@nauticana/sail 1.1.32 → 1.1.34

package/src/component/login/social_login.ts

@@ -7,7 +7,7 @@ import { BaseAuthService } from '../../service/auth.service';
 import { loadScript } from '../../service/script_loader';
 import { SAIL_GUI_CONFIG, SailGuiConfig, DEFAULT_CONFIG } from '../../config';
 import {
-  ConsentState, LoginResponseSocial, SignupConsent, SocialProvider,
+  ConsentState, LoginResponseSocial, SignupConsent, SocialName, SocialProvider,
 } from '../../model/auth';
 import { firstValueFrom } from 'rxjs';
 
@@ -22,7 +22,8 @@ const APPLE_URL = 'https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/
  * buttons using each provider's official SDK.
  *
  * Flow: click → SDK returns ID token → BaseAuthService.loginSocial(provider,
- * idToken, signupConsent) → emits loginSuccess / loginError.
+ * idToken, signupConsent) → emits loginSuccess / loginError. Apple's
+ * first-authorization name rides along as loginSuccess.socialName.
  *
  * Requires `googleClientId` / `appleServiceId` in SailGuiConfig; providers
  * without config are hidden (with a console.warn for diagnostics).
@@ -104,17 +105,17 @@ export class SocialLoginComponent extends BaseAsync implements OnInit {
     try {
       const res = await AppleID.auth.signIn();
       const token = res?.authorization?.id_token;
-      if (token) this.onIdToken('apple', token);
+      if (token) this.onIdToken('apple', token, res.user?.name);
     } catch (err: unknown) {
       this.loginError.emit(err instanceof Error ? err : new Error(String(err)));
     }
   }
 
-  private onIdToken(provider: SocialProvider, idToken: string) {
+  private onIdToken(provider: SocialProvider, idToken: string, socialName?: SocialName) {
     const fallback = `Sign-in with ${provider} failed.`;
     this.run(
       this.auth.loginSocial(provider, idToken, this.buildSignupConsent()),
-      (resp) => this.loginSuccess.emit(resp),
+      (resp) => this.loginSuccess.emit(socialName ? { ...resp, socialName } : resp),
       fallback,
       (err) => this.loginError.emit(this.toError(err, fallback)),
     );

package/src/component/security/sessions.html

@@ -0,0 +1,46 @@
+<div class="auth-container">
+  <div class="auth-card">
+    <h2 class="auth-title">Sessions</h2>
+    <p class="auth-instructions">Where your account is signed in.</p>
+
+    @if (sessions().length > 0) {
+      <table class="sessions-table">
+        <thead>
+          <tr>
+            <th>Device</th>
+            <th>Address</th>
+            <th>Signed In</th>
+            <th>Last Active</th>
+            <th><span class="cdk-visually-hidden">Actions</span></th>
+          </tr>
+        </thead>
+        <tbody>
+          @for (session of sessions(); track session.id) {
+            <tr>
+              <td>{{ session.userAgent || 'Unknown device' }} ({{ methodCaption(session.signInMethod) }})</td>
+              <td>{{ session.clientIp }}</td>
+              <td>{{ session.createdAt | date: 'short' }}</td>
+              <td>{{ session.lastSeenAt | date: 'short' }}</td>
+              <td>
+                @if (session.current) {
+                  This device
+                } @else {
+                  <button matButton type="button" (click)="revoke(session)" [disabled]="loading()">Sign out</button>
+                }
+              </td>
+            </tr>
+          }
+        </tbody>
+      </table>
+    } @else if (!loading()) {
+      <p class="empty-state">No active sessions.</p>
+    }
+
+    @if (errorMessage()) {
+      <div class="auth-error" role="alert">{{ errorMessage() }}</div>
+    }
+    @if (successMessage()) {
+      <div class="auth-success" role="status">{{ successMessage() }}</div>
+    }
+  </div>
+</div>

package/src/component/security/sessions.ts

@@ -0,0 +1,45 @@
+import { ChangeDetectionStrategy, Component, OnInit, ViewEncapsulation, inject, signal } from '@angular/core';
+import { DatePipe } from '@angular/common';
+import { MatButtonModule } from '@angular/material/button';
+import { BaseAsync } from '../abstract/base_async';
+import { BaseAuthService } from '../../service/auth.service';
+import { ActiveSession } from '../../model/appdata';
+
+@Component({
+  selector: 'sail-sessions',
+  templateUrl: './sessions.html',
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  encapsulation: ViewEncapsulation.None,
+  imports: [DatePipe, MatButtonModule],
+})
+export class SessionsComponent extends BaseAsync implements OnInit {
+  private readonly auth = inject(BaseAuthService);
+
+  readonly sessions = signal<ActiveSession[]>([]);
+  private readonly methods = new Map(
+    (this.auth.getDomainValues('sign_in_method') ?? []).map((v) => [v.Value, v.Caption]));
+
+  ngOnInit() {
+    this.loadSessions();
+  }
+
+  loadSessions() {
+    this.run(this.auth.getSessions(), (sessions) => this.sessions.set(sessions), 'Failed to load sessions.');
+  }
+
+  methodCaption(code: string): string {
+    return this.methods.get(code) ?? code;
+  }
+
+  revoke(session: ActiveSession) {
+    if (!confirm(`Sign out the session on ${session.userAgent || 'an unknown device'}?`)) return;
+    this.run(
+      this.auth.revokeSession(session.id),
+      () => {
+        this.loadSessions();
+        this.successMessage.set('Session signed out.');
+      },
+      'Failed to sign out the session.',
+    );
+  }
+}

package/src/component/security/twofactor_verify.html

@@ -5,9 +5,11 @@
     </div>
   }
   <div class="auth-card">
-    <h2 class="auth-title">Two-Factor Verification</h2>
+    <h2 class="auth-title">{{ emailed ? 'Confirm Sign-In' : 'Two-Factor Verification' }}</h2>
     <p class="auth-instructions">
-      @if (useBackupCode()) {
+      @if (emailed) {
+        We emailed you a sign-in code because this device is new. Enter it to continue.
+      } @else if (useBackupCode()) {
         Enter one of your backup codes.
       } @else {
         Enter the 6-digit code from your authenticator app.
@@ -19,7 +21,7 @@
         <input matInput type="text" formControlName="code" autocomplete="one-time-code" required>
       </mat-form-field>
 
-      @if (!useBackupCode()) {
+      @if (!useBackupCode() && !emailed) {
         <div class="auth-checkbox">
           <mat-checkbox formControlName="trustDevice">
             Trust this device for 30 days
@@ -36,11 +38,13 @@
       </button>
     </form>
     <div class="auth-actions">
-      <a tabindex="0" role="button" (click)="toggleBackupCode()" (keydown.enter)="toggleBackupCode()"
-         (keydown.space)="$event.preventDefault(); toggleBackupCode()">
-        {{ useBackupCode() ? 'Use authenticator code' : 'Use a backup code instead' }}
-      </a>
-      <a routerLink="/login/local">Back to Login</a>
+      @if (!emailed) {
+        <a tabindex="0" role="button" (click)="toggleBackupCode()" (keydown.enter)="toggleBackupCode()"
+           (keydown.space)="$event.preventDefault(); toggleBackupCode()">
+          {{ useBackupCode() ? 'Use authenticator code' : 'Use a backup code instead' }}
+        </a>
+      }
+      <a routerLink="/login/local" queryParamsHandling="preserve">Back to Login</a>
     </div>
   </div>
 </div>

package/src/component/security/twofactor_verify.ts

@@ -29,6 +29,7 @@ export class TwoFactorVerifyComponent extends BaseAsync {
   protected readonly guiConfig: SailGuiConfig = inject(SAIL_GUI_CONFIG, {optional: true}) ?? DEFAULT_CONFIG;
 
   readonly useBackupCode = signal(false);
+  readonly emailed = this.auth.pendingTwoFactorMethod() === 'email';
 
   readonly verifyForm = this.fb.group({
     code: ['', [Validators.required, Validators.minLength(6)]],
@@ -58,7 +59,7 @@ export class TwoFactorVerifyComponent extends BaseAsync {
       );
     } else {
       this.run(
-        this.auth.verify2FALogin(code!, trustDevice ?? false, this.getDeviceName()),
+        this.auth.verify2FALogin(code!, !this.emailed && !!trustDevice, this.getDeviceName()),
         (res) => {
           if (!res.valid || !res.token) {
             this.errorMessage.set('Invalid authentication code.');

package/src/index.ts

@@ -52,6 +52,7 @@ export * from './component/account/my_account';
 export * from './component/security/twofactor_setup';
 export * from './component/security/twofactor_verify';
 export * from './component/security/trusted_devices';
+export * from './component/security/sessions';
 export * from './component/billing/plan_selector';
 export * from './component/billing/price_selector';
 export * from './component/billing/checkout_button';
@@ -93,6 +94,7 @@ export * from './service/api-response.interceptor';
 export * from './service/rest_service';
 export * from './service/rest_url';
 export * from './service/label.service';
+export * from './service/caption_pipe';
 export * from './service/base_rest.service';
 export * from './util/text';
 export * from './util/money';

package/src/model/appdata.ts

@@ -164,6 +164,8 @@ export interface LoginResponse2FA {
   refreshToken?: string;
   twoFactorRequired: boolean;
   loginToken?: string;
+  /** 'email': a new-device step-up code was emailed; absent: the authenticator app. */
+  twoFactorMethod?: 'email';
   userId?: number;
   partnerId?: number;
   // Populated for users with the single-device session policy enabled.
@@ -198,6 +200,16 @@ export interface TrustedDevice {
   created_at:   string;
 }
 
+export interface ActiveSession {
+  id:           number;
+  userAgent:    string;
+  clientIp:     string;
+  signInMethod: string;
+  createdAt:    string;
+  lastSeenAt:   string;
+  current:      boolean;
+}
+
 // Mirrors keel `user.AccountRegistration`.
 export interface AccountRegistration {
 	firstName: string;

package/src/model/auth.ts

@@ -115,11 +115,19 @@ export interface UserProfile {
 
 // ── Re-authentication credentials ──
 // Required by Setup2FA, Disable2FA, DeleteAccount, LogoutEverywhere — server
-// rejects with 401 if neither `password` nor `twoFactorCode` is supplied.
-// Disable2FA additionally requires the current TOTP `code` alongside password.
+// rejects with 401 unless one is supplied. `reauthCode` comes from
+// sendReauthCode(). Disable2FA additionally requires the current TOTP `code`.
 export interface ReauthCredentials {
   password?:      string;
   twoFactorCode?: string;
+  reauthCode?:    string;
+}
+
+export type ReauthChannel = 'email' | 'phone';
+
+export interface ReauthSendResponse {
+  channel:            ReauthChannel;
+  resendCountdownSec: number;
 }
 
 // ── Social login (ID token flow) ──
@@ -144,6 +152,13 @@ export interface LoginResponseSocial {
   isNewUser:               boolean;
   singleDeviceSession?:    boolean;
   previousDeviceRevoked?:  boolean;
+  // Client-side: the name Apple returns only on first authorization, never in the ID token.
+  socialName?:             SocialName;
+}
+
+export interface SocialName {
+  firstName?: string;
+  lastName?:  string;
 }
 
 // ── Push notification tokens ──

package/src/service/auth.service.ts

@@ -2,12 +2,12 @@ import { Injectable, WritableSignal, inject, signal } from '@angular/core';
 import { HttpErrorResponse, HttpParams } from '@angular/common/http';
 import { filter, finalize, map, mergeMap, shareReplay, take, tap } from 'rxjs/operators';
 import { PasswordRules } from '../util/password_policy';
-import { ApplicationData, ConfirmRegisterResponse, DictionaryPath, LoginResponse2FA, PartnerCreated, PartnerRegistration, PartnerSetup, RestReport, TableDefinition, TokenPair, TrustedDevice, TwoFactorSetupResponse, TwoFactorVerifyRequest, TwoFactorVerifyResponse } from '../model/appdata';
+import { ActiveSession, ApplicationData, ConfirmRegisterResponse, DictionaryPath, LoginResponse2FA, PartnerCreated, PartnerRegistration, PartnerSetup, RestReport, TableDefinition, TokenPair, TrustedDevice, TwoFactorSetupResponse, TwoFactorVerifyRequest, TwoFactorVerifyResponse } from '../model/appdata';
 import {
   LoginResponseSocial,
   OtpRequest, OtpResendRequest, OtpResponse, OtpVerifyRequest, OtpVerifyResponse,
   PushPlatform, PushRegisterRequest,
-  ReauthCredentials,
+  ReauthChannel, ReauthCredentials, ReauthSendResponse,
   SignupConsent, SocialLoginRequest, SocialProvider,
   UserProfile,
 } from '../model/auth';
@@ -104,12 +104,15 @@ export abstract class BaseAuthService extends BaseRestService {
   protected get trustedDeviceListUrl()     { return this.url(RestURL.trustedDeviceListURL); }
   protected get trustedDeviceRegisterUrl() { return this.url(RestURL.trustedDeviceRegisterURL); }
   protected get trustedDeviceRevokeUrl()   { return this.url(RestURL.trustedDeviceRevokeURL); }
+  protected get sessionListUrl()           { return this.url(RestURL.sessionListURL); }
+  protected get sessionRevokeUrl()         { return this.url(RestURL.sessionRevokeURL); }
   protected get otpSendUrl()               { return this.url(RestURL.otpSendURL); }
   protected get otpVerifyUrl()             { return this.url(RestURL.otpVerifyURL); }
   protected get otpResendUrl()             { return this.url(RestURL.otpResendURL); }
   protected get loginSocialUrl()           { return this.url(RestURL.loginSocialURL); }
   protected get logoutEverywhereUrl()      { return this.url(RestURL.logoutEverywhereURL); }
   protected get deleteAccountUrl()         { return this.url(RestURL.deleteAccountURL); }
+  protected get reauthSendUrl()            { return this.url(RestURL.reauthSendURL); }
   protected get pushRegisterUrl()          { return this.url(RestURL.pushRegisterURL); }
   protected get pushRevokeUrl()            { return this.url(RestURL.pushRevokeURL); }
   protected get profileUrl()               { return this.url(RestURL.profileURL); }
@@ -146,6 +149,8 @@ export abstract class BaseAuthService extends BaseRestService {
    *  signs in again to retry instead of being redirected without a session. */
   readonly sessionHandoffError = signal<string | null>(null);
 
+  readonly signInPrompt = signal<'login' | 'select_account' | null>(null);
+
   /**
    * Multi-role app support. Consumers that distinguish rider/driver/admin
    * (or any equivalent split) call setRole() after login, then
@@ -219,9 +224,14 @@ export abstract class BaseAuthService extends BaseRestService {
   private completeLogin(token: string, refreshToken?: string) {
     this.refreshInFlight = null;         // a rotation started under the previous session must not land
     this.sessionGeneration++;
+    const replaced = localStorage.getItem('refreshToken');
+    if (replaced && replaced !== refreshToken) this.revokeRefreshToken(replaced).subscribe();
     this.storeTokens(token, refreshToken);
+    localStorage.removeItem('loginToken');
+    localStorage.removeItem('twoFactorMethod');
     this.isLoggedIn.set(true);
     this.sessionHandoffError.set(null);
+    this.signInPrompt.set(null);
     resetAuthCircuit(); // a new session must not inherit a prior session's open circuit
     if (this.startHandoff()) return;
     this.loadAppData();
@@ -231,13 +241,27 @@ export abstract class BaseAuthService extends BaseRestService {
   /** Hands the session to the OAuth authorization server when the page carries an
    * allowed `?return=` and oauthServerUrl is set; false when there is nothing to hand off. */
   private startHandoff(): boolean {
-    const ret = this.validatedReturnUrl();
-    const oauthServer = this.oauthServerBase();
-    if (!ret || !oauthServer) return false;
-    this.handOffSession(oauthServer, ret);
+    if (!this.handoffPending()) return false;
+    this.handOffSession(this.oauthServerBase(), this.validatedReturnUrl());
     return true;
   }
 
+  private handoffPending(): boolean {
+    return !!this.validatedReturnUrl() && !!this.oauthServerBase();
+  }
+
+  continueSession(): void {
+    if (this.signInPrompt() !== 'select_account') return;
+    this.signInPrompt.set(null);
+    this.adoptStoredToken();
+    this.startHandoff();
+  }
+
+  private adoptStoredToken(): void {
+    this.token = localStorage.getItem('jwt');
+    this.isLoggedIn.set(!!this.token);
+  }
+
   /** Exchange the bearer session for the authorization server's own cookie session
    * (keel POST /oauth/session/handoff), then leave the SPA for the URL it returns.
    * A 401 rotates the refresh token once and retries. Any failure stays on the
@@ -297,7 +321,10 @@ export abstract class BaseAuthService extends BaseRestService {
   private handleLoginResponse(res: LoginResponse2FA): void {
     if (res.twoFactorRequired && res.loginToken) {
         localStorage.setItem('loginToken', res.loginToken);
-        this.router.navigate(['/login/2fa']);
+        if (res.twoFactorMethod) localStorage.setItem('twoFactorMethod', res.twoFactorMethod);
+        else localStorage.removeItem('twoFactorMethod');
+        // Preserve ?return= so the login still hands off after the second factor.
+        this.router.navigate(['/login/2fa'], { queryParamsHandling: 'preserve' });
     } else {
         this.completeLogin(res.token, res.refreshToken);
     }
@@ -330,7 +357,8 @@ export abstract class BaseAuthService extends BaseRestService {
   /**
    * POST credentials; success completes the login (or routes to 2FA). Callers
    * subscribe and handle the error channel to surface failures in the UI.
-   * withCredentials sends keel's `keel_td` trusted-device cookie (skips 2FA).
+   * withCredentials sends keel's `keel_td` trusted-device cookie (skips 2FA)
+   * and `keel_device` cookie (a recognized device), as every session-minting call does.
    */
   login(username: string, password: string): Observable<LoginResponse2FA> {
     return this.http.post<LoginResponse2FA>(this.loginUrl, { username, password }, { withCredentials: true }).pipe(
@@ -362,40 +390,29 @@ export abstract class BaseAuthService extends BaseRestService {
     return this.http.post<TwoFactorVerifyResponse>(this.twoFactorVerifyUrl, request);
   }
 
+  pendingTwoFactorMethod(): LoginResponse2FA['twoFactorMethod'] {
+    return localStorage.getItem('twoFactorMethod') === 'email' ? 'email' : undefined;
+  }
+
   /**
-   * Verify a TOTP code during the LOGIN flow (public endpoint, `/public/2fa/verify`).
-   * Returns the response so callers can drive loading / invalid-code UI; on a
-   * valid code the login is completed (token stored, app data + routes loaded).
+   * Verify the login-time code (`/public/2fa/verify`): a TOTP code, or the
+   * emailed code of a new-device step-up. A valid code completes the login.
    * withCredentials so the browser stores the `keel_td` cookie keel sets on a
    * `trustDevice:true` verify — that cookie is what skips 2FA next login.
    */
   verify2FALogin(code: string, trustDevice = false, deviceName?: string): Observable<TwoFactorVerifyResponse> {
-    const request: TwoFactorVerifyRequest = {
-        code,
-        loginToken: localStorage.getItem('loginToken') ?? '',
-        trustDevice,
-        deviceName,
-    };
-    return this.http.post<TwoFactorVerifyResponse>(this.twoFactorLoginVerifyUrl, request, { withCredentials: true }).pipe(
-        tap((res) => {
-            if (res.valid && res.token) {
-                localStorage.removeItem('loginToken');
-                this.completeLogin(res.token, res.refreshToken);
-            }
-        }),
-    );
+    return this.verifyLogin(this.twoFactorLoginVerifyUrl, { code, trustDevice, deviceName });
   }
 
-  /** Verify a login-flow backup code; a valid code completes the login (same contract as verify2FALogin). */
+  /** Verify a login-flow backup code; same contract as verify2FALogin. */
   verifyBackupCode(code: string): Observable<TwoFactorVerifyResponse> {
-    const loginToken = localStorage.getItem('loginToken');
-    return this.http.post<TwoFactorVerifyResponse>(this.twoFactorBackupVerifyUrl, { code, loginToken }, { withCredentials: true }).pipe(
-        tap((res) => {
-            if (res.valid && res.token) {
-                localStorage.removeItem('loginToken');
-                this.completeLogin(res.token, res.refreshToken);
-            }
-        }),
+    return this.verifyLogin(this.twoFactorBackupVerifyUrl, { code });
+  }
+
+  private verifyLogin(url: string, body: object): Observable<TwoFactorVerifyResponse> {
+    const request = { ...body, loginToken: localStorage.getItem('loginToken') ?? '' };
+    return this.http.post<TwoFactorVerifyResponse>(url, request, { withCredentials: true }).pipe(
+        tap((res) => { if (res.valid && res.token) this.completeLogin(res.token, res.refreshToken); }),
     );
   }
 
@@ -417,6 +434,14 @@ export abstract class BaseAuthService extends BaseRestService {
     return this.http.post<{ message: string }>(this.trustedDeviceRevokeUrl, { deviceId });
   }
 
+  getSessions() {
+    return this.http.get<ActiveSession[]>(this.sessionListUrl);
+  }
+
+  revokeSession(id: number) {
+    return this.http.post<void>(this.sessionRevokeUrl, { id });
+  }
+
   chpass(username: string, new_password: string, old_password: string) {
     return this.http.post<{ status: string }>(this.chpassUrl, { username, old_password, new_password })
       .pipe(tap(() => this.passwordChanged()));
@@ -458,7 +483,7 @@ export abstract class BaseAuthService extends BaseRestService {
    *  answers. A registration without partner fields leaves `partnerId` 0. */
   confirmRegister(email: string, code: string): Observable<ConfirmRegisterResponse> {
     const params = new HttpParams().set('email', email).set('code', code);
-    return this.http.post<ConfirmRegisterResponse>(this.confirmRegisterUrl, null, { params }).pipe(
+    return this.http.post<ConfirmRegisterResponse>(this.confirmRegisterUrl, null, { params, withCredentials: true }).pipe(
         tap((res) => this.completeLogin(res.token, res.refreshToken)),
     );
   }
@@ -488,11 +513,20 @@ export abstract class BaseAuthService extends BaseRestService {
   }
 
   loadStoredSession() {
-    this.token = localStorage.getItem('jwt');
-    if (!this.token) return;
-    this.isLoggedIn.set(true);
-    // A signed-in user sent to the login page by the authorization server is handed off without signing in again.
-    if (window.location.pathname.startsWith('/login') && this.startHandoff()) return;
+    if (!localStorage.getItem('jwt')) return;
+    // A signed-in user sent to the login page by the authorization server is handed
+    // off without signing in again, unless the server asks for a sign-in.
+    const handoff = window.location.pathname.startsWith('/login') && this.handoffPending();
+    const prompt = handoff ? new URLSearchParams(window.location.search).get('prompt') : null;
+    if (prompt === 'login' || prompt === 'select_account') {
+      this.signInPrompt.set(prompt);
+      return;
+    }
+    this.adoptStoredToken();
+    if (handoff) {
+      this.startHandoff();
+      return;
+    }
     this.loadAppData();
     this.initRoutes();
   }
@@ -500,13 +534,17 @@ export abstract class BaseAuthService extends BaseRestService {
   /** Revoke the refresh token server-side (best effort: the local session is
    *  cleared regardless), then land on the login screen. */
   logout() {
+    this.signOutHere();
+    this.router.navigate(['/login/local'], { queryParams: { loggedOut: 'true' } });
+  }
+
+  /** logout() without navigating, so the login page keeps its `?return=`. */
+  signOutHere() {
     this.revokeRefreshToken().subscribe();
     this.clearSession();
-    this.router.navigate(['/login/local'], { queryParams: { loggedOut: 'true' } });
   }
 
-  private revokeRefreshToken(): Observable<unknown> {
-    const refreshToken = localStorage.getItem('refreshToken');
+  private revokeRefreshToken(refreshToken = localStorage.getItem('refreshToken')): Observable<unknown> {
     if (!refreshToken) return EMPTY;
     return this.http.post(this.logoutUrl, { refreshToken }).pipe(
       catchError((err) => { console.warn('refresh token revocation failed:', err); return EMPTY; }),
@@ -549,7 +587,7 @@ export abstract class BaseAuthService extends BaseRestService {
    * omitted (single-role apps), the role stays unchanged.
    */
   verifyOtp(req: OtpVerifyRequest, role?: string): Observable<OtpVerifyResponse> {
-    return this.http.post<OtpVerifyResponse>(this.otpVerifyUrl, req).pipe(
+    return this.http.post<OtpVerifyResponse>(this.otpVerifyUrl, req, { withCredentials: true }).pipe(
       tap((res) => {
         if (res?.token) {
           this.completeLogin(res.token, res.refreshToken);
@@ -569,7 +607,7 @@ export abstract class BaseAuthService extends BaseRestService {
     consent?: SignupConsent,
   ): Observable<LoginResponseSocial> {
     const payload: SocialLoginRequest = { provider, token: idToken, ...consent };
-    return this.http.post<LoginResponseSocial>(this.loginSocialUrl, payload).pipe(
+    return this.http.post<LoginResponseSocial>(this.loginSocialUrl, payload, { withCredentials: true }).pipe(
       tap((res) => { if (res?.token) this.completeLogin(res.token, res.refreshToken); }),
     );
   }
@@ -588,9 +626,14 @@ export abstract class BaseAuthService extends BaseRestService {
 
   // ── Account lifecycle ──
 
+  /** Send a one-time code for ReauthCredentials.reauthCode; no channel prefers email. */
+  sendReauthCode(channel?: ReauthChannel): Observable<ReauthSendResponse> {
+    return this.http.post<ReauthSendResponse>(this.reauthSendUrl, { channel });
+  }
+
   /**
    * Soft-delete the caller's account. Requires recent re-authentication —
-   * pass current `password` and/or `twoFactorCode`. Server anonymizes
+   * pass `password`, `twoFactorCode` or `reauthCode`. Server anonymizes
    * user_account, revokes all tokens / trusted devices / social links.
    * Clears local session on success.
    */
@@ -603,8 +646,8 @@ export abstract class BaseAuthService extends BaseRestService {
 
   /**
    * Revoke every active refresh token for this user (sign out everywhere).
-   * Requires recent re-authentication — pass current `password` and/or
-   * `twoFactorCode`.
+   * Requires recent re-authentication — pass `password`, `twoFactorCode`
+   * or `reauthCode`.
    */
   logoutEverywhere(reauth: ReauthCredentials): Observable<void> {
     return this.http.post<void>(this.logoutEverywhereUrl, reauth);
@@ -635,11 +678,13 @@ export abstract class BaseAuthService extends BaseRestService {
     localStorage.removeItem('refreshToken');
     localStorage.removeItem('menu');
     localStorage.removeItem('loginToken');
+    localStorage.removeItem('twoFactorMethod');
     this.clearRole();
     this.cache = undefined;
     this.authIndex.clear();
     this.appDataError.set(null);
     this.sessionHandoffError.set(null);
+    this.signInPrompt.set(null);
     this.refreshInFlight = null;
     this.landing = null;
     this.sessionGeneration++;           // in-flight loads and refreshes from this session are ignored

package/src/service/caption_pipe.ts

@@ -0,0 +1,26 @@
+import { DestroyRef, Pipe, PipeTransform, inject, signal } from '@angular/core';
+import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
+import { LabelService } from './label.service';
+
+/**
+ * `{{ code | sailCaption:'constant_id' }}` — the backend caption of a constant code, the code
+ * itself until its domain loads or when the domain lacks it. Impure so it re-renders on load.
+ */
+@Pipe({ name: 'sailCaption', pure: false })
+export class CaptionPipe implements PipeTransform {
+  private readonly labels = inject(LabelService);
+  private readonly destroyRef = inject(DestroyRef);
+  private readonly requested = new Set<string>();
+  private readonly loaded = signal(0);
+
+  transform(code: string | null | undefined, constantId: string): string {
+    if (!code) return '';
+    this.loaded();
+    if (!this.requested.has(constantId)) {
+      this.requested.add(constantId);
+      this.labels.loadLabels(constantId).pipe(takeUntilDestroyed(this.destroyRef))
+        .subscribe({ next: () => this.loaded.update((n) => n + 1), error: () => this.requested.delete(constantId) });
+    }
+    return this.labels.getLabel(constantId, code);
+  }
+}

package/src/service/label.service.ts

@@ -36,9 +36,10 @@ export class LabelService {
     }
 
     /**
-     * Load one backend-provided `constant_value` domain from ApplicationData.
-     * Completed and concurrent requests are cached; a failed application-data
-     * load is evicted so a later call can retry.
+     * Load one caption map from ApplicationData: a `constant_value` domain by its
+     * constant id, or a catalog table registered in `foreign_key_lookup` by its
+     * table name. Completed and concurrent requests are cached; a failed
+     * application-data load is evicted so a later call can retry.
      */
     loadLabels(constantId: string): Observable<void> {
         const domain = constantId.trim();
@@ -53,7 +54,7 @@ export class LabelService {
             tap({
                 next: (data) => this.labels.set(
                     domain,
-                    new Map(Object.entries(data.ConstantCache?.[domain] ?? {})),
+                    new Map(Object.entries(data.ConstantCache?.[domain] ?? data.TableCache?.[domain] ?? {})),
                 ),
                 error: () => this.pendingLoads.delete(domain),
             }),

package/src/service/rest_url.ts

@@ -23,6 +23,8 @@ export const RestURL = {
   trustedDeviceListURL: '/api/user/trusted-device/list',
   trustedDeviceRegisterURL: '/api/user/trusted-device/register',
   trustedDeviceRevokeURL: '/api/user/trusted-device/revoke',
+  sessionListURL: '/api/user/sessions',
+  sessionRevokeURL: '/api/user/sessions/revoke',
   checkoutURL:       '/api/billing/checkout',
   subscriptionURL:   '/api/billing/subscription',
   cancelSubURL:      '/api/billing/subscription/cancel',
@@ -43,6 +45,7 @@ export const RestURL = {
   ssoSamlMetadataURL:  '/public/sso/saml/metadata',
   logoutEverywhereURL: '/api/user/logout-everywhere',
   deleteAccountURL:    '/api/user/account',
+  reauthSendURL:       '/api/user/reauth/send',
   // Self-service profile (keel ProfileHandler). GET profileURL reads the
   // current profile; POST updates name/locale. Email/phone are verify-before-
   // apply (request → confirm). A consumer whose backend mounts these under a

package/src/util/errors.ts

@@ -11,6 +11,12 @@ function problemOf(err: unknown): ProblemShape | undefined {
   return body && typeof body === 'object' ? (body as ProblemShape) : undefined;
 }
 
+const codeMessages = new Map([
+  ['signin_network', 'Sign-in is not allowed from this network.'],
+  ['signin_network_lockout', 'The allowed networks must include your current address.'],
+  ['stepup_unavailable', 'A sign-in code cannot be sent right now. Please try again later.'],
+]);
+
 function asString(value: unknown): string | undefined {
   return typeof value === 'string' && value ? value : undefined;
 }
@@ -58,7 +64,7 @@ export function errorDetail(err: unknown, fallback: string, statuses?: readonly
   }
   const problem = problemOf(err);
   if (problem) {
-    const message = asString(problem.detail) ?? asString(problem.title) ?? asString(problem.message);
+    const message = codeMessages.get(asString(problem.code) ?? '') ?? asString(problem.detail) ?? asString(problem.title) ?? asString(problem.message);
     if (message) return message;
   }
   if (err instanceof Error && err.message) {