@takosjp/yurucommu-core 3.2.0 → 3.3.0

package/src/backend/lib/rtc/provider.ts

@@ -0,0 +1,135 @@
+/**
+ * RtcProvider — media-plane configuration for the call feature.
+ *
+ * This is the seam that keeps calling vendor-neutral: 1:1 calls are pure P2P
+ * WebRTC over the operator-configured STUN/TURN servers (no SFU, no Cloudflare),
+ * and group calls (Phase 3) select a WHIP/WHEP SFU "focus" whose backend is any
+ * of `whip` / `livekit` / `cloudflare-realtime` — Cloudflare Realtime is one
+ * adapter among equals, never required.
+ *
+ * TURN credentials, when coturn's REST scheme is configured, are minted
+ * per-request as short-lived HMAC creds (RFC 8489 long-term-credential via the
+ * `turn-rest` `timestamp:name` username convention) — no static long-lived
+ * secret is ever handed to a client.
+ */
+
+import type {
+  CallMediaKind,
+  IceServerConfig,
+  SfuFocus,
+} from "../../../../packages/api/src/types/call.ts";
+import type { EnvVars } from "../../types.ts";
+import { bufferToBase64 } from "../base64.ts";
+import { logger } from "../logger.ts";
+
+const log = logger.child({ component: "rtc.provider" });
+
+const DEFAULT_TURN_TTL_SECONDS = 3600;
+
+export interface RtcProvider {
+  /** ICE (STUN/TURN) servers for a call. Fresh (short-lived) TURN creds. */
+  getIceServers(): Promise<IceServerConfig[]>;
+  /** Group-call SFU focus, or null for pure P2P (always null for 1:1). */
+  getSfuFocus(media: CallMediaKind): Promise<SfuFocus | null>;
+}
+
+function parseStaticIceServers(raw: string | undefined): IceServerConfig[] {
+  if (!raw?.trim()) return [];
+  try {
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    const out: IceServerConfig[] = [];
+    for (const entry of parsed) {
+      if (!entry || typeof entry !== "object") continue;
+      const urls = (entry as { urls?: unknown }).urls;
+      if (typeof urls !== "string" && !Array.isArray(urls)) continue;
+      const server: IceServerConfig = { urls: urls as string | string[] };
+      const username = (entry as { username?: unknown }).username;
+      const credential = (entry as { credential?: unknown }).credential;
+      if (typeof username === "string") server.username = username;
+      if (typeof credential === "string") server.credential = credential;
+      out.push(server);
+    }
+    return out;
+  } catch (err) {
+    log.warn("Invalid YURUCOMMU_RTC_ICE_SERVERS JSON", { error: String(err) });
+    return [];
+  }
+}
+
+async function mintTurnCredential(
+  uris: string[],
+  secret: string,
+  ttlSeconds: number,
+): Promise<IceServerConfig | null> {
+  if (uris.length === 0 || !secret) return null;
+  // coturn REST: username = "<unix-expiry>:<name>", credential = base64(HMAC-
+  // SHA1(secret, username)). A random name keeps creds unlinkable per call.
+  const expiry = Math.floor(Date.now() / 1000) + ttlSeconds;
+  const username = `${expiry}:yurucommu`;
+  try {
+    const key = await crypto.subtle.importKey(
+      "raw",
+      new TextEncoder().encode(secret),
+      { name: "HMAC", hash: "SHA-1" },
+      false,
+      ["sign"],
+    );
+    const mac = await crypto.subtle.sign(
+      "HMAC",
+      key,
+      new TextEncoder().encode(username),
+    );
+    return { urls: uris, username, credential: bufferToBase64(mac) };
+  } catch (err) {
+    log.error("Failed to mint TURN credential", { error: String(err) });
+    return null;
+  }
+}
+
+class ConfiguredRtcProvider implements RtcProvider {
+  constructor(private readonly env: EnvVars) {}
+
+  async getIceServers(): Promise<IceServerConfig[]> {
+    const servers = parseStaticIceServers(this.env.YURUCOMMU_RTC_ICE_SERVERS);
+    const uris = (this.env.YURUCOMMU_RTC_TURN_URIS ?? "")
+      .split(",")
+      .map((s) => s.trim())
+      .filter(Boolean);
+    const secret = this.env.YURUCOMMU_RTC_TURN_SECRET?.trim();
+    if (uris.length > 0 && secret) {
+      const ttl =
+        Number.parseInt(this.env.YURUCOMMU_RTC_TURN_TTL ?? "", 10) ||
+        DEFAULT_TURN_TTL_SECONDS;
+      const turn = await mintTurnCredential(uris, secret, ttl);
+      if (turn) servers.push(turn);
+    }
+    return servers;
+  }
+
+  async getSfuFocus(_media: CallMediaKind): Promise<SfuFocus | null> {
+    const adapter = (this.env.YURUCOMMU_RTC_SFU_ADAPTER ?? "p2p")
+      .trim()
+      .toLowerCase();
+    if (adapter === "" || adapter === "p2p") return null;
+    const url = this.env.YURUCOMMU_RTC_SFU_URL?.trim();
+    if (!url) {
+      log.warn("SFU adapter selected but YURUCOMMU_RTC_SFU_URL unset", {
+        adapter,
+      });
+      return null;
+    }
+    // WHIP/WHEP focus passthrough. Real per-room token minting (LiveKit JWT,
+    // Cloudflare Realtime app tokens) lands with group calls (Phase 3); today
+    // the shared/static token (if any) is advertised as-is.
+    return {
+      kind: adapter,
+      url,
+      token: this.env.YURUCOMMU_RTC_SFU_TOKEN?.trim() || undefined,
+    };
+  }
+}
+
+export function createRtcProvider(env: EnvVars): RtcProvider {
+  return new ConfiguredRtcProvider(env);
+}

package/src/backend/lib/rtc/signal-transport.ts

@@ -0,0 +1,125 @@
+/**
+ * Cross-instance call signaling transport (server-to-server).
+ *
+ * Signaling for a call between two self-hosted instances travels as an
+ * HTTP-Signature-signed POST to the peer instance's `/ap/rtc/signal` endpoint.
+ * This deliberately does NOT use the queued federation delivery path
+ * (`enqueueDeliveryToActor`, with its circuit-breaker + retry/backoff): an SDP
+ * offer or ICE candidate is ephemeral and latency-sensitive, so a stale retry is
+ * useless. We reuse the same low-level signing (`signRequest`) + SSRF-guarded
+ * fetch (`fetchWithTimeout`) primitives the delivery worker uses, but send
+ * synchronously and directly. It also does NOT go through the inbox activity
+ * pipeline (`claimActivityForDispatch` / `parseActivity`), which would both strip
+ * the SDP/ICE fields and pollute the `activities` ledger with ephemeral frames.
+ */
+
+import { eq } from "drizzle-orm";
+import type { Database } from "../../../db/index.ts";
+import { actorCache } from "../../../db/index.ts";
+import type { RtcSignalEnvelopeV1 } from "../../../../packages/api/src/types/call.ts";
+import { signRequest } from "../ap-signing.ts";
+import { fetchWithTimeout } from "../federation-fetch.ts";
+import { fetchAndUpsertActorCache } from "../activitypub-actor-cache.ts";
+import { isSafeRemoteUrl } from "../ssrf.ts";
+import { logger } from "../logger.ts";
+
+const log = logger.child({ component: "rtc.signal-transport" });
+
+const SIGNAL_PATH = "/ap/rtc/signal";
+const SIGNAL_TIMEOUT_MS = 8000;
+
+export interface CallSigner {
+  apId: string;
+  privateKeyPem: string;
+}
+
+/** Derive a peer's signaling endpoint from a cached actor row. */
+function endpointFromActorRow(row: {
+  inbox: string;
+  rawJson: string;
+}): string | null {
+  // Prefer an explicitly advertised endpoint (actor `endpoints.rtcSignal`).
+  try {
+    const doc = JSON.parse(row.rawJson) as {
+      endpoints?: { rtcSignal?: unknown };
+    };
+    const advertised = doc.endpoints?.rtcSignal;
+    if (typeof advertised === "string" && isSafeRemoteUrl(advertised)) {
+      return advertised;
+    }
+  } catch {
+    // fall through to inbox-origin derivation
+  }
+  // Fall back to `<inbox-origin>/ap/rtc/signal` (every yurucommu instance
+  // serves this path). Peers that are not yurucommu simply won't answer.
+  try {
+    const origin = new URL(row.inbox).origin;
+    const endpoint = `${origin}${SIGNAL_PATH}`;
+    return isSafeRemoteUrl(endpoint) ? endpoint : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Resolve (and cache) the peer instance's signaling endpoint URL. */
+export async function resolvePeerSignalEndpoint(
+  db: Database,
+  peerApId: string,
+): Promise<string | null> {
+  let row = await db.query.actorCache.findFirst({
+    where: eq(actorCache.apId, peerApId),
+    columns: { inbox: true, rawJson: true },
+  });
+  if (!row) {
+    const result = await fetchAndUpsertActorCache(db, peerApId, {});
+    if (result.ok) {
+      row = { inbox: result.row.inbox, rawJson: result.row.rawJson };
+    }
+  }
+  if (!row) return null;
+  return endpointFromActorRow(row);
+}
+
+/**
+ * Sign + POST a signaling envelope to the peer instance. Throws on any
+ * unreachable / non-2xx outcome so the caller can fail the call fast.
+ */
+export async function sendCallSignal(
+  db: Database,
+  signer: CallSigner,
+  envelope: RtcSignalEnvelopeV1,
+  peerSignalEndpoint?: string,
+): Promise<void> {
+  const endpoint =
+    peerSignalEndpoint ?? (await resolvePeerSignalEndpoint(db, envelope.to));
+  if (!endpoint) {
+    throw new Error(`no signaling endpoint for ${envelope.to}`);
+  }
+  const body = JSON.stringify(envelope);
+  const keyId = `${signer.apId}#main-key`;
+  const signed = await signRequest(
+    signer.privateKeyPem,
+    keyId,
+    "POST",
+    endpoint,
+    body,
+  );
+  const res = await fetchWithTimeout(endpoint, {
+    method: "POST",
+    headers: {
+      ...signed,
+      "Content-Type": "application/activity+json",
+      Accept: "application/json",
+    },
+    body,
+    timeout: SIGNAL_TIMEOUT_MS,
+  });
+  if (!res.ok) {
+    log.warn("Signaling POST rejected", {
+      callId: envelope.callId,
+      type: envelope.type,
+      status: res.status,
+    });
+    throw new Error(`signal POST ${res.status}`);
+  }
+}

package/src/backend/lib/session-actor.ts

@@ -17,7 +17,7 @@ function isExpired(expiresAt: string): boolean {
 export async function extractActorFromSession(
   c: Context<{ Bindings: Env; Variables: Variables }>,
 ): Promise<void> {
-  const sessionId = getCookie(c, "session");
+  const sessionId = rawSessionCredential(c);
   if (!sessionId) return;
 
   const db = c.get("db");
@@ -59,3 +59,18 @@ export async function extractActorFromSession(
   };
   c.set("actor", actor);
 }
+
+/**
+ * Resolve the host-owned session credential used by browser and native clients.
+ * Cookie auth wins when both are present so adding an Authorization header to a
+ * browser request never changes its CSRF/session identity semantics.
+ */
+export function rawSessionCredential(
+  c: Context<{ Bindings: Env; Variables: Variables }>,
+): string | undefined {
+  const cookie = getCookie(c, "session")?.trim();
+  if (cookie) return cookie;
+  const authorization = c.req.header("Authorization")?.trim();
+  const match = authorization?.match(/^Bearer\s+([^\s]+)$/i);
+  return match?.[1];
+}

package/src/backend/lib/unread-counts.ts

@@ -0,0 +1,79 @@
+/**
+ * Shared Yurume unread totals.
+ *
+ * SINGLE owner of the DM + community-chat unread COUNT(*) SQL. It is consumed
+ * by BOTH:
+ *   - GET /api/dm/unread/count (the Messages nav badge), and
+ *   - the notification push payload's `counts.unread`
+ * so the app badge a push sets can never drift from the badge the client
+ * computes when it opens. A parity test pins this helper to the endpoint.
+ *
+ * - DM unread: direct Notes addressed TO the actor (via the object_recipients
+ *   `to` index), not authored by the actor, published after the actor's
+ *   per-conversation read time (epoch if never read), excluding archived
+ *   conversations.
+ * - Community unread: group-CHAT Notes (audience-linked, communityApId IS NULL
+ *   — NOT feed posts) in communities the actor belongs to, not the actor's
+ *   own, after the later of the per-community read time and the join time.
+ */
+
+import { sql } from "drizzle-orm";
+import type { Database } from "../../db/index.ts";
+
+export interface YurumeUnreadCounts {
+  readonly dm: number;
+  readonly community: number;
+  readonly total: number;
+}
+
+export async function yurumeUnreadCounts(
+  db: Database,
+  actorApId: string,
+): Promise<YurumeUnreadCounts> {
+  const dmRow = await db.get<{ c: number }>(sql`
+    SELECT COUNT(*) AS c
+    FROM objects o
+    JOIN object_recipients orp
+      ON orp.object_ap_id = o.ap_id
+      AND orp.recipient_ap_id = ${actorApId}
+      AND orp.type = 'to'
+    LEFT JOIN dm_read_status r
+      ON r.conversation_id = o.conversation
+      AND r.actor_ap_id = ${actorApId}
+    WHERE o.visibility = 'direct'
+      AND o.type = 'Note'
+      AND o.conversation IS NOT NULL
+      AND o.attributed_to != ${actorApId}
+      AND o.published > COALESCE(r.last_read_at, '1970-01-01T00:00:00Z')
+      AND o.conversation NOT IN (
+        SELECT conversation_id FROM dm_archived_conversations
+        WHERE actor_ap_id = ${actorApId}
+      )
+  `);
+
+  const communityRow = await db.get<{ c: number }>(sql`
+    SELECT COUNT(*) AS c
+    FROM community_members cm
+    JOIN object_recipients orp
+      ON orp.recipient_ap_id = cm.community_ap_id
+      AND orp.type = 'audience'
+    JOIN objects o
+      ON o.ap_id = orp.object_ap_id
+      AND o.type = 'Note'
+      AND o.community_ap_id IS NULL
+      AND o.attributed_to != ${actorApId}
+    LEFT JOIN dm_community_read_status r
+      ON r.community_ap_id = cm.community_ap_id
+      AND r.actor_ap_id = ${actorApId}
+    WHERE cm.actor_ap_id = ${actorApId}
+      AND o.published > COALESCE(
+        r.last_read_at,
+        cm.joined_at,
+        '1970-01-01T00:00:00Z'
+      )
+  `);
+
+  const dm = Number(dmRow?.c ?? 0);
+  const community = Number(communityRow?.c ?? 0);
+  return { dm, community, total: dm + community };
+}

package/src/backend/middleware/csrf.ts

@@ -69,6 +69,16 @@ function isBearerApiRequest(
   return !c.req.header("Cookie");
 }
 
+function isCookieLessNativeAuthRequest(
+  c: Context<{ Bindings: Env; Variables: Variables }>,
+) {
+  return (
+    !c.req.header("Cookie") &&
+    (c.req.path === "/api/auth/mobile/login" ||
+      c.req.path === "/api/auth/mobile/oidc")
+  );
+}
+
 /**
  * CSRF protection middleware.
  * Validates Origin/Referer for state-changing requests as defense-in-depth
@@ -82,6 +92,7 @@ export function csrfProtection() {
     if (!STATE_CHANGING_METHODS.has(c.req.method.toUpperCase())) return next();
     if (isActivityPubInbox(c.req.path)) return next();
     if (isBearerApiRequest(c)) return next();
+    if (isCookieLessNativeAuthRequest(c)) return next();
 
     const appUrl = c.env.APP_URL;
     const allowedOrigins = buildAllowedOrigins(c.env);

package/src/backend/public.ts

@@ -13,6 +13,9 @@ export { default } from "./index.ts";
 export { default as app } from "./index.ts";
 export { type Database, getDb, getDbSQLite } from "../db/index.ts";
 export { wrapCloudflareBindings } from "./runtime/cloudflare.ts";
+// Call feature: the signaling Durable Object class each product's generated
+// worker entry must re-export so Wrangler can bind CALL_SIGNALING to it.
+export { CallSignalingDurableObject } from "./runtime/call-signaling-do.ts";
 export type { Env, EnvVars } from "./types.ts";
 export type {
   DeliveryDlqMessageV1,

package/src/backend/routes/account-teardown.ts

@@ -19,6 +19,8 @@ import {
   mediaUploads,
   mutes,
   notificationArchived,
+  notificationPushers,
+  notificationPushJobs,
   nowIso,
   objectRecipients,
   objects,
@@ -244,6 +246,17 @@ export async function teardownActor(
     .delete(notificationArchived)
     .where(eq(notificationArchived.actorApId, apId));
 
+  // Notification push state (no FK cascade — these tables intentionally declare
+  // no actors FK; see migrations/0019). Remove the actor's registered pushers
+  // (their pushkey is an external push endpoint that must stop being woken) and
+  // any durable outbox rows keyed to the actor.
+  await db
+    .delete(notificationPushers)
+    .where(eq(notificationPushers.actorApId, apId));
+  await db
+    .delete(notificationPushJobs)
+    .where(eq(notificationPushJobs.actorApId, apId));
+
   // Media: hard-delete the actor's uploads + best-effort purge backing R2.
   await purgeActorMediaUploads(db, env.MEDIA, apId);
 

package/src/backend/routes/activitypub.ts

@@ -440,9 +440,13 @@ ap.get(
       following: showCollections ? actor.followingUrl : undefined,
       // Advertise sharedInbox so remote servers can deduplicate fan-out
       // delivery (Mastodon convention). The endpoint accepts signed
-      // activities just like the per-actor inbox.
+      // activities just like the per-actor inbox. `rtcSignal` advertises the
+      // call-signaling ingest so a caller's instance can reach this user
+      // directly (yurucommu extension; peers that don't recognize it just fall
+      // back to deriving it from the inbox origin).
       endpoints: {
         sharedInbox: `${baseUrl}/ap/inbox`,
+        rtcSignal: `${baseUrl}/ap/rtc/signal`,
       },
       publicKey: buildPublicKey(actor.apId, actor.publicKeyPem),
       discoverable: !actor.isPrivate,

package/src/backend/routes/auth-helpers.ts

@@ -139,6 +139,7 @@ export async function rotateSession(
   tokens: OAuthTokens | null,
   encryptionKey: string | undefined,
   rotationContext: string,
+  options: { setCookie?: boolean } = {},
 ): Promise<string> {
   const db = c.get("db");
 
@@ -184,13 +185,15 @@ export async function rotateSession(
   // served over plain http:// — a hardcoded Secure made an http self-host
   // un-loginnable (the browser never sends a Secure cookie over http), so honour
   // the operator's APP_URL protocol while defaulting to Secure for https/unknown.
-  setCookie(c, "session", sessionId, {
-    httpOnly: true,
-    secure: !(c.env.APP_URL ?? "").startsWith("http://"),
-    sameSite: "Strict",
-    path: "/",
-    maxAge: SESSION_MAX_AGE_SECONDS,
-  });
+  if (options.setCookie !== false) {
+    setCookie(c, "session", sessionId, {
+      httpOnly: true,
+      secure: !(c.env.APP_URL ?? "").startsWith("http://"),
+      sameSite: "Strict",
+      path: "/",
+      maxAge: SESSION_MAX_AGE_SECONDS,
+    });
+  }
 
   return sessionId;
 }

package/src/backend/routes/auth.ts

@@ -40,6 +40,7 @@ import {
   rotateSession,
 } from "./auth-helpers.ts";
 import { logger } from "../lib/logger.ts";
+import { rawSessionCredential } from "../lib/session-actor.ts";
 
 const log = logger.child({ component: "auth" });
 
@@ -62,6 +63,12 @@ const auth = new Hono<{ Bindings: Env; Variables: Variables }>();
 // abuse even from the legitimate owner session (#23).
 const MAX_SUB_ACCOUNTS = 20;
 
+function parsePassword(value: unknown): string | null {
+  // Passwords are opaque credentials. Trimming changes a valid secret and can
+  // make the native and browser login behavior diverge from the stored hash.
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+
 // 認証設定取得
 auth.get("/providers", async (c) => {
   const config = getAuthConfig(c.env);
@@ -75,12 +82,20 @@ auth.get("/providers", async (c) => {
   });
 });
 
+function mobileSessionResponse(sessionId: string) {
+  return {
+    access_token: sessionId,
+    token_type: "Bearer",
+    expires_in: 30 * 24 * 60 * 60,
+  };
+}
+
 // 現在のユーザー情報
 auth.get("/me", async (c) => {
   const actor = c.get("actor");
   if (!actor) return c.json({ error: "Not authenticated" }, 401);
 
-  const sessionId = getCookie(c, "session");
+  const sessionId = rawSessionCredential(c);
   let provider: string | null = null;
   let hasTakosAccess = false;
 
@@ -142,7 +157,7 @@ auth.post("/login", async (c) => {
     return c.json({ error: "Invalid request body", code: "BAD_REQUEST" }, 400);
   }
 
-  const password = parseNonEmptyString(body.password);
+  const password = parsePassword(body.password);
   if (!password) {
     return c.json({ error: "password is required", code: "BAD_REQUEST" }, 400);
   }
@@ -206,6 +221,119 @@ auth.post("/login", async (c) => {
   return c.json({ success: true });
 });
 
+// Native password authentication. The credential is a host-owned session,
+// not the password itself and not a browser cookie, so Tauri/native clients can
+// call the same API safely from any app origin.
+auth.post("/mobile/login", async (c) => {
+  const config = getAuthConfig(c.env);
+  if (!config.passwordEnabled) {
+    return c.json({ error: "Password auth not enabled" }, 400);
+  }
+
+  const clientIp = getClientIP(c);
+  const lockoutKey = `password:${clientIp}`;
+  const lockoutStatus = await getLoginLockoutStatus(c.env.KV, lockoutKey);
+  if (lockoutStatus.locked) {
+    c.header("Retry-After", String(lockoutStatus.retryAfterSeconds));
+    return c.json(lockoutErrorResponse(lockoutStatus.retryAfterSeconds), 429);
+  }
+
+  const body = await parseJsonObject(c);
+  const password = body ? parsePassword(body.password) : null;
+  if (!password) {
+    return c.json({ error: "password is required", code: "BAD_REQUEST" }, 400);
+  }
+  const isValid = c.env.AUTH_PASSWORD_HASH?.trim()
+    ? await verifyBootstrapOrPassword(password, c.env.AUTH_PASSWORD_HASH)
+    : false;
+  if (!isValid) {
+    const failedStatus = await recordFailedLoginAttempt(c.env.KV, lockoutKey);
+    if (failedStatus.locked) {
+      c.header("Retry-After", String(failedStatus.retryAfterSeconds));
+      return c.json(lockoutErrorResponse(failedStatus.retryAfterSeconds), 429);
+    }
+    return c.json({ error: "Invalid password" }, 401);
+  }
+
+  const db = c.get("db");
+  const actorData =
+    (await db
+      .select()
+      .from(actors)
+      .where(and(eq(actors.role, "owner"), notDeleted(actors)))
+      .get()) ??
+    (await createActor(db, c.env, {
+      username: "tako",
+      name: "tako",
+      takosUserId: "password:owner",
+      role: "owner",
+    }));
+  const sessionId = await rotateSession(
+    c,
+    actorData.apId,
+    null,
+    null,
+    c.env.ENCRYPTION_KEY,
+    "mobile password login rotation",
+    { setCookie: false },
+  );
+  await clearLoginLockout(c.env.KV, lockoutKey);
+  return c.json(mobileSessionResponse(sessionId));
+});
+
+// Exchange a verified native OIDC ID token for the same host-owned session
+// used by password login. This keeps product APIs independent from the
+// operator's token format and makes session revocation host-local.
+auth.post("/mobile/oidc", async (c) => {
+  const provider = getProvider(c.env, "takos");
+  if (!provider?.issuer || !provider.jwksUrl) {
+    return c.json({ error: "OIDC auth not enabled" }, 400);
+  }
+  const body = await parseJsonObject(c);
+  const idToken = body ? parseNonEmptyString(body.id_token) : undefined;
+  if (!idToken) {
+    return c.json({ error: "id_token is required", code: "BAD_REQUEST" }, 400);
+  }
+
+  try {
+    const { clientId } = getClientCredentials(c.env, "takos");
+    const claims = await verifyOidcIdToken(idToken, {
+      issuer: provider.issuer,
+      clientId,
+      jwksUrl: provider.jwksUrl,
+    });
+    const actorData = await findOrCreateOAuthActor(
+      c.get("db"),
+      c.env,
+      "takos",
+      {
+        id: claims.sub,
+        name:
+          claims.name ?? claims.preferred_username ?? claims.email ?? "user",
+        email: claims.email,
+        username: claims.preferred_username,
+      },
+    );
+    if (!actorData) return c.json({ error: "actor_creation_failed" }, 403);
+    const sessionId = await rotateSession(
+      c,
+      actorData.apId,
+      "takos",
+      null,
+      c.env.ENCRYPTION_KEY,
+      "mobile oidc login rotation",
+      { setCookie: false },
+    );
+    return c.json(mobileSessionResponse(sessionId));
+  } catch (error) {
+    log.warn("Mobile OIDC exchange failed", {
+      event: "auth.mobile.oidc_exchange_failed",
+      error,
+    });
+    return c.json({ error: "invalid_id_token" }, 401);
+  }
+});
+
 // OAuth: 認証開始
 auth.get("/login/:provider", async (c) => {
   const providerId = c.req.param("provider");
@@ -388,7 +516,7 @@ auth.get("/callback/:provider", async (c) => {
 
 // ログアウト
 auth.post("/logout", async (c) => {
-  const sessionId = getCookie(c, "session");
+  const sessionId = rawSessionCredential(c);
   if (sessionId) {
     await deleteSessionSafely(c.get("db"), c.env, sessionId, "logout");
     deleteCookie(c, "session");