@things-factory/auth-base 10.1.40 → 10.1.46

package/dist-server/utils/same-origin-redirect.d.ts

@@ -0,0 +1,4 @@
+export declare function sameOriginRedirectPath(redirectTo: unknown, context: {
+    host?: string;
+    headers?: any;
+}): string;

package/dist-server/utils/same-origin-redirect.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sameOriginRedirectPath = sameOriginRedirectPath;
+/**
+ * Where a sign-in or check-in may send the browser afterwards.
+ *
+ * `redirect_to` arrives in the query string, so anyone can write a link that passes through our
+ * login page and lands on a host of their choosing — the address bar shows our host until the
+ * last hop. Before this, `/auth/checkin?redirect_to=https://elsewhere` did exactly that: in
+ * fixed-domain mode `getRedirectSubdomainPath` hands the value back untouched, and otherwise
+ * `new URL(value, base)` keeps the value's own host.
+ *
+ * The answer here is always a path on this site. A value that resolves to another origin becomes
+ * `'/'` — the same place a missing value goes. An absolute URL on our own host is kept as its
+ * path, since the 401 redirect and older links may carry one.
+ *
+ * Leading slashes are collapsed to one: `/.//elsewhere` resolves to the path `//elsewhere`, which
+ * a browser reads as a host.
+ */
+const PROBE_ORIGIN = 'http://same-origin.invalid';
+function sameOriginRedirectPath(redirectTo, context) {
+    if (typeof redirectTo !== 'string' || !redirectTo.trim()) {
+        return '/';
+    }
+    let url;
+    try {
+        url = new URL(redirectTo, `${PROBE_ORIGIN}/`);
+    }
+    catch {
+        return '/';
+    }
+    const ownHosts = [context.host, context.headers?.['x-forwarded-host']].filter(Boolean);
+    const sameOrigin = url.origin === PROBE_ORIGIN || ((url.protocol === 'http:' || url.protocol === 'https:') && ownHosts.includes(url.host));
+    if (!sameOrigin) {
+        return '/';
+    }
+    return `${url.pathname.replace(/^\/+/, '/')}${url.search}${url.hash}`;
+}
+//# sourceMappingURL=same-origin-redirect.js.map

package/dist-server/utils/same-origin-redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"same-origin-redirect.js","sourceRoot":"","sources":["../../server/utils/same-origin-redirect.ts"],"names":[],"mappings":";;AAkBA,wDAqBC;AAvCD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,YAAY,GAAG,4BAA4B,CAAA;AAEjD,SAAgB,sBAAsB,CAAC,UAAmB,EAAE,OAAyC;IACnG,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,GAAG,YAAY,GAAG,CAAC,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACtF,MAAM,UAAU,GACd,GAAG,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAEzH,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;AACvE,CAAC","sourcesContent":["/**\n * Where a sign-in or check-in may send the browser afterwards.\n *\n * `redirect_to` arrives in the query string, so anyone can write a link that passes through our\n * login page and lands on a host of their choosing — the address bar shows our host until the\n * last hop. Before this, `/auth/checkin?redirect_to=https://elsewhere` did exactly that: in\n * fixed-domain mode `getRedirectSubdomainPath` hands the value back untouched, and otherwise\n * `new URL(value, base)` keeps the value's own host.\n *\n * The answer here is always a path on this site. A value that resolves to another origin becomes\n * `'/'` — the same place a missing value goes. An absolute URL on our own host is kept as its\n * path, since the 401 redirect and older links may carry one.\n *\n * Leading slashes are collapsed to one: `/.//elsewhere` resolves to the path `//elsewhere`, which\n * a browser reads as a host.\n */\nconst PROBE_ORIGIN = 'http://same-origin.invalid'\n\nexport function sameOriginRedirectPath(redirectTo: unknown, context: { host?: string; headers?: any }): string {\n  if (typeof redirectTo !== 'string' || !redirectTo.trim()) {\n    return '/'\n  }\n\n  let url: URL\n  try {\n    url = new URL(redirectTo, `${PROBE_ORIGIN}/`)\n  } catch {\n    return '/'\n  }\n\n  const ownHosts = [context.host, context.headers?.['x-forwarded-host']].filter(Boolean)\n  const sameOrigin =\n    url.origin === PROBE_ORIGIN || ((url.protocol === 'http:' || url.protocol === 'https:') && ownHosts.includes(url.host))\n\n  if (!sameOrigin) {\n    return '/'\n  }\n\n  return `${url.pathname.replace(/^\\/+/, '/')}${url.search}${url.hash}`\n}\n"]}

package/dist-server/utils/verification-token-rule.d.ts

@@ -0,0 +1,16 @@
+export declare const VERIFICATION_TOKEN_LIFETIME_MS: Readonly<Record<string, number>>;
+/** The value the table keeps for a token. */
+export declare function hashVerificationToken(token: string): string;
+/**
+ * When a token of this type, issued at `now`, stops working.
+ *
+ * Throws for a type with no lifetime here — a new kind of mailed link has to say how long it lives
+ * rather than inherit forever.
+ */
+export declare function verificationTokenExpiresAt(type: string, now?: Date): Date;
+/** The parts of a stored token this rule reads. */
+export type VerificationTokenRecord = {
+    expiresAt?: Date | string | null;
+} | null | undefined;
+/** May this token still be used, as of `now`? Absence of an expiry refuses; the expiry itself refuses. */
+export declare function isVerificationTokenLive(record: VerificationTokenRecord, now?: Date): boolean;

package/dist-server/utils/verification-token-rule.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VERIFICATION_TOKEN_LIFETIME_MS = void 0;
+exports.hashVerificationToken = hashVerificationToken;
+exports.verificationTokenExpiresAt = verificationTokenExpiresAt;
+exports.isVerificationTokenLive = isVerificationTokenLive;
+const crypto_1 = require("crypto");
+/**
+ * How long a mailed link lives, and what the table keeps of it. (Pure rule.)
+ *
+ * Password reset, unlock and sign-up confirmation each mail a link that carries a token, and the
+ * token is the whole credential: whoever holds the link resets the password or unlocks the account.
+ * Before 2026-09-24 those tokens never expired, were stored as written and were found by that same
+ * value — so a reset mail from last year still changed a password today, and a copy of the table
+ * (a backup, a replica, a dump handed to support) was a set of live reset links.
+ *
+ * ── The lifetimes ──────────────────────────────────────────────────────────
+ *
+ *   password-reset   1 hour    hands the account over at once, so short
+ *   unlock           1 hour    the same
+ *   activation       48 hours  the person may read the mail late; it only confirms an address
+ *
+ * Decided with the architect, 2026-09-24 (`docs/design/auth-rebuild-questions-2026-09-24.md` Q4).
+ *
+ * ── Expiry is its own column ───────────────────────────────────────────────
+ * Not derived from `createdAt` or `updatedAt`: `updatedAt` moves every time the row is saved again,
+ * and a rule that reads it would extend a link by touching the row. `expiresAt` is written once,
+ * with the token.
+ *
+ * A row without `expiresAt` reads as **expired** — the rule `invitation-state.ts` uses. Such rows
+ * were written before this existed, with the token in plain text; refusing them is also how links
+ * already sent stop working when this ships.
+ *
+ * ── What is stored is a hash ───────────────────────────────────────────────
+ * sha256 of the token. The token is 16 random bytes, so there is nothing for a slow hash to protect
+ * — it guards against guessing, and there is no guessing a random 128-bit value. The point is only
+ * that the table no longer holds anything a link can be made from.
+ */
+const HOUR = 60 * 60 * 1000;
+exports.VERIFICATION_TOKEN_LIFETIME_MS = Object.freeze({
+    'password-reset': 1 * HOUR,
+    unlock: 1 * HOUR,
+    activation: 48 * HOUR
+});
+/** The value the table keeps for a token. */
+function hashVerificationToken(token) {
+    return (0, crypto_1.createHash)('sha256').update(token, 'utf8').digest('hex');
+}
+/**
+ * When a token of this type, issued at `now`, stops working.
+ *
+ * Throws for a type with no lifetime here — a new kind of mailed link has to say how long it lives
+ * rather than inherit forever.
+ */
+function verificationTokenExpiresAt(type, now = new Date()) {
+    const lifetime = exports.VERIFICATION_TOKEN_LIFETIME_MS[type];
+    if (!lifetime) {
+        throw new Error(`verification token type '${type}' has no lifetime`);
+    }
+    return new Date(now.getTime() + lifetime);
+}
+/** May this token still be used, as of `now`? Absence of an expiry refuses; the expiry itself refuses. */
+function isVerificationTokenLive(record, now = new Date()) {
+    if (!record?.expiresAt) {
+        return false;
+    }
+    const at = record.expiresAt instanceof Date ? record.expiresAt : new Date(record.expiresAt);
+    if (Number.isNaN(at.getTime())) {
+        return false;
+    }
+    return now.getTime() < at.getTime();
+}
+//# sourceMappingURL=verification-token-rule.js.map

package/dist-server/utils/verification-token-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-token-rule.js","sourceRoot":"","sources":["../../server/utils/verification-token-rule.ts"],"names":[],"mappings":";;;AA2CA,sDAEC;AAQD,gEAQC;AAMD,0DAYC;AA/ED,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEd,QAAA,8BAA8B,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC5F,gBAAgB,EAAE,CAAC,GAAG,IAAI;IAC1B,MAAM,EAAE,CAAC,GAAG,IAAI;IAChB,UAAU,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAA;AAEF,6CAA6C;AAC7C,SAAgB,qBAAqB,CAAC,KAAa;IACjD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,IAAY,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7E,MAAM,QAAQ,GAAG,sCAA8B,CAAC,IAAI,CAAC,CAAA;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,mBAAmB,CAAC,CAAA;IACtE,CAAC;IAED,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAA;AAC3C,CAAC;AAKD,0GAA0G;AAC1G,SAAgB,uBAAuB,CAAC,MAA+B,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7F,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAE3F,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;AACrC,CAAC","sourcesContent":["import { createHash } from 'crypto'\n\n/**\n * How long a mailed link lives, and what the table keeps of it. (Pure rule.)\n *\n * Password reset, unlock and sign-up confirmation each mail a link that carries a token, and the\n * token is the whole credential: whoever holds the link resets the password or unlocks the account.\n * Before 2026-09-24 those tokens never expired, were stored as written and were found by that same\n * value — so a reset mail from last year still changed a password today, and a copy of the table\n * (a backup, a replica, a dump handed to support) was a set of live reset links.\n *\n * ── The lifetimes ──────────────────────────────────────────────────────────\n *\n *   password-reset   1 hour    hands the account over at once, so short\n *   unlock           1 hour    the same\n *   activation       48 hours  the person may read the mail late; it only confirms an address\n *\n * Decided with the architect, 2026-09-24 (`docs/design/auth-rebuild-questions-2026-09-24.md` Q4).\n *\n * ── Expiry is its own column ───────────────────────────────────────────────\n * Not derived from `createdAt` or `updatedAt`: `updatedAt` moves every time the row is saved again,\n * and a rule that reads it would extend a link by touching the row. `expiresAt` is written once,\n * with the token.\n *\n * A row without `expiresAt` reads as **expired** — the rule `invitation-state.ts` uses. Such rows\n * were written before this existed, with the token in plain text; refusing them is also how links\n * already sent stop working when this ships.\n *\n * ── What is stored is a hash ───────────────────────────────────────────────\n * sha256 of the token. The token is 16 random bytes, so there is nothing for a slow hash to protect\n * — it guards against guessing, and there is no guessing a random 128-bit value. The point is only\n * that the table no longer holds anything a link can be made from.\n */\n\nconst HOUR = 60 * 60 * 1000\n\nexport const VERIFICATION_TOKEN_LIFETIME_MS: Readonly<Record<string, number>> = Object.freeze({\n  'password-reset': 1 * HOUR,\n  unlock: 1 * HOUR,\n  activation: 48 * HOUR\n})\n\n/** The value the table keeps for a token. */\nexport function hashVerificationToken(token: string): string {\n  return createHash('sha256').update(token, 'utf8').digest('hex')\n}\n\n/**\n * When a token of this type, issued at `now`, stops working.\n *\n * Throws for a type with no lifetime here — a new kind of mailed link has to say how long it lives\n * rather than inherit forever.\n */\nexport function verificationTokenExpiresAt(type: string, now: Date = new Date()): Date {\n  const lifetime = VERIFICATION_TOKEN_LIFETIME_MS[type]\n\n  if (!lifetime) {\n    throw new Error(`verification token type '${type}' has no lifetime`)\n  }\n\n  return new Date(now.getTime() + lifetime)\n}\n\n/** The parts of a stored token this rule reads. */\nexport type VerificationTokenRecord = { expiresAt?: Date | string | null } | null | undefined\n\n/** May this token still be used, as of `now`? Absence of an expiry refuses; the expiry itself refuses. */\nexport function isVerificationTokenLive(record: VerificationTokenRecord, now: Date = new Date()): boolean {\n  if (!record?.expiresAt) {\n    return false\n  }\n\n  const at = record.expiresAt instanceof Date ? record.expiresAt : new Date(record.expiresAt)\n\n  if (Number.isNaN(at.getTime())) {\n    return false\n  }\n\n  return now.getTime() < at.getTime()\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.40",
+  "version": "10.1.46",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -34,9 +34,9 @@
     "@reduxjs/toolkit": "^2.2.5",
     "@simplewebauthn/browser": "^13.0.0",
     "@simplewebauthn/server": "^13.0.0",
-    "@things-factory/email-base": "^10.1.40",
+    "@things-factory/email-base": "^10.1.46",
     "@things-factory/env": "^10.1.20",
-    "@things-factory/shell": "^10.1.40",
+    "@things-factory/shell": "^10.1.46",
     "@things-factory/utils": "^10.1.20",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -48,5 +48,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "51c5d804c14ad8fcc6d4707e6ef80c9deede2766"
+  "gitHead": "d3467cde550453f3348fed0ed6c79a12a6ba0db4"
 }

package/tests/invitation-route.test.ts

@@ -71,27 +71,46 @@ describe('the invitation link', () => {
 
 describe('the other links sent by mail', () => {
   /*
-   * Same class, older links. Each controller builds its URL from a literal; every literal has to be
-   * a route this router answers. Read from the source because they are not exported — the point is
-   * that the link and the route are two spellings of one thing and nothing else ties them.
+   * Reset, unlock and sign-up confirmation moved to the invitation's shape on 2026-09-24 (Q4): one
+   * exported path, the token after `#`. Each page answers GET where the mail points and POST where
+   * the page sends the token.
    */
-  const CONTROLLERS = join(__dirname, '..', 'server', 'controllers')
-
-  const linked = readdirSync(CONTROLLERS)
-    .filter(file => file.endsWith('.ts'))
-    .flatMap(file =>
-      [...readFileSync(join(CONTROLLERS, file), 'utf-8').matchAll(/new URL\(`(\/auth\/[^`?$]*)/g)].map(m => ({
-        file,
-        path: m[1].replace(/\/$/, '/:token')
-      }))
-    )
+  const { RESET_PASSWORD_PATH } = loadCompiled('controllers/reset-password')
+  const { UNLOCK_USER_PATH } = loadCompiled('controllers/unlock-user')
+  const { VERIFY_EMAIL_PATH } = loadCompiled('controllers/verification')
+
+  const paths = [RESET_PASSWORD_PATH, UNLOCK_USER_PATH, VERIFY_EMAIL_PATH]
 
-  it('finds the links it means to check', () => {
-    /* A scan that matches nothing passes whatever the links say. */
-    expect(linked.map(l => l.file).sort()).toEqual(['reset-password.ts', 'unlock-user.ts', 'verification.ts'])
+  it('names the three it means to check', () => {
+    expect(paths).toEqual(['/auth/reset-password', '/auth/unlock-user', '/auth/verify'])
   })
 
-  it.each(linked.map(l => [l.file, l.path]))('%s → %s', (_file, path) => {
+  it.each(paths)('%s — the page answers where the mail points', path => {
     expect(answers('GET', path)).toBe(true)
   })
+
+  it.each(paths)('%s — and listens where the page posts', path => {
+    expect(answers('POST', path)).toBe(true)
+  })
+
+  it('no longer answers the old link that confirmed on opening', () => {
+    /* `GET /auth/verify/<token>` confirmed the address for whoever fetched it — a mail scanner too. */
+    expect(answers('GET', '/auth/verify/0123456789abcdef0123456789abcdef')).toBe(false)
+  })
+
+  it('no controller puts a token in a query string or a path', () => {
+    const CONTROLLERS = join(__dirname, '..', 'server', 'controllers')
+    const offending = readdirSync(CONTROLLERS)
+      .filter(file => file.endsWith('.ts'))
+      .filter(file => /\?token=\$\{|\/verify\/\$\{/.test(readFileSync(join(CONTROLLERS, file), 'utf-8')))
+
+    expect(offending).toEqual([])
+  })
+
+  it('nor does the redirect for a password that must be reset', () => {
+    const middleware = readFileSync(join(__dirname, '..', 'server', 'middlewares', 'jwt-authenticate-middleware.ts'), 'utf-8')
+
+    expect(middleware).toContain('context.redirect(`${RESET_PASSWORD_PATH}#${token}`)')
+    expect(middleware).not.toMatch(/\?token=/)
+  })
 })

package/tests/lock-recovery.test.ts

@@ -20,6 +20,7 @@ const { signin } = loadCompiled('controllers/signin')
 const { resetPassword } = loadCompiled('controllers/reset-password')
 const { unlockUser } = loadCompiled('controllers/unlock-user')
 const { VerificationToken, VerificationTokenType } = loadCompiled('service/verification-token/verification-token')
+const { saveVerificationToken } = loadCompiled('controllers/utils/save-verification-token')
 
 const OLD = 'Passw0rd!'
 const NEW = 'N3wPassw0rd!'
@@ -41,8 +42,9 @@ async function lockedUser() {
   })
 }
 
+/* Through the one writer, so the row carries its hash and expiry the way a mailed link's does. */
 async function giveToken(userId: string, token: string, type: string) {
-  await getRepository(VerificationToken).save({ userId, token, type })
+  await saveVerificationToken(userId, token, type)
 }
 
 /** `resetPassword` 가 컨텍스트에서 읽는 것만 담는다. */

package/tests/open-fields-framework.test.ts

@@ -0,0 +1,212 @@
+import { buildSchema, getMetadataStorage } from 'type-graphql'
+import { createPubSub } from '@graphql-yoga/subscription'
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'fs'
+import { join } from 'path'
+
+import { loadCompiled } from './compiled'
+
+const { privilegeDirectiveResolver } = loadCompiled('service/privilege/privilege-directive')
+const companion = loadCompiled('service/index').schema.resolverClasses
+
+/**
+ * Every things-factory module with resolvers says which of its fields are open (§8 step 1).
+ *
+ * ── Two modes ───────────────────────────────────────────────────────────────
+ * Normally this is the check. For each module that declares `schema.openFields`, the directive
+ * must accept it in boot mode — no field is open without being listed — and no name on its lists
+ * may be stale (a field that has since been given @privilege, or that no longer exists). A list
+ * that keeps names after they are closed stops telling anyone what is left.
+ *
+ * With `GENERATE_OPEN_FIELDS=<package>[,<package>…]` it writes that module's declaration from
+ * what its schema serves today: every undeclared root field goes under `notYetDeclared`, and the
+ * module's `server/service/index.ts` gains the one key. Behaviour does not change — everything
+ * that was open is listed. Sorting a field into `byDesign` with its reason, or closing it, is the
+ * work of step 2 and is done by hand.
+ *
+ * ── How a module is measured ────────────────────────────────────────────────
+ * The way the server builds it: the module's own `resolverClasses`, `buildSchema` with a pub/sub
+ * (modules with subscriptions do not build without one), and the privilege directive's record of
+ * what each field declares. A module with mutations and no query cannot build alone, so every
+ * build carries auth-base's resolvers beside it, and only the module's own fields — by the class
+ * that declared them, from type-graphql's metadata — are counted.
+ *
+ * ⚠ Reads `dist-server`. After editing a module, build it before this means anything.
+ */
+
+const PACKAGES = join(__dirname, '..', '..')
+
+/**
+ * The modules that have declared their lists. Named rather than counted, the way `screen-words` names
+ * the packages that owe words: a module that opts in is added here in the same commit, and the day
+ * every module with resolvers is on it, the "not yet" half of this file goes.
+ *
+ * 2026-09-24: auth-base only. The generator below writes the rest; running it for the framework is
+ * the next step of §8 step 1 and was held back from the 10.1.38 cut so it could be verified first.
+ */
+const OPTED_IN = ['auth-base']
+
+/** Modules that cannot be measured here, and why. Adding one needs its reason. */
+const CANNOT_MEASURE: Record<string, string> = {
+  calendar:
+    "its compiled entry throws on load when required on its own (`events` of `Attendee` has no inferable type). None of the four products loads it."
+}
+
+type Measured = { name: string; own: string[]; undeclared: string[]; schema: any }
+
+function modulesWithResolvers(): string[] {
+  return readdirSync(PACKAGES)
+    .filter(name => existsSync(join(PACKAGES, name, 'dist-server', 'service', 'index.js')))
+    .filter(name => {
+      const source = join(PACKAGES, name, 'server', 'service', 'index.ts')
+      return existsSync(source) && readFileSync(source, 'utf-8').includes('resolverClasses')
+    })
+    .sort()
+}
+
+async function measure(name: string): Promise<Measured> {
+  const schema = require(join(PACKAGES, name, 'dist-server', 'service', 'index.js')).schema
+  const classes = new Set<Function>(schema?.resolverClasses || [])
+
+  const storage = getMetadataStorage() as any
+  const own: string[] = []
+  for (const [typeName, bucket] of [
+    ['Query', 'queries'],
+    ['Mutation', 'mutations'],
+    ['Subscription', 'subscriptions']
+  ]) {
+    for (const field of storage[bucket] || []) {
+      if (classes.has(field.target)) own.push(`${typeName}.${field.schemaName}`)
+    }
+  }
+
+  process['PRIVILEGE_OF_FIELD'] = {}
+  const built = await buildSchema({
+    resolvers: (name === 'auth-base' ? [...classes] : [...companion, ...classes]) as any,
+    validate: false,
+    pubSub: createPubSub() as any
+  })
+  privilegeDirectiveResolver(built, { modules: [] })
+
+  const record = process['PRIVILEGE_OF_FIELD'] as Record<string, unknown>
+  const undeclared = own.filter(where => record[where] === null).sort()
+
+  return { name, own: own.sort(), undeclared, schema }
+}
+
+function declarationSource(name: string, undeclared: string[]): string {
+  return `/**
+ * ${name}'s root fields that carry no \`@privilege\` (auth-base \`docs/design/auth-rebuild.md\` §8).
+ *
+ * Written from what this module served on the day it opted in, so nothing that was open stopped
+ * working. Every name starts under \`notYetDeclared\`: nobody has yet decided what each one guards.
+ * Closing one means giving it \`@privilege(category: …, privilege: …)\` and taking it off this list.
+ * A field that is open on purpose moves to \`byDesign\`, with its reason.
+ *
+ * A new root field that is on neither list, and has no \`@privilege\`, stops the development server
+ * and is refused in production — see \`privilege/open-field-rule.ts\` in auth-base.
+ */
+export const openFields = {
+  byDesign: {} as Record<string, string>,
+  notYetDeclared: [
+${undeclared.map(where => `    '${where}'`).join(',\n')}${undeclared.length ? '\n' : ''}  ]
+}
+`
+}
+
+function optIn(name: string, undeclared: string[]) {
+  const dir = join(PACKAGES, name, 'server', 'service')
+  writeFileSync(join(dir, 'open-fields.ts'), declarationSource(name, undeclared))
+
+  const indexPath = join(dir, 'index.ts')
+  let index = readFileSync(indexPath, 'utf-8')
+
+  if (!index.includes("from './open-fields.js'")) {
+    /* After the last import line, so the module's own import order is left as it was. */
+    const lines = index.split('\n')
+    let last = -1
+    lines.forEach((line, i) => {
+      if (/^import .* from '.*'$/.test(line) || /^} from '.*'$/.test(line)) last = i
+    })
+    lines.splice(last + 1, 0, "import { openFields } from './open-fields.js'")
+    index = lines.join('\n')
+  }
+
+  if (!/export const schema = \{\n\s*openFields,/.test(index)) {
+    index = index.replace('export const schema = {', 'export const schema = {\n  openFields,')
+  }
+
+  writeFileSync(indexPath, index)
+}
+
+const GENERATE = (process.env.GENERATE_OPEN_FIELDS || '').split(',').map(s => s.trim()).filter(Boolean)
+
+if (GENERATE.length) {
+  it(`writes the declarations for ${GENERATE.join(', ')}`, async () => {
+    for (const name of GENERATE) {
+      const measured = await measure(name)
+      optIn(name, measured.undeclared)
+    }
+  }, 600000)
+} else {
+  const names = modulesWithResolvers().filter(name => !(name in CANNOT_MEASURE))
+
+  describe('every module with resolvers', () => {
+    it('finds the modules it means to check', () => {
+      /* A walk that finds nothing passes whatever the modules say. */
+      expect(names.length).toBeGreaterThan(50)
+      expect(names).toContain('auth-base')
+      expect(names).toContain('shell')
+    })
+
+    it('the modules that have opted in are exactly the ones named', async () => {
+      /*
+       * ⚠ Both directions. A module that declares lists without being named here is caught, and so is
+       * one named here that has lost its lists — either way the name list stops saying what is true.
+       */
+      const optedIn: string[] = []
+      for (const name of names) {
+        const schema = require(join(PACKAGES, name, 'dist-server', 'service', 'index.js')).schema
+        if (schema?.openFields) optedIn.push(name)
+      }
+
+      expect(optedIn.sort()).toEqual([...OPTED_IN].sort())
+    })
+
+    it.each(OPTED_IN)('%s says which of its fields are open', async name => {
+      const measured = await measure(name)
+
+      expect(measured.schema?.openFields).toBeTruthy()
+
+      /* The directive in boot mode is the check the development server runs. */
+      process['PRIVILEGE_OF_FIELD'] = {}
+      const built = await buildSchema({
+        resolvers: (name === 'auth-base'
+          ? measured.schema.resolverClasses
+          : [...companion, ...measured.schema.resolverClasses]) as any,
+        validate: false,
+        pubSub: createPubSub() as any
+      })
+
+      expect(() =>
+        privilegeDirectiveResolver(built, {
+          modules: [{ name, schema: measured.schema }],
+          mode: 'boot'
+        })
+      ).not.toThrow()
+
+      /* No stale names: every listed field is one this module serves and has not yet closed. */
+      const declaration = measured.schema.openFields
+      const listed = [...Object.keys(declaration.byDesign || {}), ...(declaration.notYetDeclared || [])]
+      const stale = listed.filter(where => !measured.undeclared.includes(where))
+
+      expect(stale).toEqual([])
+    }, 120000)
+  })
+
+  describe('what cannot be measured here', () => {
+    it.each(Object.entries(CANNOT_MEASURE))('%s — %s', name => {
+      /* Still listed as a module with resolvers — the day it can be measured, this fails and it moves. */
+      expect(modulesWithResolvers()).toContain(name)
+    })
+  })
+}

package/tests/open-redirect-db.test.ts

@@ -0,0 +1,143 @@
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+import { sameOriginRedirectPath } from '../server/utils/same-origin-redirect'
+
+const { Privilege } = loadCompiled('service/privilege/privilege')
+const { Role } = loadCompiled('service/role/role')
+const { User, UserStatus } = loadCompiled('service/user/user')
+const { authCheckinRouter } = loadCompiled('router/auth-checkin-router')
+
+/**
+ * `/auth/checkin?redirect_to=` must not send the browser to another host.
+ *
+ * Every sign-in ends there: the 401 redirect, the sign-in form and the WebAuthn sign-in all hand
+ * their `redirect_to` to the check-in page, and the check-in page is where `context.redirect` runs.
+ * So a link like `https://our-host/auth/checkin?redirect_to=https://elsewhere` used to show our
+ * login page and then land on `elsewhere` — the open redirect this file closes.
+ *
+ * The first half drives the real route with the value an attacker would write, because a test of
+ * the helper alone would stay green if the route stopped calling it. The second half pins the
+ * helper's reading of the shapes a browser treats as "another host".
+ *
+ * ⚠ Fixed-domain mode (`config.subdomain`) is read once when shell loads, so this suite runs the
+ * path-domain branch only. The helper runs before either branch, so both see the same value.
+ */
+
+const OUR_HOST = 'ex.test'
+
+let acme: any
+let person: any
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+
+  acme = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme' })
+  const seeing = await getRepository(Privilege).save({ name: 'query', category: 'board' })
+  const role = await getRepository(Role).save({ name: 'viewer', domain: { id: acme.id }, privileges: [seeing] })
+
+  const saved = await getRepository(User).save({
+    username: 'kim@acme.z',
+    email: 'kim@acme.z',
+    name: 'kim',
+    status: UserStatus.ACTIVATED,
+    domains: [{ id: acme.id }],
+    roles: [role]
+  })
+  person = await getRepository(User).findOne({ where: { id: saved.id }, relations: ['domains', 'roles'] })
+})
+
+/** Runs `GET /auth/checkin` the way a browser following a link would, and returns where it sent it. */
+async function checkinRedirectsTo(redirectTo: string): Promise<string> {
+  const layer = authCheckinRouter.stack.find((layer: any) => layer.path === '/auth/checkin/:subdomain?')
+  const redirect = jest.fn()
+  const render = jest.fn()
+
+  const context: any = {
+    method: 'GET',
+    host: OUR_HOST,
+    href: `http://${OUR_HOST}/auth/checkin`,
+    header: {},
+    headers: {},
+    request: { header: { accept: 'text/html' } },
+    req: { headers: {}, connection: { remoteAddress: '127.0.0.1' } },
+    t: (key: string) => key,
+    state: { user: person },
+    params: {},
+    query: { redirect_to: redirectTo },
+    redirect,
+    render
+  }
+
+  await layer.stack[layer.stack.length - 1](context, async () => {})
+
+  expect(render).not.toHaveBeenCalled()
+  expect(redirect).toHaveBeenCalledTimes(1)
+  return redirect.mock.calls[0][0]
+}
+
+describe('GET /auth/checkin with a single domain', () => {
+  it('still goes where it was asked, on this host', async () => {
+    const target = new URL(await checkinRedirectsTo('/domain/acme/board-list?x=1'))
+
+    expect(target.host).toBe(OUR_HOST)
+    expect(target.pathname + target.search).toBe('/domain/acme/board-list?x=1')
+  })
+
+  it.each([
+    'https://evil.example/steal',
+    '//evil.example/steal',
+    '/\\evil.example/steal',
+    'https:evil.example',
+    '\t//evil.example'
+  ])('does not leave this host for %j', async redirectTo => {
+    const target = new URL(await checkinRedirectsTo(redirectTo))
+
+    expect(target.host).toBe(OUR_HOST)
+  })
+})
+
+describe('sameOriginRedirectPath', () => {
+  const context = { host: OUR_HOST, headers: {} }
+
+  it.each([
+    ['/domain/acme/x?y=1#z', '/domain/acme/x?y=1#z'],
+    [`http://${OUR_HOST}/domain/acme/x`, '/domain/acme/x'],
+    ['board-list', '/board-list']
+  ])('keeps %j on this site as %j', (value, path) => {
+    expect(sameOriginRedirectPath(value, context)).toBe(path)
+  })
+
+  it('keeps an absolute URL on the host the proxy says we are', () => {
+    expect(sameOriginRedirectPath('https://public.example/x', { host: 'internal:3000', headers: { 'x-forwarded-host': 'public.example' } })).toBe('/x')
+  })
+
+  it.each([
+    'https://evil.example/x',
+    '//evil.example/x',
+    '/\\evil.example/x',
+    'https:evil.example/x',
+    '\t//evil.example/x',
+    '/\t/evil.example/x',
+    'javascript:alert(1)',
+    `ftp://${OUR_HOST}/x`
+  ])('sends %j home', value => {
+    expect(sameOriginRedirectPath(value, context)).toBe('/')
+  })
+
+  it('does not return a path a browser reads as a host', () => {
+    /* `/.//evil.example` resolves on our origin to the path `//evil.example`. */
+    expect(sameOriginRedirectPath('/.//evil.example', context)).toBe('/evil.example')
+  })
+
+  it.each([undefined, '', '   ', ['/a', '/b']])('sends %j home', value => {
+    expect(sameOriginRedirectPath(value, context)).toBe('/')
+  })
+})