cartethyia 2.7.4 → 2.7.6

package/src/console/api-keys/contracts.ts

@@ -8,11 +8,12 @@ import { randomBytes } from "node:crypto";
 import type { ApiKeyRecord, ApiKeyStore } from "../../persistence/stores/api-key-store";
 import { hashSecret } from "../../security/crypto";
 import { type ShareLinkStore, type ShareLinkSummary } from "../../persistence/stores/share-store";
-import { API_KEY_MODES, type ApiKeyMode, type ApiKeyModelAccessMode, type ShareLinkKind } from "../../persistence/schema";
+import { API_KEY_MODES, API_KEY_CONCURRENCY_SCOPES, type ApiKeyMode, type ApiKeyModelAccessMode, type ShareLinkKind } from "../../persistence/schema";
 import { isValidTenantKeyScope, type AccessScope } from "../../security/access-control";
 import { normalizeClientRouterId } from "../../security/client-router-fingerprint";
 import type { ShareActivityPort } from "../share/share-usage";
 import { ConsoleDomainError } from "../shared/errors";
+import { pickDefined } from "../shared/object";
 import type { ConsoleAccessResolver } from "../auth/access";
 import type { ApiKeyAdmissionService } from "../../security/admission/service";
 import {
@@ -34,6 +35,9 @@ export type {
   SharedKeySummary,
   SharedKeyActivityDetail,
 } from "../share/share-usage";
+/** How a share template's concurrency cap applies to its recipients. */
+export type ConcurrencyScope = (typeof API_KEY_CONCURRENCY_SCOPES)[number];
+
 /** Input accepted when creating or editing a key. Null limits mean unlimited. */
 export interface CreateApiKeyRequest {
   enabled?: boolean;
@@ -49,6 +53,13 @@ export interface CreateApiKeyRequest {
   monthlyTokenLimit?: number | null;
   lifetimeTokenBudget?: number | null;
   maxConcurrentRequests?: number | null;
+  /**
+   * How `maxConcurrentRequests` applies to a share template's family:
+   * `family` (default) = one cap across all recipient keys (a single shared
+   * admission counter); `per_key` = each recipient key gets its own cap and
+   * independent counter. Ignored/meaningless for personal keys.
+   */
+  concurrencyScope?: ConcurrencyScope;
   /** Share-template slot cap; only meaningful when keyMode === "share". */
   maxChildren?: number | null;
   modelPrefix?: string;
@@ -90,6 +101,7 @@ export interface ApiKeyResponse {
   readonly modelList?: readonly string[];
   readonly clientRouterDenylist?: readonly string[];
   readonly maxConcurrentRequests?: number;
+  readonly concurrencyScope?: ConcurrencyScope;
   readonly maxChildren?: number;
   readonly notesTitle?: string;
   readonly notesSubtitle?: string;
@@ -119,34 +131,16 @@ export interface UpdateApiKeyResponse extends ApiKeyResponse {
 }
 
 /**
- * Ban reasons offered by the console dropdown. The first two are the operator's
- * own: "Instant Ban — Suka suka Gw" for the arbitrary ban, and a template for
- * suspicious traffic. The rest are generic, and an operator can still type a
- * custom reason — the dropdown is a convenience, not a closed set.
- */
-export const API_KEY_BAN_REASONS: readonly { readonly value: string; readonly label: string }[] = [
-  { value: "instant_arbitrary", label: "Instant Ban — Suka suka Gw" },
-  { value: "traffic_suspicious", label: "Your traffic looks suspicious" },
-  { value: "abuse", label: "Abuse of the gateway" },
-  { value: "policy_violation", label: "Policy violation" },
-  { value: "compromised", label: "Key may be compromised" },
-  { value: "quota_exceeded", label: "Quota abused" },
-  { value: "other", label: "Other / custom" },
-] as const;
-
-/**
- * Ban durations the console offers, in whole minutes. `null` is permanent.
- * Mirrored by the dashboard (`dashboard/src/lib/ban-durations.ts`) so the UI
- * and the API agree on one list.
+ * Ban reasons offered by the console dropdown, and the durations the ban
+ * endpoint accepts. These are pure lists, kept in `ban-constants.ts` (no
+ * `node:*` imports) so the dashboard can import them without dragging Node
+ * crypto into the browser bundle. Re-exported here for backend consumers
+ * (`routes.ts` validates against `BAN_DURATION_CHOICES`).
  */
-export const BAN_DURATION_CHOICES: readonly { readonly minutes: number | null; readonly label: string }[] = [
-  { minutes: 60, label: "1 hour" },
-  { minutes: 6 * 60, label: "6 hours" },
-  { minutes: 12 * 60, label: "12 hours" },
-  { minutes: 24 * 60, label: "1 day" },
-  { minutes: 7 * 24 * 60, label: "7 days" },
-  { minutes: null, label: "Permanent" },
-];
+export {
+  API_KEY_BAN_REASONS,
+  BAN_DURATION_CHOICES,
+} from "./ban-constants";
 
 /** What a bare "ban this key" click uses: the shortest, most reversible choice. */
 export const DEFAULT_BAN_MINUTES: number = 60;
@@ -154,7 +148,6 @@ export const DEFAULT_BAN_MINUTES: number = 60;
 /** Body accepted by the ban endpoint. */
 export interface BanApiKeyRequest {
   readonly reason: string;
-  readonly reasonLabel?: string;
   /**
    * Ban duration in whole minutes from {@link BAN_DURATION_CHOICES}; `null`
    * means permanent. Absent = {@link DEFAULT_BAN_MINUTES}.
@@ -255,16 +248,20 @@ export function generateApiKeySecret(prefix = DEFAULT_API_KEY_PREFIX): {
   return { secret, hash: hashSecret(secret), prefix };
 }
 
-/** Normalizes a caller-supplied prefix; falls back to the default. */
-export function resolveKeyPrefix(raw: string | undefined): string {
+/** Normalizes a caller-supplied prefix; falls back to `fallback`. */
+function resolvePrefix(raw: string | undefined, fallback: string): string {
   const trimmed = raw?.trim();
-  return trimmed && trimmed.length > 0 ? trimmed : DEFAULT_API_KEY_PREFIX;
+  return trimmed && trimmed.length > 0 ? trimmed : fallback;
 }
 
-/** Resolves the share-key prefix; falls back to the default. */
+/** Normalizes a caller-supplied prefix; falls back to the personal default. */
+export function resolveKeyPrefix(raw: string | undefined): string {
+  return resolvePrefix(raw, DEFAULT_API_KEY_PREFIX);
+}
+
+/** Resolves the share-key prefix; falls back to the share default. */
 export function resolveShareKeyPrefix(raw: string | undefined): string {
-  const trimmed = raw?.trim();
-  return !trimmed ? DEFAULT_SHARE_API_KEY_PREFIX : trimmed;
+  return resolvePrefix(raw, DEFAULT_SHARE_API_KEY_PREFIX);
 }
 
 /** Maximum hint the enroll page accepts; the dashboard caps its input there. */
@@ -349,6 +346,19 @@ export function validateApiKeyRequest(request: CreateApiKeyRequest): readonly Ac
   finitePositive(request.monthlyTokenLimit, "monthlyTokenLimit");
   finitePositive(request.lifetimeTokenBudget, "lifetimeTokenBudget");
   finitePositive(request.maxConcurrentRequests, "maxConcurrentRequests");
+  if (
+    request.concurrencyScope !== undefined &&
+    !(API_KEY_CONCURRENCY_SCOPES as readonly string[]).includes(request.concurrencyScope)
+  ) {
+    throw new ConsoleDomainError("invalid_limits", 400, "concurrencyScope must be family or per_key");
+  }
+  if (request.concurrencyScope !== undefined && keyMode !== "share") {
+    throw new ConsoleDomainError(
+      "invalid_limits",
+      400,
+      "concurrencyScope is only valid for share templates",
+    );
+  }
   if (request.maxChildren !== undefined && request.maxChildren !== null) {
     finitePositive(request.maxChildren, "maxChildren");
     if (request.maxChildren > 10_000) {
@@ -424,34 +434,33 @@ export function sanitizeApiKeyResponse(record: ApiKeyRecord): ApiKeyResponse {
      * renaming the key cannot change which key is the default.
      */
     isDefault: isDefaultGatewayApiKey(record),
-    ...(keyPrefix === undefined ? {} : { keyPrefix }),
-    ...(record.parentKeyId === undefined ? {} : { parentKeyId: record.parentKeyId }),
-    ...(record.notesTitle === undefined ? {} : { notesTitle: record.notesTitle }),
-    ...(record.notesSubtitle === undefined ? {} : { notesSubtitle: record.notesSubtitle }),
-    ...(record.notesBody === undefined ? {} : { notesBody: record.notesBody }),
-    ...(record.sharePopupEnabled === undefined ? {} : { sharePopupEnabled: record.sharePopupEnabled }),
-    ...(record.sharePopupImageMime === undefined
-      ? {}
-      : { sharePopupImageMime: record.sharePopupImageMime }),
-    ...(record.sharePopupTitle === undefined ? {} : { sharePopupTitle: record.sharePopupTitle }),
-    ...(record.sharePopupBody === undefined ? {} : { sharePopupBody: record.sharePopupBody }),
-    ...(record.requestsPerMinute === undefined ? {} : { requestsPerMinute: record.requestsPerMinute }),
-    ...(record.dailyTokenLimit === undefined ? {} : { dailyTokenLimit: record.dailyTokenLimit }),
-    ...(record.monthlyTokenLimit === undefined ? {} : { monthlyTokenLimit: record.monthlyTokenLimit }),
-    ...(record.lifetimeTokenBudget === undefined ? {} : { lifetimeTokenBudget: record.lifetimeTokenBudget }),
-    ...(record.maxConcurrentRequests === undefined ? {} : { maxConcurrentRequests: record.maxConcurrentRequests }),
-    ...(record.maxChildren === undefined ? {} : { maxChildren: record.maxChildren }),
-    ...(record.modelPrefix === undefined ? {} : { modelPrefix: record.modelPrefix }),
-    ...(record.modelAccessMode === undefined ? {} : { modelAccessMode: record.modelAccessMode }),
-    ...(record.modelList === undefined ? {} : { modelList: record.modelList }),
-    ...(record.clientRouterDenylist === undefined
-      ? {}
-      : { clientRouterDenylist: record.clientRouterDenylist }),
+    ...pickDefined({
+      keyPrefix,
+      parentKeyId: record.parentKeyId,
+      notesTitle: record.notesTitle,
+      notesSubtitle: record.notesSubtitle,
+      notesBody: record.notesBody,
+      sharePopupEnabled: record.sharePopupEnabled,
+      sharePopupImageMime: record.sharePopupImageMime,
+      sharePopupTitle: record.sharePopupTitle,
+      sharePopupBody: record.sharePopupBody,
+      requestsPerMinute: record.requestsPerMinute,
+      dailyTokenLimit: record.dailyTokenLimit,
+      monthlyTokenLimit: record.monthlyTokenLimit,
+      lifetimeTokenBudget: record.lifetimeTokenBudget,
+      maxConcurrentRequests: record.maxConcurrentRequests,
+      concurrencyScope: record.concurrencyScope,
+      maxChildren: record.maxChildren,
+      modelPrefix: record.modelPrefix,
+      modelAccessMode: record.modelAccessMode,
+      modelList: record.modelList,
+      clientRouterDenylist: record.clientRouterDenylist,
+      revokedAt: record.revokedAt?.toISOString(),
+      bannedAt: record.bannedAt?.toISOString(),
+      banReason: record.banReason,
+      bannedUntil: record.bannedUntil?.toISOString(),
+    }),
     createdAt: record.createdAt.toISOString(),
-    ...(record.revokedAt === undefined ? {} : { revokedAt: record.revokedAt.toISOString() }),
-    ...(record.bannedAt === undefined ? {} : { bannedAt: record.bannedAt.toISOString() }),
-    ...(record.banReason === undefined ? {} : { banReason: record.banReason }),
-    ...(record.bannedUntil === undefined ? {} : { bannedUntil: record.bannedUntil.toISOString() }),
     tokensConsumed: record.tokensConsumed,
   };
 }

package/src/console/api-keys/routes.ts

@@ -11,7 +11,7 @@ import { generateShareSlug, hashShareToken } from "../../persistence/stores/shar
 import type { AccessDecision } from "../../security/access-control";
 import { ConsoleDomainError, errorResponse, requireTenantScope } from "../shared/errors";
 import { literalUnion } from "../shared/elysia-schema";
-import { API_KEY_MODES, API_KEY_MODEL_ACCESS_MODES, type ShareLinkKind } from "../../persistence/schema";
+import { API_KEY_MODES, API_KEY_MODEL_ACCESS_MODES, API_KEY_CONCURRENCY_SCOPES, type ShareLinkKind } from "../../persistence/schema";
 import type { ApiKeyConfig, ApiKeyResponse, BanApiKeyRequest, UpdateApiKeyResponse } from "./contracts";
 import type {
   ApiKeyPatch,
@@ -20,6 +20,7 @@ import type {
   SharedChildrenPageOptions,
 } from "../../persistence/stores/api-key-store";
 import {
+  API_KEY_BAN_REASONS,
   BAN_DURATION_CHOICES,
   DEFAULT_BAN_MINUTES,
   generateApiKeySecret,
@@ -50,6 +51,9 @@ const SHARED_CHILD_SORT_COLUMNS = new Set<SharedChildSortColumn>([
   "enabled",
 ]);
 
+/** The offered ban durations as a set of minute values, hoisted once. */
+const BAN_DURATION_MINUTES = new Set(BAN_DURATION_CHOICES.map((choice) => choice.minutes));
+
 /** Parses and bounds the paginated share-child list query. */
 function parseSharedChildrenQuery(query: URLSearchParams): SharedChildrenPageOptions {
   const limitRaw = query.get("limit");
@@ -82,24 +86,23 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         const topLevel = records.filter(
           (record) => record.revokedAt === undefined && record.parentKeyId === undefined,
         );
-        // A share template's own counter never moves for child traffic, so
-        // reporting it raw would show a template as untouched while the gateway
-        // is refusing its recipients on the parent budget. Report the figure
-        // the gateway actually enforces: the template's counter plus every
-        // telemetry total the family ever recorded — revoked/deleted children
-        // included (their spend is already spent), so the number survives
-        // cleanup and matches the share page.
+        // A share template's own counter is the live family accumulator now:
+        // every recipient commit adds to it (see ApiKeyAdmissionService
+        // commitUsage), so reporting it raw gives the enforced family total.
+        // No telemetry add-on is needed, and adding it here would double-count.
         return Promise.all(
           topLevel.map(async (record) => {
             const response = sanitizeApiKeyResponse(record);
             if (record.keyMode !== "share") return response;
-            const family = await config.store
-              .sumFamilyTelemetryConsumed(authorized.tenantId, record.id)
-              .catch(() => 0);
-            return { ...response, tokensConsumed: response.tokensConsumed + family };
+            return response;
           }),
-        );
-      },
+      );
+    },
+    async listActiveBannedKeys(access: AccessDecision | undefined): Promise<ApiKeyResponse[]> {
+      const authorized = requireTenantScope(access, "dashboard:read");
+      const records = await config.store.listActiveBanned(authorized.tenantId);
+      return records.map(sanitizeApiKeyResponse);
+    },
     /** Persists a new credential order. `keyIds` must name every top-level key
         the tenant has, so a partial list cannot silently renumber rows. */
     async reorderKeys(access: AccessDecision | undefined, keyIds: readonly string[]): Promise<void> {
@@ -187,6 +190,7 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         ...(request.monthlyTokenLimit == null ? {} : { monthlyTokenLimit: request.monthlyTokenLimit }),
         ...(request.lifetimeTokenBudget == null ? {} : { lifetimeTokenBudget: request.lifetimeTokenBudget }),
         ...(request.maxConcurrentRequests == null ? {} : { maxConcurrentRequests: request.maxConcurrentRequests }),
+        ...(request.concurrencyScope !== undefined ? { concurrencyScope: request.concurrencyScope } : {}),
         ...(request.maxChildren == null ? {} : { maxChildren: request.maxChildren }),
         ...(request.modelPrefix === undefined ? {} : { modelPrefix: request.modelPrefix }),
         modelAccessMode: request.modelAccessMode ?? "whitelist",
@@ -322,6 +326,7 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         ...(patchRequest.monthlyTokenLimit === undefined ? {} : { monthlyTokenLimit: patchRequest.monthlyTokenLimit }),
         ...(patchRequest.lifetimeTokenBudget === undefined ? {} : { lifetimeTokenBudget: patchRequest.lifetimeTokenBudget }),
         ...(patchRequest.maxConcurrentRequests === undefined ? {} : { maxConcurrentRequests: patchRequest.maxConcurrentRequests }),
+        ...(patchRequest.concurrencyScope !== undefined ? { concurrencyScope: patchRequest.concurrencyScope } : {}),
         ...(patchRequest.maxChildren === undefined ? {} : { maxChildren: patchRequest.maxChildren }),
         ...(patchRequest.modelPrefix === undefined ? {} : { modelPrefix: patchRequest.modelPrefix }),
         ...(patchRequest.modelAccessMode === undefined ? {} : { modelAccessMode: patchRequest.modelAccessMode }),
@@ -791,8 +796,7 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
       // clamping would answer a request for 90 days with a week and report
       // success.
       const chosenMinutes = request.minutes === undefined ? DEFAULT_BAN_MINUTES : request.minutes;
-      const allowed = new Set(BAN_DURATION_CHOICES.map((choice) => choice.minutes));
-      if (!allowed.has(chosenMinutes)) {
+      if (!BAN_DURATION_MINUTES.has(chosenMinutes)) {
         throw new ConsoleDomainError(
           "invalid_request",
           400,
@@ -814,11 +818,27 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         access: authorized,
         action: "api_key.banned",
         target: keyId,
-        detail: { reason, ...(bannedUntil === null ? { permanent: true } : { bannedUntil: bannedUntil.toISOString() }) },
+        detail: {
+          reason,
+          // The human-readable label is derived server-side from the machine
+          // `reason`, so the audit trail cannot be skewed by a client-authored
+          // label. Unknown reasons (custom text) simply carry no label; the
+          // free-text `reason` above is still recorded verbatim.
+          ...(API_KEY_BAN_REASONS.find((r) => r.value === reason)?.label === undefined
+            ? {}
+            : { reasonLabel: API_KEY_BAN_REASONS.find((r) => r.value === reason)!.label }),
+          ...(bannedUntil === null ? { permanent: true } : { bannedUntil: bannedUntil.toISOString() }),
+        },
+      });
+      // The ban mutates the row already fetched; derive the response from that
+      // record instead of re-fetching after the write. Match the store's own
+      // mapping: a `null` (permanent) `bannedUntil` is omitted, not carried.
+      return sanitizeApiKeyResponse({
+        ...current,
+        bannedAt: new Date(),
+        banReason: reason,
+        ...(bannedUntil ? { bannedUntil } : {}),
       });
-      const record = await config.store.get(authorized.tenantId, keyId);
-      if (!record) throw new ConsoleDomainError("key_not_found", 404, "Key not found");
-      return sanitizeApiKeyResponse(record);
     },
     async unbanKey(
       access: AccessDecision | undefined,
@@ -836,9 +856,11 @@ export function createApiKeyOperations(config: ApiKeyConfig) {
         action: "api_key.unbanned",
         target: keyId,
       });
-      const record = await config.store.get(authorized.tenantId, keyId);
-      if (!record) throw new ConsoleDomainError("key_not_found", 404, "Key not found");
-      return sanitizeApiKeyResponse(record);
+      // Unban clears all three ban columns and re-enables the key; derive the
+      // response from the pre-fetch instead of re-fetching after the write.
+      const { bannedAt: _bannedAt, banReason: _banReason, bannedUntil: _bannedUntil, ...currentRest } = current;
+      const unbannedRecord: ApiKeyRecord = { ...currentRest, enabled: true };
+      return sanitizeApiKeyResponse(unbannedRecord);
     },
   };
   return operations;
@@ -858,6 +880,7 @@ const apiKeyBody = t.Object({
   monthlyTokenLimit: t.Optional(t.Union([t.Number(), t.Null()])),
   lifetimeTokenBudget: t.Optional(t.Union([t.Number(), t.Null()])),
   maxConcurrentRequests: t.Optional(t.Union([t.Number(), t.Null()])),
+  concurrencyScope: t.Optional(literalUnion(API_KEY_CONCURRENCY_SCOPES)),
   modelPrefix: t.Optional(t.String()),
   modelAccessMode: t.Optional(literalUnion(API_KEY_MODEL_ACCESS_MODES)),
   modelList: t.Optional(t.Array(t.String())),
@@ -905,6 +928,13 @@ export function createApiKeyRoutes(config: ApiKeyConfig): AnyElysia {
         return errorResponse(error, set, "API-key operation failed");
       }
     })
+    .get("/banned", async ({ request, set }) => {
+      try {
+        return await factory.listActiveBannedKeys(config.accessResolver(request));
+      } catch (error) {
+        return errorResponse(error, set, "API-key operation failed");
+      }
+    })
     .post("/reorder", { body: reorderKeysBody }, async ({ request, body, set }) => {
       try {
         await factory.reorderKeys(config.accessResolver(request), body.keyIds);
@@ -1020,7 +1050,9 @@ export function createApiKeyRoutes(config: ApiKeyConfig): AnyElysia {
       {
         body: t.Object({
           reason: t.String(),
-          reasonLabel: t.Optional(t.String()),
+          // `reasonLabel` is deliberately not accepted: the audit label is
+          // derived server-side from `reason` (see `banKey`), so a client
+          // cannot author the human-readable audit entry.
           minutes: t.Optional(t.Union([t.Number({ minimum: 1 }), t.Null()])),
         }),
       },

package/src/console/auth/access.ts

@@ -1,4 +1,4 @@
-import type { AccessDecision } from "../../security/access-control";
-
-/** Resolves the authenticated console request to a tenant-scoped decision. */
-export type ConsoleAccessResolver = (request: Request) => AccessDecision | undefined;
+import type { AccessDecision } from "../../security/access-control";
+
+/** Resolves the authenticated console request to a tenant-scoped decision. */
+export type ConsoleAccessResolver = (request: Request) => AccessDecision | undefined;

package/src/console/auth/account-reset.ts

@@ -25,7 +25,7 @@
 import { GatewayError } from "../../protocol/gateway-error";
 import { isLoopbackPeer, tokenMatches } from "../../transport/drain-endpoint";
 
-export interface ConsoleAccountResetDeps {
+interface ConsoleAccountResetDeps {
   /** Shared secret; the route is registered only when this is set. */
   readonly token: string;
   /** Removes every console user and session. Resolves to the number removed. */

package/src/console/auth/audit-recorder.ts

@@ -8,7 +8,7 @@ import {
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import { type AccessDecision } from "../../security/access-control";
 
-export interface AuditRecordInput {
+interface AuditRecordInput {
   readonly access: AccessDecision;
   readonly action: string;
   readonly target: string;

package/src/console/auth/lockout.ts

@@ -7,8 +7,9 @@ import {
 } from "../../persistence/schema";
 
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
+import { log } from "../../observability/logger";
 
-export class ConsoleLockoutStore {
+class ConsoleLockoutStore {
   constructor(private readonly db: CartethyiaDatabase) {}
 
   async getLockedUntil(ip: string): Promise<Date | null | undefined> {
@@ -143,8 +144,11 @@ export class ConsoleLockoutService {
           enforcement: "full_network_lockout",
         },
       });
-    } catch {
-      // Best-effort audit logging; the ban itself remains enforced via the DB row.
+    } catch (error) {
+      // Best-effort audit logging; the ban itself remains enforced via the DB
+      // row. A failed write is logged — for a security-relevant event
+      // (`security.ip_banned`) total silence would hide a broken audit trail.
+      log.error(`[auth] failed to record ip_banned audit for ${ip}`, error as Error, reason);
     }
   }
 

package/src/console/auth/row-coercion.ts

@@ -3,7 +3,7 @@ import type { ConsoleSession, ConsoleUser } from "../../persistence/schema";
 
 import { isRecord } from "../../protocol/codecs";
 
-export function asDate(value: unknown): Date | undefined {
+function asDate(value: unknown): Date | undefined {
   if (value instanceof Date && !Number.isNaN(value.getTime())) return value;
   if (typeof value === "string" || typeof value === "number") {
     const date = new Date(value);
@@ -14,33 +14,78 @@ export function asDate(value: unknown): Date | undefined {
 
 export function sessionRecord(value: unknown): ConsoleSession | undefined {
   if (!isRecord(value)) return undefined;
+  const id = value.id;
+  const userId = value.userId;
+  const sessionToken = value.sessionToken;
+  const ipAddress = value.ipAddress;
+  const userAgent = value.userAgent;
   if (
-    typeof value.id !== "string" ||
-    typeof value.userId !== "string" ||
-    typeof value.sessionToken !== "string"
+    typeof id !== "string" ||
+    typeof userId !== "string" ||
+    typeof sessionToken !== "string"
   ) {
     return undefined;
   }
   const expiresAt = asDate(value.expiresAt);
   const createdAt = asDate(value.createdAt);
   if (!expiresAt || !createdAt) return undefined;
-  return { ...value, expiresAt, createdAt } as unknown as ConsoleSession;
+  // Construct the result explicitly field-by-field so the output shape is
+  // exactly what was validated — arbitrary extra keys on a driver row must
+  // not survive into the typed session.
+  return {
+    id,
+    userId,
+    sessionToken,
+    ...(ipAddress === null || typeof ipAddress === "string" ? { ipAddress } : { ipAddress: null }),
+    ...(userAgent === null || typeof userAgent === "string" ? { userAgent } : { userAgent: null }),
+    expiresAt,
+    createdAt,
+  };
 }
 
 export function userRecord(value: unknown): ConsoleUser | undefined {
   if (!isRecord(value)) return undefined;
+  const id = value.id;
+  const username = value.username;
+  const passwordHash = value.passwordHash;
+  const isActive = value.isActive;
   if (
-    typeof value.id !== "string" ||
-    typeof value.username !== "string" ||
-    typeof value.passwordHash !== "string" ||
-    typeof value.isActive !== "boolean"
+    typeof id !== "string" ||
+    typeof username !== "string" ||
+    typeof passwordHash !== "string" ||
+    typeof isActive !== "boolean"
   ) {
     return undefined;
   }
-  return value as unknown as ConsoleUser;
+  // Timestamps are coerced through `asDate` because SQLite hands them back as
+  // text; a login path that rejects non-Date values must still work there.
+  const createdAt = asDate(value.createdAt);
+  const updatedAt = asDate(value.updatedAt);
+  if (!createdAt || !updatedAt) return undefined;
+  const tenantId = value.tenantId;
+  const email = value.email;
+  const displayName = value.displayName;
+  const isFirstBoot = value.isFirstBoot;
+  const isPlatformAdmin = value.isPlatformAdmin;
+  // Construct the result explicitly field-by-field so the output shape is
+  // exactly what was validated — arbitrary extra keys on a driver row must
+  // not survive into the typed user.
+  return {
+    id,
+    tenantId: typeof tenantId === "string" ? tenantId : "",
+    username,
+    email: typeof email === "string" ? email : null,
+    passwordHash,
+    displayName: typeof displayName === "string" ? displayName : null,
+    isActive,
+    isPlatformAdmin: isPlatformAdmin === true,
+    isFirstBoot: isFirstBoot === true,
+    createdAt,
+    updatedAt,
+  };
 }
 
-export function mutationAffectedRows(value: unknown): number | undefined {
+function mutationAffectedRows(value: unknown): number | undefined {
   if (!isRecord(value)) return undefined;
   for (const key of ["rowCount", "rowsAffected", "changes"] as const) {
     const count = value[key];
@@ -50,7 +95,7 @@ export function mutationAffectedRows(value: unknown): number | undefined {
 }
 
 /** Awaitable Drizzle mutation builder that may expose `.returning()`. */
-export interface ReturningBuilder extends PromiseLike<unknown> {
+interface ReturningBuilder extends PromiseLike<unknown> {
   returning?: (...columns: unknown[]) => PromiseLike<unknown[]>;
 }
 

package/src/console/auth/session-resolver.ts

@@ -45,7 +45,7 @@ export async function resolveConsoleAccess(
 }
 
 /** The signed-in console user behind a request, or `null` when unauthenticated. */
-export interface ResolvedConsoleUser {
+interface ResolvedConsoleUser {
   readonly id: string;
   readonly sessionId: string;
   readonly tenantId: string;

package/src/console/auth/session-service.ts

@@ -58,7 +58,7 @@ function newSessionToken(): string {
   return randomBytes(32).toString("base64url");
 }
 
-export class ConsoleSessionStore {
+class ConsoleSessionStore {
   constructor(private readonly db: CartethyiaDatabase) {}
 
   async create(newSession: {
@@ -73,7 +73,13 @@ export class ConsoleSessionStore {
     const inserted = await returningRows(this.db.insert(consoleSessions).values(newSession));
     assertMutationApplied(inserted, "Console session");
     const persisted = sessionRecord(inserted.rows[0]);
-    return persisted ?? ({ ...newSession } as unknown as ConsoleSession);
+    if (!persisted) {
+      // `assertMutationApplied` already refused a failed insert, so an
+      // unshaped row here is a driver/schema mismatch — pretending success by
+      // returning the input cast to ConsoleSession would mask it.
+      throw new Error("Console session row could not be coerced after insert");
+    }
+    return persisted;
   }
 
   async findValidByTokenHash(tokenHash: string, now: Date): Promise<ConsoleSession | null> {