const { token, userId } = await identity.requestPasswordReset(email)
 
     if (token !== null && userId !== null) {
-      const account = await getContainer().accountStore.accounts.findById(userId)
-      if (account !== null) {
+      const deliver = async (): Promise<void> => {
         try {
+          const account = await getContainer().accountStore.accounts.findById(userId)
+          if (account === null) return
           await sendPasswordResetEmail({
             token,
             email: account.email,
@@ -455,6 +457,12 @@ export async function requestResetAction(_prev: FormState, form: FormData): Prom
           )
         }
       }
+
+      try {
+        after(deliver)
+      } catch {
+        await deliver()
+      }
     }
 
     if (token && env.NODE_ENV === 'development') {
@@ -479,6 +487,7 @@ export async function confirmResetAction(_prev: FormState, form: FormData): Prom
   try {
     const { userId } = await identity.redeemPasswordReset(token, password)
     await revokeFeedToken(userId)
+    await notificationService()?.unsubscribeAllFromPush(userId)
     await recordAuthEvent({ userId, kind: 'password_reset' })
   } catch (err) {
     return toFormState(err, { token })

package/src/server/content-actions.ts

@@ -2,7 +2,7 @@
 
 import { redirect } from 'next/navigation'
 
-import { ForbiddenError, ValidationError } from '@meith/core'
+import { ForbiddenError, logger, ValidationError } from '@meith/core'
 import { msg } from '@meith/i18n'
 import {
   authorRef,
@@ -82,11 +82,15 @@ export async function quotePostAction(threadId: number, postId: number): Promise
 
   const forumId = target.forum.id
   const matrix = await authorizer.forumMatrix(actor, forumId)
+  const scope = {
+    ...(await authorizer.moderatorTargetIn(actor, forumId, matrix)),
+    threadAuthorId: target.authorUserId,
+  }
+  if (!authorizer.can(actor, 'thread.view', scope)) return null
+
   if (
-    !authorizer.can(actor, 'thread.view', {
-      ...(await authorizer.moderatorTargetIn(actor, forumId, matrix)),
-      threadAuthorId: target.authorUserId,
-    })
+    (target.visibility === 'deleted' && !authorizer.can(actor, 'content.viewDeleted', scope)) ||
+    (target.visibility === 'unapproved' && !authorizer.can(actor, 'content.viewUnapproved', scope))
   )
     return null
 
@@ -151,6 +155,20 @@ function pollClosingTime(value: string): Date | null {
 
 const toFormState = formStateReporter('content-actions', 'unexpected error writing content')
 
+async function finaliseNewPost(
+  kind: 'thread' | 'reply',
+  finalise: () => Promise<void>,
+): Promise<void> {
+  try {
+    await finalise()
+  } catch (err) {
+    logger().error(
+      { err: String(err), kind },
+      'content saved but attaching uploads or clearing the draft failed',
+    )
+  }
+}
+
 export interface ComposerAutosaveInput {
   readonly forumId?: number
   readonly threadId?: number
@@ -244,9 +262,11 @@ export async function createThreadAction(_prev: FormState, form: FormData): Prom
 
   let created: Awaited<ReturnType<typeof submitThread>>
   let resolved: Awaited<ReturnType<typeof resolveThreadTarget>>
+  let staged: Awaited<ReturnType<typeof stageAttachments>>
+  let userId: number
   try {
     resolved = await resolveThreadTarget(actor, forumId)
-    const userId = actor.userId!
+    userId = actor.userId!
 
     if (intent === 'save_draft') {
       if (drafts === null) throw new ValidationError(msg('error.app.drafts-unavailable-board'))
@@ -256,7 +276,7 @@ export async function createThreadAction(_prev: FormState, form: FormData): Prom
 
     const pollClosesAt = pollClosingTime(poll.closesAt)
 
-    const staged = await stageAttachments(actor, resolved.scope, await submittedFiles(form))
+    staged = await stageAttachments(actor, resolved.scope, await submittedFiles(form))
 
     const subscribeMode = subscribe
       ? autoWatchCadence(await autoWatchPreference(userId, 'create'))
@@ -280,7 +300,11 @@ export async function createThreadAction(_prev: FormState, form: FormData): Prom
               publicVotes: poll.publicVotes,
             },
     })
+  } catch (err) {
+    return { ...(await toFormState(err, values)), poll }
+  }
 
+  await finaliseNewPost('thread', async () => {
     const attached = await attachStaged(staged, { postId: created.postId, forumId, userId })
     await claimAttachments(
       form,
@@ -289,9 +313,7 @@ export async function createThreadAction(_prev: FormState, form: FormData): Prom
       attached.length,
     )
     await drafts?.remove(userId, forumId, null)
-  } catch (err) {
-    return { ...(await toFormState(err, values)), poll }
-  }
+  })
 
   if (created.visibility === 'unapproved') {
     redirect(`/${resolved.forum.id}-${resolved.forum.slug}?posted=moderated`)
@@ -316,6 +338,7 @@ export async function createReplyAction(_prev: FormState, form: FormData): Promi
   const { drafts } = getContainer()
 
   let created: Awaited<ReturnType<typeof submitReply>>
+  let finalise: () => Promise<void>
   try {
     const resolved = await resolveReplyTarget(actor, threadId)
     const { forumId, scope } = resolved
@@ -341,18 +364,22 @@ export async function createReplyAction(_prev: FormState, form: FormData): Promi
       seenLastPostId,
     })
 
-    const attached = await attachStaged(staged, { postId: created.postId, forumId, userId })
-    await claimAttachments(
-      form,
-      { postId: created.postId, forumId, userId },
-      scope,
-      attached.length,
-    )
-    await drafts?.remove(userId, forumId, threadId)
+    finalise = async () => {
+      const attached = await attachStaged(staged, { postId: created.postId, forumId, userId })
+      await claimAttachments(
+        form,
+        { postId: created.postId, forumId, userId },
+        scope,
+        attached.length,
+      )
+      await drafts?.remove(userId, forumId, threadId)
+    }
   } catch (err) {
     return toFormState(err, values)
   }
 
+  await finaliseNewPost('reply', finalise)
+
   const thread = `/thread/${created.threadId}-${created.slug}`
   if (created.visibility === 'unapproved') {
     redirect(`${thread}?posted=moderated`)

package/src/server/credential-proof-actions.ts

@@ -4,6 +4,7 @@ import { redirect } from 'next/navigation'
 
 import { verifyPassword } from '@meith/accounts'
 
+import { limitMessage, refused, spendCredentialProofLimit } from './antispam'
 import type { FormState } from './auth-form-state'
 import { getContainer } from './container'
 import { getActor } from './context'
@@ -17,6 +18,9 @@ export async function proveCredentialAction(_prev: FormState, form: FormData): P
   const actor = await getActor()
   if (actor.userId === null) return { error: await tr('credentialProof.signIn') }
 
+  const limited = await spendCredentialProofLimit(actor.userId)
+  if (refused(limited)) return { error: limitMessage(limited) }
+
   const method = text(form, 'method')
   let proved = false
 

package/src/server/credential-proof.ts

@@ -1,5 +1,7 @@
 import 'server-only'
 
+import { redirect } from 'next/navigation'
+
 import { hasFreshCredentialProof, hashToken, type SessionRecord } from '@meith/accounts'
 
 import { getContainer } from './container'
@@ -19,6 +21,15 @@ export async function currentCredentialProof(
   return { session, provedAt: session.credentialProvedAt! }
 }
 
+export async function requireFreshCredentialProof(
+  userId: number,
+  next = '/usercp/security',
+): Promise<void> {
+  if ((await currentCredentialProof(userId)) === null) {
+    redirect(`/usercp/security/verify?next=${encodeURIComponent(next)}`)
+  }
+}
+
 export async function markCurrentSessionCredentialProved(
   userId: number,
   at = new Date(),

package/src/server/federation-actions.ts

@@ -9,6 +9,7 @@ import { recordAuthEvent } from './auth-events'
 import type { FormState } from './auth-form-state'
 import { getContainer } from './container'
 import { getActor } from './context'
+import { requireFreshCredentialProof } from './credential-proof'
 import { assertDemoAccountChangeable } from './demo'
 import {
   federationService,
@@ -61,6 +62,8 @@ async function requireOwnAccount(): Promise<{
 }
 
 export async function unlinkIdentityAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const actor = await getActor()
+  if (actor.userId !== null) await requireFreshCredentialProof(actor.userId)
   try {
     const { userId, hasPassword } = await requireOwnAccount()
     const identityId = Number(text(form, 'identityId'))
@@ -84,6 +87,8 @@ export async function unlinkIdentityAction(_prev: FormState, form: FormData): Pr
 }
 
 export async function removePasskeyAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const actor = await getActor()
+  if (actor.userId !== null) await requireFreshCredentialProof(actor.userId)
   try {
     const { userId, hasPassword } = await requireOwnAccount()
     const passkeyId = Number(text(form, 'passkeyId'))

package/src/server/federation.ts

@@ -54,7 +54,9 @@ export async function federationProvider(id: string): Promise<IdentityProvider |
   if (!isProviderKind(id)) return null
   if (getContainer().dataSource !== 'postgres') return null
 
-  return providerFor(id, federationOptions(await getSettingsUncached()))
+  return providerFor(id, federationOptions(await getSettingsUncached()), {
+    allowPrivateHosts: env.OIDC_ALLOW_PRIVATE_HOSTS,
+  })
 }
 
 export async function signInProviders(): Promise<readonly ProviderButton[]> {

package/src/server/fixture-thread-repo.ts

@@ -40,7 +40,9 @@ export class FixtureThreadRepository implements ThreadRepository {
 
   async locate(threadId: number): Promise<ThreadLocation | null> {
     const row = this.rows.find((entry) => entry.id === threadId)
-    return row === undefined ? null : { forumId: row.forumId, authorUserId: row.authorUserId }
+    return row === undefined
+      ? null
+      : { forumId: row.forumId, authorUserId: row.authorUserId, visibility: row.visibility }
   }
 
   async findById(

package/src/server/install-actions.ts

@@ -20,8 +20,28 @@ import { mailConfigFromEnvironment } from '@meith/settings'
 
 import { getTranslator } from './i18n'
 import { gatherPreflight, installerIsSealed, runInstall } from './install'
+import { grantInstallUnlock, installUnlocked, operatorSecretMatches } from './install-unlock'
 import { sendTestMail } from './mail-test'
 
+export interface InstallUnlockState {
+  readonly error?: string
+}
+
+export async function installUnlockAction(
+  _previous: InstallUnlockState,
+  form: FormData,
+): Promise<InstallUnlockState> {
+  if (await installerIsSealed()) redirect('/')
+
+  const secret = typeof form.get('secret') === 'string' ? String(form.get('secret')) : ''
+  if (!operatorSecretMatches(secret)) {
+    return { error: (await getTranslator()).t('installUnlock.incorrect') }
+  }
+
+  await grantInstallUnlock()
+  redirect('/install')
+}
+
 export interface InstallFormState {
   readonly errors?: Record<string, string>
   readonly failedStep?: {
@@ -50,8 +70,12 @@ export async function installAction(
     redirect('/')
   }
 
-  const parsed = parseInstallInput(submitted)
   const t = await getTranslator()
+  if (!(await installUnlocked())) {
+    return { errors: { form: t.t('installUnlock.required') }, values }
+  }
+
+  const parsed = parseInstallInput(submitted)
   if (!parsed.ok) return { errors: translatedErrors(parsed.errors, t), values }
 
   if (!canProceed(await gatherPreflight())) {

package/src/server/install-restore-actions.ts

@@ -5,6 +5,7 @@ import { isAppError, logger } from '@meith/core'
 import { getTranslator } from './i18n'
 import { installerIsSealed } from './install'
 import { type InstallRestoreOutcome, runInstallRestore } from './install-restore'
+import { installUnlocked } from './install-unlock'
 
 export interface InstallRestoreState {
   readonly error?: string
@@ -17,6 +18,7 @@ export async function installRestoreAction(
 ): Promise<InstallRestoreState> {
   const t = await getTranslator()
   if (await installerIsSealed()) return { error: t.t('installRestore.alreadyInstalled') }
+  if (!(await installUnlocked())) return { error: t.t('installUnlock.required') }
 
   const raw = form.get('bundle')
   const name = typeof raw === 'string' ? raw.trim() : ''

package/src/server/install-unlock.ts

@@ -0,0 +1,55 @@
+import 'server-only'
+
+import { createHmac } from 'node:crypto'
+
+import { cookies } from 'next/headers'
+
+import { env, timingSafeEqualString } from '@meith/core'
+
+const UNLOCK_COOKIE = 'fs_install_unlock'
+
+const UNLOCK_TTL_MS = 30 * 60 * 1000
+
+function secure(): boolean {
+  return env.NODE_ENV !== 'development'
+}
+
+function sign(issuedAt: number): string {
+  return createHmac('sha256', env.AUTH_SECRET ?? '')
+    .update(`install-unlock:${issuedAt}`)
+    .digest('base64url')
+}
+
+export function operatorSecretMatches(candidate: string): boolean {
+  const secret = env.AUTH_SECRET ?? ''
+  return secret !== '' && candidate !== '' && timingSafeEqualString(candidate, secret)
+}
+
+export async function grantInstallUnlock(now = Date.now()): Promise<void> {
+  const jar = await cookies()
+  jar.set(UNLOCK_COOKIE, `${now}.${sign(now)}`, {
+    httpOnly: true,
+    secure: secure(),
+    sameSite: 'strict',
+    path: '/install',
+    maxAge: UNLOCK_TTL_MS / 1000,
+  })
+}
+
+export async function installUnlocked(now = Date.now()): Promise<boolean> {
+  if ((env.AUTH_SECRET ?? '') === '') return false
+
+  const jar = await cookies()
+  const raw = jar.get(UNLOCK_COOKIE)?.value
+  if (raw === undefined) return false
+
+  const dot = raw.indexOf('.')
+  if (dot < 0) return false
+
+  const issuedAt = Number(raw.slice(0, dot))
+  if (!Number.isInteger(issuedAt) || now - issuedAt > UNLOCK_TTL_MS || issuedAt - now > 60_000) {
+    return false
+  }
+
+  return timingSafeEqualString(raw.slice(dot + 1), sign(issuedAt))
+}

package/src/server/message-actions.ts

@@ -91,7 +91,7 @@ export async function messageBulkAction(_prev: FormState, form: FormData): Promi
           query = `moved=${await service.move(userId, copyIds, 'trash')}`
           break
         case 'restore':
-          query = `moved=${await service.move(userId, copyIds, 'inbox')}`
+          query = `moved=${await service.restore(userId, copyIds)}`
           break
         case 'delete':
           query = `deleted=${await service.remove(userId, copyIds)}`

package/src/server/passkey-challenge.ts

@@ -1,37 +1,70 @@
 import 'server-only'
 
+import { createHmac } from 'node:crypto'
+
+import { env, timingSafeEqualString } from '@meith/core'
+
 export type PasskeyPurpose = 'register' | 'authenticate' | 'second-factor' | 'credential-proof'
 
+export const PASSKEY_CHALLENGE_TTL_MS = 10 * 60 * 1000
+
+export const PASSKEY_CHALLENGE_TTL_SECONDS = PASSKEY_CHALLENGE_TTL_MS / 1000
+
+const CLOCK_SKEW_MS = 60_000
+
 export interface PasskeyChallenge {
   readonly challenge: string
+  readonly issuedAt: number
   readonly userId?: number
   readonly sessionId?: number
   readonly provedAt?: number
 }
 
+function signature(purpose: PasskeyPurpose, payload: string): string {
+  return createHmac('sha256', env.AUTH_SECRET ?? '')
+    .update(`${purpose}:${payload}`)
+    .digest('base64url')
+}
+
 export function packChallenge(
   purpose: PasskeyPurpose,
   challenge: string,
-  binding: Omit<PasskeyChallenge, 'challenge'> = {},
+  binding: Omit<PasskeyChallenge, 'challenge' | 'issuedAt'> = {},
+  now: number = Date.now(),
 ): string {
-  return `${purpose}:${encodeURIComponent(JSON.stringify({ challenge, ...binding }))}`
+  const payload = Buffer.from(JSON.stringify({ challenge, issuedAt: now, ...binding })).toString(
+    'base64url',
+  )
+  return `${purpose}:${payload}.${signature(purpose, payload)}`
 }
 
 export function unpackChallenge(
   raw: string | undefined,
   purpose: PasskeyPurpose,
+  now: number = Date.now(),
 ): PasskeyChallenge | null {
   if (raw === undefined) return null
 
   const separator = raw.indexOf(':')
   if (separator < 0 || raw.slice(0, separator) !== purpose) return null
 
+  const body = raw.slice(separator + 1)
+  const dot = body.indexOf('.')
+  if (dot < 0) return null
+
+  const payload = body.slice(0, dot)
+  const provided = body.slice(dot + 1)
+  if (!timingSafeEqualString(provided, signature(purpose, payload))) return null
+
   try {
-    const value = JSON.parse(decodeURIComponent(raw.slice(separator + 1))) as Record<
+    const value = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as Record<
       string,
       unknown
     >
     if (typeof value.challenge !== 'string' || value.challenge === '') return null
+    if (typeof value.issuedAt !== 'number' || !Number.isInteger(value.issuedAt)) return null
+    if (now - value.issuedAt > PASSKEY_CHALLENGE_TTL_MS) return null
+    if (value.issuedAt - now > CLOCK_SKEW_MS) return null
     if (value.userId !== undefined && !Number.isInteger(value.userId)) return null
     if (value.sessionId !== undefined && !Number.isInteger(value.sessionId)) return null
     if (value.provedAt !== undefined && !Number.isInteger(value.provedAt)) return null

package/src/server/poll-scope.ts

@@ -32,6 +32,12 @@ export async function resolvePollScope(actor: Actor, threadId: number): Promise<
   }
   if (!authorizer.can(actor, 'thread.view', scope)) return null
 
+  if (
+    (located.visibility === 'deleted' && !authorizer.can(actor, 'content.viewDeleted', scope)) ||
+    (located.visibility === 'unapproved' && !authorizer.can(actor, 'content.viewUnapproved', scope))
+  )
+    return null
+
   const wroteIt = actor.userId !== null && located.authorUserId === actor.userId
   const editsOwn = wroteIt && authorizer.can(actor, 'post.editOwn', scope)
   const mayEditOthers = authorizer.can(actor, 'post.editOthers', scope)

package/src/server/post-notifications.ts

@@ -1,7 +1,7 @@
 import 'server-only'
 
 import { foldIdentifier } from '@meith/accounts'
-import { logger } from '@meith/core'
+import { audienceFilterIn, authorFilterAdmits, logger } from '@meith/core'
 import { extractMentions, extractQuotedAuthors, vocabularyOptions } from '@meith/markdown'
 
 import { postLink } from '@/view/post-link'
@@ -15,8 +15,10 @@ const MAX_RECIPIENTS_PER_KIND = 10
 export interface NewPostNotice {
   readonly postId: number
   readonly threadId: number
+  readonly forumId: number
   readonly threadSlug: string
   readonly threadTitle: string
+  readonly threadAuthorId: number | null
   readonly message: string
   readonly authorUsername: string
   readonly visibility: 'visible' | 'unapproved'
@@ -35,7 +37,7 @@ export async function notifyPostAudience(notice: NewPostNotice): Promise<void> {
     const href = postLink(`/thread/${notice.threadId}-${notice.threadSlug}`, notice.postId)
     const data = { byUsername: notice.authorUsername, threadTitle: notice.threadTitle }
 
-    const { accountStore } = getContainer()
+    const { accountStore, actorSource, authorizer } = getContainer()
     const told = new Set<string>([foldIdentifier(notice.authorUsername)])
 
     for (const [kind, names] of [
@@ -52,6 +54,12 @@ export async function notifyPostAudience(notice: NewPostNotice): Promise<void> {
         const account = await accountStore.accounts.findByUsernameLower(folded)
         if (account === null) continue
 
+        const recipient = await actorSource.buildForUser(account.id)
+        if (recipient === null) continue
+        const audience = await authorizer.threadAudience(recipient)
+        const filter = audienceFilterIn(audience, notice.forumId)
+        if (!authorFilterAdmits(filter, notice.threadAuthorId)) continue
+
         await service.raise({
           userId: account.id,
           kind,

package/src/server/post-scope.ts

@@ -36,9 +36,13 @@ export async function resolvePostScope(
   const scope = {
     ...(await moderatorTargetFor(actor, target.forum.id, matrix)),
     ownerId: target.post.authorUserId,
+    threadAuthorId: target.thread.authorUserId,
   }
   if (!authorizer.can(actor, 'thread.view', scope)) return null
 
+  const visibleStates = authorizer.contentScope(actor, scope)
+  if (!visibleStates.states.includes(target.thread.visibility)) return null
+
   const isOwn = actor.userId !== null && target.post.authorUserId === actor.userId
   const editsOthers = authorizer.can(actor, 'post.editOthers', scope)
   const moderates = authorizer.can(actor, 'content.viewUnapproved', scope)

package/src/server/reply-core.ts

@@ -162,8 +162,10 @@ export async function submitReply(
   await notifyPostAudience({
     postId: created.postId,
     threadId: created.threadId,
+    forumId,
     threadSlug: created.slug,
     threadTitle: target.title,
+    threadAuthorId: target.authorUserId,
     message: draft.body,
     authorUsername: profile.username,
     visibility: created.visibility,

package/src/server/thread-core.ts

@@ -201,8 +201,10 @@ export async function submitThread(
   await notifyPostAudience({
     postId: created.postId,
     threadId: created.threadId,
+    forumId: forum.id,
     threadSlug: created.slug,
     threadTitle: draft.subject ?? input.title,
+    threadAuthorId: userId,
     message: draft.body,
     authorUsername: profile.username,
     visibility: created.visibility,

package/src/server/thread-rating-actions.ts

@@ -38,6 +38,12 @@ export async function rateThreadAction(form: FormData): Promise<void> {
   }
   if (!authorizer.can(actor, 'thread.view', target))
     throw new ValidationError(msg('error.app.thread-exist'))
+  if (
+    (located?.visibility === 'deleted' && !authorizer.can(actor, 'content.viewDeleted', target)) ||
+    (located?.visibility === 'unapproved' &&
+      !authorizer.can(actor, 'content.viewUnapproved', target))
+  )
+    throw new ValidationError(msg('error.app.thread-exist'))
   const recorded = await new ThreadRatingService(polls).rate({
     threadId,
     userId: actor.userId,

package/src/server/two-factor-actions.ts

@@ -12,6 +12,7 @@ import { recordAuthEvent } from './auth-events'
 import type { FormState } from './auth-form-state'
 import { getContainer } from './container'
 import { getActor } from './context'
+import { requireFreshCredentialProof } from './credential-proof'
 import { assertDemoAccountChangeable } from './demo'
 import { formStateReporter } from './form-state-reporter'
 import { text } from './form-values'
@@ -59,6 +60,8 @@ async function requireOwnFactor(): Promise<Owner> {
 }
 
 export async function beginTwoFactorAction(_prev: FormState, _form: FormData): Promise<FormState> {
+  const actor = await getActor()
+  if (actor.userId !== null) await requireFreshCredentialProof(actor.userId)
   try {
     const { userId } = await requireOwnAccount()
 
@@ -91,6 +94,8 @@ export async function abandonTwoFactorAction(
 }
 
 export async function confirmTwoFactorAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const actor = await getActor()
+  if (actor.userId !== null) await requireFreshCredentialProof(actor.userId)
   try {
     const { userId } = await requireOwnAccount()
 

package/src/server/upgrade-notice.ts

@@ -17,7 +17,7 @@ import { planUpgrade, type UpgradeState, upgradeNotice } from '@meith/upgrade'
 
 import { activeDefinitions } from './plugin-host'
 
-export const CODE_VERSION = '0.34.0'
+export const CODE_VERSION = '0.35.1'
 
 export interface UpgradeApplied {
   readonly plugins: readonly string[]

package/src/server/user-admin-actions.ts

@@ -447,15 +447,15 @@ async function queueMassMailBatch(
   bulk: ReturnType<typeof requireUserBulk>,
   massMailId: number,
 ): Promise<{ state: FormState; sent: number; queued: number }> {
-  const chunk = await bulk.claimMassMailChunk(massMailId, MASS_MAIL_CHUNK)
-
-  for (const recipient of chunk.recipients) {
-    await drivers().queue.enqueue(
-      'admin.mass_mail',
-      { massMailId, userId: recipient.userId, email: recipient.email },
-      { dedupeKey: `mass-mail:${massMailId}:${recipient.userId}` },
-    )
-  }
+  const chunk = await bulk.claimMassMailChunk(massMailId, MASS_MAIL_CHUNK, async (recipients) => {
+    for (const recipient of recipients) {
+      await drivers().queue.enqueue(
+        'admin.mass_mail',
+        { massMailId, userId: recipient.userId, email: recipient.email },
+        { dedupeKey: `mass-mail:${massMailId}:${recipient.userId}` },
+      )
+    }
+  })
 
   const total = (await bulk.readMassMail(massMailId))?.queuedCount ?? 0
 

package/src/server/usercp-actions.ts

@@ -23,6 +23,7 @@ import { formStateReporter } from './form-state-reporter'
 import { text } from './form-values'
 import { getTranslator, tr } from './i18n'
 import { boardRendering } from './markdown-pipeline'
+import { notificationService } from './notifications'
 import { emitEvent } from './plugin-view'
 import { profileFieldService, submittedFields, viewerFieldContext } from './profile-fields'
 import { setSessionCookie } from './session-cookies'
@@ -170,6 +171,7 @@ export async function changePasswordAction(_prev: FormState, form: FormData): Pr
     if (admin !== null) await admin.endAllFor(userId)
 
     await revokeFeedToken(userId)
+    await notificationService()?.unsubscribeAllFromPush(userId)
 
     await recordAuthEvent({ userId, kind: 'password_changed' })
   } catch (err) {