@sigrun/sigrun 0.2.1 → 0.3.0

package/dist/server/auth/own-host.js

@@ -0,0 +1,115 @@
+/**
+ * The C5 own-host rule (proxy-trust Task 4b): a peer that IS this host —
+ * loopback (127.0.0.0/8, ::1) or any current interface address — can
+ * reach the server without traversing the forward-auth proxy, because
+ * every local process shares those source addresses. Trusting such a
+ * peer through a CIDR RANGE would let any local process impersonate
+ * users, so an own-host peer vouches only when:
+ *
+ *  1. the shared secret is configured (`secret` + `secretHeader`) — the
+ *     existing secret check then decides; or
+ *  2. that exact address is listed explicitly in `trustedProxies` (a
+ *     bare address, or a /32 (IPv4) / /128 (IPv6) entry) — an explicit
+ *     operator decision, which the boot warning surfaces.
+ *
+ * Otherwise both identity-trust paths (the request pipeline's proxy
+ * method and onboarding's `resolveProxyIdentity`) reject exactly the
+ * way an untrusted peer is rejected, with the OWN_HOST diagnostic.
+ */
+import { networkInterfaces } from "node:os";
+import { isIP } from "node:net";
+import { normalizePeerAddress } from "./ip.js";
+/** Interface addresses refresh at most this often (milliseconds). */
+const CACHE_TTL_MS = 30_000;
+let testAddresses;
+let cached;
+/** The seam override, or the real interface list (cached ≤ 30 s). */
+function ownHostAddresses() {
+    if (testAddresses !== undefined)
+        return testAddresses;
+    const now = Date.now();
+    if (cached === undefined || now - cached.readAt >= CACHE_TTL_MS) {
+        const addresses = [];
+        for (const entries of Object.values(networkInterfaces())) {
+            for (const entry of entries ?? [])
+                addresses.push(entry.address);
+        }
+        cached = { addresses, readAt: now };
+    }
+    return cached.addresses;
+}
+function isLoopback(address) {
+    if (address === "::1")
+        return true;
+    if (isIP(address) !== 4)
+        return false;
+    return address.split(".")[0] === "127";
+}
+/** Loopback (127.0.0.0/8, ::1) or any current interface address; `::ffff:` unwrapped. */
+export function isOwnHostAddress(address) {
+    if (address === undefined)
+        return false;
+    const candidate = normalizePeerAddress(address);
+    if (isLoopback(candidate))
+        return true;
+    return ownHostAddresses().some((entry) => normalizePeerAddress(entry) === candidate);
+}
+/** True when `address` is listed exactly in `cidrs`: a bare address, or a /32 (IPv4) or /128 (IPv6) entry for it. */
+export function listedExactly(address, cidrs) {
+    const candidate = normalizePeerAddress(address);
+    for (const raw of cidrs) {
+        const entry = raw.trim();
+        if (entry === "")
+            continue;
+        const slash = entry.indexOf("/");
+        if (slash === -1) {
+            if (normalizePeerAddress(entry) === candidate)
+                return true;
+            continue;
+        }
+        const base = normalizePeerAddress(entry.slice(0, slash));
+        if (base !== candidate)
+            continue;
+        const prefix = Number(entry.slice(slash + 1));
+        const family = isIP(candidate);
+        if (family === 4 && prefix === 32)
+            return true;
+        if (family === 6 && prefix === 128)
+            return true;
+    }
+    return false;
+}
+/** The C5 rule: false only for an own-host peer reached through a range with no shared secret configured. */
+export function ownHostPeerPermitted(address, trustedProxies, secretConfigured) {
+    if (!isOwnHostAddress(address))
+        return true;
+    if (secretConfigured)
+        return true;
+    return listedExactly(address, trustedProxies);
+}
+/** Test seam: replace the interface addresses (loopback stays implicit); `undefined` restores os.networkInterfaces(). */
+export function setOwnHostAddressesForTests(addresses) {
+    testAddresses = addresses;
+    cached = undefined;
+}
+/** Explicitly listed own-host entries (verbatim spellings), for the boot warning. */
+export function listedOwnHostEntries(trustedProxies) {
+    return trustedProxies.filter((entry) => {
+        const trimmed = entry.trim();
+        if (trimmed === "")
+            return false;
+        const slash = trimmed.indexOf("/");
+        const base = slash === -1 ? trimmed : trimmed.slice(0, slash);
+        if (slash !== -1) {
+            const prefix = Number(trimmed.slice(slash + 1));
+            const family = isIP(normalizePeerAddress(base));
+            if (family === 4 && prefix !== 32)
+                return false;
+            if (family === 6 && prefix !== 128)
+                return false;
+            if (family === 0)
+                return false;
+        }
+        return isOwnHostAddress(base);
+    });
+}

package/dist/server/auth/pipeline.js

@@ -43,13 +43,19 @@
  *     the token's user must exist in the directory, else 401 (no log —
  *     token failures are not proxy diagnostics).
  *  6. **Empty list** (the naive workstation path): the trimmed
- *     `X-Sigrun-User` header verbatim, `admin: true`, method `"none"`.
+ *     `X-Sigrun-User` header DERIVED to its canonical key (`admin: true`,
+ *     method `"none"`). An unusable header (no derivable key) is a loud
+ *     400 `invalid_username`; an absent header behaves as before.
  */
 import { timingSafeEqual } from "node:crypto";
 import { ipAllowed } from "./ip.js";
 import { isLoopbackHost } from "./loopback.js";
+import { listedOwnHostEntries, ownHostPeerPermitted } from "./own-host.js";
+import { ProxyRejectReason, warnProxyRejected } from "./proxy-diagnostic.js";
+import { resolveProxyUser } from "./proxy-identity.js";
 import { AdmissionRefusedError } from "../../harness/identity/users.js";
 import { effectiveAdmin } from "../../harness/identity/groups.js";
+import { deriveUsername } from "@sigrun/shared/usernames";
 /** One header read: Fastify headers may be string | string[]; first wins. */
 function headerOf(request, name) {
     const value = request.headers[name.toLowerCase()];
@@ -190,22 +196,6 @@ function isPublicPath(request, ctx) {
     }
     return false;
 }
-/**
- * The proxy-auth rejection diagnostic (release-readiness Task 1, spec §3):
- * ONE `warn` per rejected request, naming the socket peer, the request
- * method, a short reason, and — only when Fastify already resolved it —
- * the ROUTE TEMPLATE (`routeOptions.url`, never the raw URL). The line
- * must never carry API tokens, cookies, identity-header VALUES, query
- * strings, or the full request URL; a header NAME appears only where the
- * reason itself is "that configured header was absent/wrong" (its value
- * never does). This is diagnostic logging, not evidence that the
- * configured allowlist is correct.
- */
-function warnProxyRejected(request, reason) {
-    const peer = request.socket.remoteAddress ?? "unknown";
-    const route = request.routeOptions.url;
-    console.warn(`sigrun: proxy auth rejected ${request.method} request from ${peer} (${reason})${route === undefined ? "" : ` on ${route}`}`);
-}
 /**
  * Stage 5a (proxy): resolve the forward-auth headers, or reply with the
  * rejection. The secret header is DELETED from the request before any
@@ -229,7 +219,17 @@ async function resolveProxy(request, ctx) {
         ctx.methods.includes("token");
     if (!ipAllowed(request.socket.remoteAddress, proxy.trustedProxies)) {
         if (!attemptingToken) {
-            warnProxyRejected(request, "untrusted proxy");
+            warnProxyRejected(request, ProxyRejectReason.UNTRUSTED);
+        }
+        return { status: 401 };
+    }
+    // C5: an own-host peer (loopback or a local interface address) can
+    // originate from ANY local process, so trust through a range alone
+    // never vouches — the shared secret must be configured (its check
+    // then decides), or the exact address must be listed explicitly.
+    if (!ownHostPeerPermitted(request.socket.remoteAddress, proxy.trustedProxies, proxy.secret !== undefined && proxy.secretHeader !== undefined)) {
+        if (!attemptingToken) {
+            warnProxyRejected(request, ProxyRejectReason.OWN_HOST);
         }
         return { status: 401 };
     }
@@ -239,7 +239,7 @@ async function resolveProxy(request, ctx) {
         delete request.headers[name];
         if (presented === undefined || !timingSafeStringEqual(presented, proxy.secret)) {
             if (!attemptingToken) {
-                warnProxyRejected(request, `missing or wrong shared secret (${proxy.secretHeader} header)`);
+                warnProxyRejected(request, ProxyRejectReason.secretReason(proxy.secretHeader));
             }
             return { status: 401 };
         }
@@ -247,7 +247,7 @@ async function resolveProxy(request, ctx) {
     const user = headerOf(request, proxy.userHeader);
     if (user === undefined) {
         if (!attemptingToken) {
-            warnProxyRejected(request, `missing identity header (${proxy.userHeader})`);
+            warnProxyRejected(request, ProxyRejectReason.missingHeaderReason(proxy.userHeader));
         }
         return { status: 401 };
     }
@@ -255,34 +255,29 @@ async function resolveProxy(request, ctx) {
         ?.split(",")
         .map((group) => group.trim())
         .filter((group) => group !== "") ?? [];
-    const { users } = ctx.opened.identity;
-    // The invalid-username case (a proxy header that can't be a directory
-    // user) is a loud 403, not a 500: the proxy vouched for an identity
-    // this server can never represent. The warn's reason never carries the
-    // claimed value (spec §3: no identity-header values).
-    if (!/^[a-z0-9][a-z0-9._-]*$/.test(user)) {
-        warnProxyRejected(request, "unusable identity claim");
-        return { status: 403, error: "invalid_username" };
-    }
-    const existing = users.get(user);
-    if (existing === undefined && !proxy.autoProvision) {
-        warnProxyRejected(request, "untrusted identity source");
-        return { status: 403, error: "user_not_provisioned" };
-    }
+    const { users, accounts } = ctx.opened.identity;
     let record;
     try {
-        record = existing ??
-            (await users.add({
-                user,
-                ...(headerOf(request, proxy.nameHeader) === undefined
-                    ? {}
-                    : { name: headerOf(request, proxy.nameHeader) }),
-                ...(headerOf(request, proxy.emailHeader) === undefined
-                    ? {}
-                    : { email: headerOf(request, proxy.emailHeader) }),
-                admin: false,
-                source: "proxy",
-            }));
+        const resolved = await resolveProxyUser({ users, accounts }, user, {
+            ...(headerOf(request, proxy.nameHeader) === undefined
+                ? {}
+                : { name: headerOf(request, proxy.nameHeader) }),
+            ...(headerOf(request, proxy.emailHeader) === undefined
+                ? {}
+                : { email: headerOf(request, proxy.emailHeader) }),
+        }, { provision: proxy.autoProvision });
+        // The invalid-username case is a loud 403, not a 500: the proxy
+        // vouched for an identity this server can never represent. The warn
+        // never carries the claimed value (spec §3).
+        if (resolved.kind === "invalid") {
+            warnProxyRejected(request, ProxyRejectReason.UNUSABLE);
+            return { status: 403, error: "invalid_username" };
+        }
+        if (resolved.kind === "not_provisioned") {
+            warnProxyRejected(request, ProxyRejectReason.UNTRUSTED_IDENTITY_SOURCE);
+            return { status: 403, error: "user_not_provisioned" };
+        }
+        record = resolved.record;
     }
     catch (error) {
         if (error instanceof AdmissionRefusedError) {
@@ -294,7 +289,7 @@ async function resolveProxy(request, ctx) {
     // setGroups avoids the write when the values are unchanged. Effective
     // admin is computed over the UPDATED record, so a group exit revokes
     // the request's grant immediately and host-side checks agree.
-    record = await users.setGroups(user, "proxy", groups);
+    record = await users.setGroups(record.user, "proxy", groups);
     return {
         user: record.user,
         ...(record.name === undefined ? {} : { name: record.name }),
@@ -332,6 +327,18 @@ export function resolveToken(request, ctx) {
 }
 /** The ONE request hook. Stages 1→5 in brief order; a stage replies or falls through. */
 export function registerAuthPipeline(app, ctx) {
+    // C5 boot warning: an explicitly listed own-host trust entry WITHOUT
+    // a shared secret is the one shape where a local process can still
+    // impersonate users by connecting directly. Surface it once per
+    // entry, at registration (a boot-time config warning, not a request
+    // diagnostic — the throttled warnProxyRejected does not apply).
+    const { proxy } = ctx.config.auth;
+    if (ctx.methods.includes("proxy") &&
+        !(proxy.secret !== undefined && proxy.secretHeader !== undefined)) {
+        for (const entry of listedOwnHostEntries(proxy.trustedProxies)) {
+            console.warn(`sigrun: trusting local address ${entry} without a shared secret lets any local process impersonate users; set server.auth.proxy.secretHeader`);
+        }
+    }
     app.addHook("onRequest", async (request, reply) => {
         // Stage 1: Host + Origin.
         const hostStatus = checkHost(request, ctx);
@@ -378,8 +385,17 @@ export function registerAuthPipeline(app, ctx) {
         // Stage 5/6: the configured methods, in order; the empty list is
         // the naive loopback path.
         if (ctx.methods.length === 0) {
+            const header = headerOf(request, "x-sigrun-user");
+            // The header is an unchecked (operator-typed) source: derive the
+            // canonical key on receipt, the same rule the CLI applies before
+            // sending. An unusable value is a loud 400, never a verbatim
+            // identity; an absent header keeps today's ownerless behavior.
+            const user = header === undefined ? undefined : deriveUsername(header);
+            if (header !== undefined && user === undefined) {
+                return await reply.code(400).send({ error: "invalid_username" });
+            }
             request.principal = {
-                user: headerOf(request, "x-sigrun-user"),
+                user,
                 admin: true,
                 service: false,
                 method: "none",

package/dist/server/auth/proxy-diagnostic.js

@@ -0,0 +1,60 @@
+/**
+ * The shared proxy-auth rejection diagnostic (proxy-trust C1), extracted
+ * from the request pipeline so the onboarding routes can report WHY they
+ * rejected a proxy identity with the same line and redaction contract.
+ *
+ * ONE `warn` per rejected request, naming the socket peer, the request
+ * method, a short reason, and — only when Fastify already resolved it —
+ * the ROUTE TEMPLATE (`routeOptions.url`, never the raw URL). The line
+ * must never carry API tokens, cookies, identity-header VALUES, query
+ * strings, or the full request URL; a header NAME appears only where the
+ * reason itself is "that configured header was absent/wrong" (its value
+ * never does). This is diagnostic logging, not evidence that the
+ * configured allowlist is correct.
+ *
+ * The throttle is per reason: one line per reason per 60 s, with a
+ * `(N suppressed)` suffix on the next emitted line for that reason —
+ * a flood of identical rejections cannot drown the log, and a DIFFERENT
+ * reason always emits immediately.
+ */
+/** One line per reason per this window; suppressed lines count up. */
+const THROTTLE_MS = 60_000;
+/** The reason vocabulary (byte-identical to the pipeline's originals). */
+export const ProxyRejectReason = {
+    UNTRUSTED: "untrusted proxy",
+    UNUSABLE: "unusable identity claim",
+    UNTRUSTED_IDENTITY_SOURCE: "untrusted identity source",
+    OWN_HOST: "own-host peer without shared secret",
+    secretReason: (header) => `missing or wrong shared secret (${header} header)`,
+    missingHeaderReason: (header) => `missing identity header (${header})`,
+};
+const throttle = new Map();
+let clock = () => Date.now();
+/** Test seam: inject the clock the throttle reads. */
+export function setProxyDiagnosticClock(now) {
+    clock = now;
+}
+/** Test seam: forget all throttle state (and restore the real clock). */
+export function resetProxyDiagnostic() {
+    throttle.clear();
+    clock = () => Date.now();
+}
+/**
+ * Emit one sanitized rejection line, throttled per reason. The line
+ * carries no values by construction: it is built from the method, the
+ * socket peer, the caller-supplied reason (a fixed string, or one naming
+ * a configured header), and the route template.
+ */
+export function warnProxyRejected(request, reason) {
+    const now = clock();
+    const entry = throttle.get(reason);
+    if (entry !== undefined && now - entry.lastEmit < THROTTLE_MS) {
+        entry.suppressed += 1;
+        return;
+    }
+    const suppressed = entry?.suppressed ?? 0;
+    throttle.set(reason, { lastEmit: now, suppressed: 0 });
+    const peer = request.socket.remoteAddress ?? "unknown";
+    const route = request.routeOptions.url;
+    console.warn(`sigrun: proxy auth rejected ${request.method} request from ${peer} (${reason})${route === undefined ? "" : ` on ${route}`}${suppressed > 0 ? ` (${suppressed} suppressed)` : ""}`);
+}

package/dist/server/auth/proxy-identity.js

@@ -0,0 +1,134 @@
+/**
+ * Proxy identity resolution (username-derivation D3): a trusted proxy
+ * header names an external subject, not necessarily a directory key.
+ * Folded subjects are linked to users; case variants of an existing key
+ * adopt it, and every other new identity gets a derived, suffixed key.
+ *
+ * The request pipeline owns trust and diagnostics. The claim route owns
+ * its lock; only the pipeline entry below acquires `withClaimLock`.
+ */
+import { deriveUsername, foldSubject, isUsernameKey, withSuffix, } from "@sigrun/shared/usernames";
+import { AccountLinkConflictError, } from "../../harness/identity/accounts.js";
+import { withClaimLock } from "./claim-lock.js";
+function identityParts(header) {
+    const subject = foldSubject(header);
+    const base = deriveUsername(header);
+    if (subject.length > 512 || base === undefined)
+        return undefined;
+    return { subject, base };
+}
+function linkedUser(deps, subject) {
+    const link = deps.accounts.lookup("proxy", subject);
+    return link === undefined ? undefined : deps.users.get(link.user);
+}
+function isAddConflict(error) {
+    return error instanceof Error && /^user ".*" already exists$/.test(error.message);
+}
+/** Lock-free resolution body; conflicts become a signal for the pipeline's retry. */
+async function provisionAttempt(deps, header, profile, opts) {
+    const parts = identityParts(header);
+    if (parts === undefined)
+        return { kind: "invalid" };
+    const linked = linkedUser(deps, parts.subject);
+    if (linked !== undefined)
+        return { kind: "user", record: linked };
+    if (isUsernameKey(parts.subject)) {
+        const existing = deps.users.get(parts.subject);
+        if (existing !== undefined) {
+            try {
+                await deps.accounts.link({
+                    provider: "proxy",
+                    subject: parts.subject,
+                    user: existing.user,
+                    via: "proxy",
+                });
+                return { kind: "user", record: existing };
+            }
+            catch (error) {
+                if (error instanceof AccountLinkConflictError)
+                    return { kind: "retry", error };
+                throw error;
+            }
+        }
+    }
+    if (!opts.provision)
+        return { kind: "not_provisioned" };
+    const key = withSuffix(parts.base, (candidate) => deps.users.get(candidate) !== undefined);
+    try {
+        const record = await deps.users.add({
+            user: key,
+            ...(profile.name === undefined ? {} : { name: profile.name }),
+            ...(profile.email === undefined ? {} : { email: profile.email }),
+            admin: opts.admin ?? false,
+            source: "proxy",
+        });
+        try {
+            await deps.accounts.link({
+                provider: "proxy",
+                subject: parts.subject,
+                user: record.user,
+                via: "proxy",
+            });
+            return { kind: "user", record };
+        }
+        catch (error) {
+            if (error instanceof AccountLinkConflictError) {
+                // Never leave the user created by this attempt attached to no
+                // identity when the link itself was refused.
+                await deps.users.remove(record.user);
+                return { kind: "retry", error };
+            }
+            throw error;
+        }
+    }
+    catch (error) {
+        if (isAddConflict(error))
+            return { kind: "retry", error: error };
+        throw error;
+    }
+}
+/** One lookup/lock pass. A retry is observed only AFTER the lock returns. */
+async function resolveOnce(deps, header, profile, opts) {
+    const parts = identityParts(header);
+    if (parts === undefined)
+        return { kind: "invalid" };
+    const linked = linkedUser(deps, parts.subject);
+    if (linked !== undefined)
+        return { kind: "user", record: linked };
+    return await withClaimLock(() => provisionAttempt(deps, header, profile, opts));
+}
+/** Pipeline entry: lookup outside the lock; on a miss, provision under it. */
+export async function resolveProxyUser(deps, header, profile, opts) {
+    const first = await resolveOnce(deps, header, profile, opts);
+    if (first.kind !== "retry")
+        return first;
+    // A second-process conflict retries resolution once, after the claim
+    // section has returned. A second conflict is a real failure, not a loop.
+    const second = await resolveOnce(deps, header, profile, opts);
+    if (second.kind === "retry")
+        throw second.error;
+    return second;
+}
+/** Lock-free body. Callers MUST already hold `withClaimLock`. */
+export async function provisionProxyUser(deps, header, profile, opts) {
+    const result = await provisionAttempt(deps, header, profile, opts);
+    if (result.kind === "retry")
+        throw result.error;
+    return result;
+}
+/** Read-only key computation for an already-vouched header. */
+export function previewProxyUser(deps, header) {
+    const parts = identityParts(header);
+    if (parts === undefined)
+        return undefined;
+    const linked = linkedUser(deps, parts.subject);
+    if (linked !== undefined)
+        return { user: linked.user, subject: header };
+    if (isUsernameKey(parts.subject) && deps.users.get(parts.subject) !== undefined) {
+        return { user: parts.subject, subject: header };
+    }
+    return {
+        user: withSuffix(parts.base, (candidate) => deps.users.get(candidate) !== undefined),
+        subject: header,
+    };
+}

package/dist/server/auth/proxy-only.js

@@ -0,0 +1,28 @@
+/**
+ * The C2 vouch rule for account-creating public paths (proxy-trust
+ * onboarding, spec Task 4): a proxy-only server bound beyond loopback
+ * admits accounts ONLY through a trusted proxy vouch. On such a boot
+ * every unvouched account-creating public path — the onboarding claim
+ * (setup-code and invite branches alike) and the login code-resume —
+ * refuses with 403 `proxy_identity_required`, and boot never mints or
+ * logs a setup code (it would be an unvouched account-creation path).
+ *
+ * The rule is deliberately about the CONFIGURED posture, not the
+ * request: the login code-resume has no proxy identity at all, so under
+ * `requiresProxyVouch` it always refuses. Mixed `[proxy, token]`
+ * deployments keep the setup-code/invite paths (token callers exist),
+ * and loopback binds keep them too (loopback is its own trust).
+ */
+import { isLoopbackHost } from "./loopback.js";
+/** Whether the configured auth methods are exactly proxy-only. */
+export function isProxyOnly(methods) {
+    return methods.includes("proxy") && !methods.includes("token");
+}
+/**
+ * Whether this boot requires a proxy vouch for account creation:
+ * proxy-only AND bound beyond loopback. The loopback test is the shared
+ * one (`127.0.0.0/8`, `::1`, `localhost`; `::ffff:127.*` unwrapped).
+ */
+export function requiresProxyVouch(methods, listenHost) {
+    return isProxyOnly(methods) && !isLoopbackHost(listenHost);
+}

package/dist/server/login/resolve.js

@@ -1,9 +1,85 @@
+import { deriveUsername, withSuffix } from "@sigrun/shared/usernames";
 import { AccountLinkConflictError, } from "../../harness/identity/accounts.js";
 import { AdmissionRefusedError, } from "../../harness/identity/users.js";
 import { setupCodeMatches } from "../../harness/identity/setup-code-check.js";
 import { hashToken } from "../../harness/identity/tokens.js";
 import { withClaimLock } from "../auth/claim-lock.js";
-import { assignUsername } from "./usernames.js";
+/** The first usable profile claim wins; the external subject remains exact. */
+export function loginUsernameCandidate(profile, subject) {
+    for (const candidate of [profile.username, profile.email, subject]) {
+        if (candidate === undefined)
+            continue;
+        const derived = deriveUsername(candidate);
+        if (derived !== undefined)
+            return derived;
+    }
+    return "user";
+}
+function isAddConflict(error) {
+    return error instanceof Error && /^user ".*" already exists$/.test(error.message);
+}
+function isLinkConflict(error) {
+    return error instanceof AccountLinkConflictError || (error instanceof Error && error.message.startsWith("account_link_conflict:"));
+}
+async function sessionForLinkedUser(input, deps) {
+    const existing = deps.accounts.lookup(input.provider, input.result.subject);
+    if (deps.users.get(existing.user) === undefined) {
+        return { kind: "refused", error: "not_allowed" };
+    }
+    await deps.users.setGroups(existing.user, input.provider, input.result.groups ?? []);
+    return { kind: "session", user: existing.user };
+}
+/** Lock-free provisioning body; add/link conflicts become retry signals. */
+async function provisionLogin(input, deps) {
+    if (deps.accounts.lookup(input.provider, input.result.subject) !== undefined) {
+        return sessionForLinkedUser(input, deps);
+    }
+    // Admission is checked before redemption so an M1 refusal burns no invite.
+    deps.users.checkAdmission();
+    const base = loginUsernameCandidate(input.result.profile, input.result.subject);
+    const autoProvision = deps.policy.autoProvision === true;
+    const user = autoProvision
+        ? withSuffix(base, (name) => deps.users.get(name) !== undefined)
+        : base;
+    if (!autoProvision && deps.users.get(user) !== undefined) {
+        return { kind: "refused", error: "not_allowed" };
+    }
+    const grant = autoProvision
+        ? { admin: false }
+        : await deps.invites.redeem(input.code, user);
+    if (grant === undefined)
+        return { kind: "refused", error: "not_allowed" };
+    try {
+        const record = await deps.users.add({
+            user,
+            ...profileFields(input.result.profile),
+            admin: grant.admin,
+            source: "login",
+        });
+        try {
+            await deps.accounts.link({
+                provider: input.provider,
+                subject: input.result.subject,
+                user,
+                via: "login",
+            });
+        }
+        catch (error) {
+            if (isLinkConflict(error)) {
+                await deps.users.remove(record.user);
+                return { kind: "retry", error: error };
+            }
+            throw error;
+        }
+        await deps.users.setGroups(user, input.provider, input.result.groups ?? []);
+        return { kind: "session", user: record.user };
+    }
+    catch (error) {
+        if (isAddConflict(error))
+            return { kind: "retry", error: error };
+        throw error;
+    }
+}
 function allowed(result, policy) {
     if (policy.allowedGroups !== undefined &&
         !policy.allowedGroups.some((group) => result.groups?.includes(group) === true))
@@ -42,13 +118,8 @@ export async function resolveLogin(input, deps) {
             return { kind: "linked", user: input.linkUser };
         }
         const existing = deps.accounts.lookup(provider, result.subject);
-        if (existing !== undefined) {
-            if (deps.users.get(existing.user) === undefined) {
-                return { kind: "refused", error: "not_allowed" };
-            }
-            await deps.users.setGroups(existing.user, provider, result.groups ?? []);
-            return { kind: "session", user: existing.user };
-        }
+        if (existing !== undefined)
+            return sessionForLinkedUser(input, deps);
         const setupResolution = await withClaimLock(async () => {
             const validSetupCode = input.code !== undefined && setupCodeMatches(input.code, deps.setupCode());
             if (deps.users.isClaimed()) {
@@ -69,7 +140,7 @@ export async function resolveLogin(input, deps) {
             if (!validSetupCode)
                 return { kind: "needs_code", reason: "setup" };
             const claim = deps.setupClaims.matches(provider, result.subject, input.code);
-            const user = claim?.user ?? assignUsername(result.profile, result.subject, (name) => deps.users.get(name) !== undefined);
+            const user = claim?.user ?? withSuffix(loginUsernameCandidate(result.profile, result.subject), (name) => deps.users.get(name) !== undefined);
             // Persist the recovery breadcrumb before creating the user. On a
             // retry, only this exact subject may finish the claim; if the user
             // write did not happen, it is retried under the recorded name.
@@ -99,23 +170,9 @@ export async function resolveLogin(input, deps) {
         if (deps.policy.autoProvision !== true && input.code === undefined) {
             return { kind: "needs_code", reason: "invite" };
         }
-        // Admission is checked before redemption so an M1 refusal burns no invite.
-        deps.users.checkAdmission();
-        const user = assignUsername(result.profile, result.subject, (name) => deps.users.get(name) !== undefined);
-        const grant = deps.policy.autoProvision === true
-            ? { admin: false }
-            : await deps.invites.redeem(input.code, user);
-        if (grant === undefined)
-            return { kind: "refused", error: "not_allowed" };
-        const record = await deps.users.add({
-            user,
-            ...profileFields(result.profile),
-            admin: grant.admin,
-            source: "login",
-        });
-        await deps.accounts.link({ provider, subject: result.subject, user, via: "login" });
-        await deps.users.setGroups(user, provider, result.groups ?? []);
-        return { kind: "session", user: record.user };
+        const provisioned = await withClaimLock(() => provisionLogin(input, deps));
+        if (provisioned.kind !== "retry")
+            return provisioned;
     }
     catch (error) {
         if (error instanceof AccountLinkConflictError || (error instanceof Error && error.message.startsWith("account_link_conflict:")))
@@ -130,4 +187,9 @@ export async function resolveLogin(input, deps) {
         }
         throw error;
     }
+    // Conflicts from another writer retry once, only after the section returns.
+    const second = await withClaimLock(() => provisionLogin(input, deps));
+    if (second.kind === "retry")
+        throw second.error;
+    return second;
 }