dscs-server 0.1.3 → 0.1.5

package/dist/http.js

@@ -7,10 +7,13 @@ import { SyncError, statusOf } from './shared/wire.js';
 import { BLOB_BATCH_CONTENT_TYPE, MAX_BATCH_BLOBS, MAX_BATCH_BODY_BYTES, decodeBlobBatch, encodeBlobBatch } from './shared/blob-batch.js';
 import { deriveMasterKey, newSalt } from './shared/crypto.js';
 import { hasBlob, putBlob, readBlob } from './blobs.js';
-import { DEFAULT_DATASET, SERVER_SCHEMA_VERSION, adminPassword, blobRecord, isAdminInitialized, markAdminInitialized, readMaxBytes, readMeta, recordBlob, readRevision, setAdminPassword, usedBlobBytes, writeMaxBytes } from './db.js';
-import { MAX_APPEND_BODY_BYTES, adminSessions, appendFrames, deleteSession, getManifest, getV2SessionSummary, listV2Batches, listV2Changes, listV2Sessions, sessionCounts } from './sessions.js';
+import { DEFAULT_DATASET, SERVER_SCHEMA_VERSION, adminPassword, blobRecord, isAdminInitialized, markAdminInitialized, nextDeviceColor, readMaxBytes, readMeta, recordBlob, setAdminPassword, usedBlobBytes, writeMaxBytes } from './db.js';
+import { MAX_APPEND_BODY_BYTES, adminSessions, appendFrames, deleteSession, getManifest, getV2SessionSummary, listV2Batches, listV2Sessions, sessionCounts } from './sessions.js';
 import { acquireLease, releaseLease, SYNC_RESOURCE, vaultResource } from './leases.js';
 import { appendVaultRecord, readVaultCursor, readVaultStream, validVaultWriter } from './vault.js';
+import { listAudit, recordAudit } from './audit.js';
+import { archiveSession, removeSession, resetSession, restoreSession } from './session-admin.js';
+import { listActivity, listActivitySessions, listSessionHistory } from './session-history.js';
 function readServerVersion() {
     try {
         const raw = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
@@ -87,16 +90,26 @@ function authenticate(db, req) {
     if (setupToken !== undefined && token === setupToken) return {
         role: 'admin'
     };
-    const row = db.handle.prepare('SELECT device_id, label, created_at, last_seen_at, revoked_at FROM devices WHERE dataset = ? AND token_hash = ?').get(DEFAULT_DATASET, hashToken(token));
+    const row = db.handle.prepare('SELECT device_id, label, created_at, last_seen_at, revoked_at, color FROM devices WHERE dataset = ? AND token_hash = ?').get(DEFAULT_DATASET, hashToken(token));
     if (row === undefined || row.revoked_at !== null) return undefined;
+    const now = Date.now();
+    let lastSeenAt = row.last_seen_at;
+    try {
+        const result = db.handle.prepare(`UPDATE devices SET last_seen_at = ?
+                WHERE dataset = ? AND device_id = ? AND (last_seen_at IS NULL OR last_seen_at < ?)`).run(now, DEFAULT_DATASET, row.device_id, now - DEVICE_LAST_SEEN_THROTTLE_MS);
+        if (Number(result.changes) > 0) lastSeenAt = now;
+    } catch  {}
     return {
         role: 'device',
         device: {
             deviceId: row.device_id,
             label: row.label,
             createdAt: row.created_at,
-            ...row.last_seen_at === null ? {} : {
-                lastSeenAt: row.last_seen_at
+            ...lastSeenAt === null ? {} : {
+                lastSeenAt
+            },
+            ...row.color === null ? {} : {
+                color: row.color
             }
         }
     };
@@ -163,40 +176,6 @@ function decodeSessionsCursor(raw) {
     }
     return value['after'];
 }
-function decodeChangesCursor(raw) {
-    const value = decodeCursorObject(raw);
-    if (value === undefined) {
-        return {
-            revision: 0,
-            tombstone: {
-                deletedAt: 0,
-                sessionId: '',
-                createdAt: 0
-            }
-        };
-    }
-    const revision = value['revision'];
-    const tombstone = value['tombstone'];
-    if (value['v'] !== 2 || typeof revision !== 'number' || !Number.isSafeInteger(revision) || revision < 0 || tombstone === null || typeof tombstone !== 'object' || Array.isArray(tombstone)) {
-        throw new SyncError('bad-request', 'cursor 非法');
-    }
-    const record = tombstone;
-    const deletedAt = record['deletedAt'];
-    const sessionId = record['sessionId'];
-    const createdAt = record['createdAt'];
-    const empty = deletedAt === 0 && sessionId === '' && createdAt === 0;
-    if (typeof deletedAt !== 'number' || !Number.isSafeInteger(deletedAt) || deletedAt < 0 || typeof sessionId !== 'string' || !empty && !SESSION_ID_PATTERN.test(sessionId) || typeof createdAt !== 'number' || !Number.isSafeInteger(createdAt) || createdAt < 0) {
-        throw new SyncError('bad-request', 'cursor 非法');
-    }
-    return {
-        revision,
-        tombstone: {
-            deletedAt,
-            sessionId,
-            createdAt
-        }
-    };
-}
 function etagMatches(header, digest) {
     const raw = Array.isArray(header) ? header.join(',') : header;
     if (raw === undefined) return false;
@@ -266,7 +245,6 @@ function intParam(value, fallback, min, max) {
 }
 const SYNC_LEASE_PATH = /^\/v2\/sync\/lease$/u;
 const V2_SESSIONS_PATH = /^\/v2\/sessions$/u;
-const V2_CHANGES_PATH = /^\/v2\/changes$/u;
 const V2_SUMMARY_PATH = /^\/v2\/sessions\/([^/]+)\/summary$/u;
 const V2_BATCHES_PATH = /^\/v2\/sessions\/([^/]+)\/batches$/u;
 const V2_MANIFEST_PATH = /^\/v2\/sessions\/([^/]+)\/manifest$/u;
@@ -283,6 +261,8 @@ const VAULT_LEASE_PATH = /^\/v2\/vault\/lease$/u;
 const VAULT_CURSOR_PATH = /^\/v2\/vault\/cursor$/u;
 const VAULT_STREAM_PATH = /^\/v2\/vault\/stream\/([^/]+)$/u;
 const ADMIN_DEVICE_PATH = /^\/admin\/devices\/([0-9a-f]+)$/u;
+const ADMIN_SESSION_ACTION_PATH = /^\/admin\/sessions\/([^/]+)\/(archive|remove|reset|restore|clear-reset)$/u;
+const ADMIN_SESSION_HISTORY_PATH = /^\/admin\/sessions\/([^/]+)\/history$/u;
 function withBatchFields(value) {
     if (value === null || typeof value !== 'object') return value;
     const record = value;
@@ -303,6 +283,7 @@ function withBatchFields(value) {
 const ADMIN_COOKIE = 'dsh_sync_admin';
 const SETUP_COOKIE = 'dsh_sync_setup';
 const ADMIN_TTL_MS = 12 * 60 * 60 * 1000;
+const DEVICE_LAST_SEEN_THROTTLE_MS = 60 * 1000;
 const SETUP_TTL_MS = 15 * 60 * 1000;
 export const ONBOARDING_TTL_MS = 10 * 60 * 1000;
 export const ONBOARDING_CODE_FILE = 'onboarding-code.json';
@@ -350,24 +331,29 @@ export function createDevice(db, label) {
     const deviceId = randomBytes(8).toString('hex');
     const token = mintToken();
     const now = Date.now();
-    db.handle.prepare('INSERT INTO devices (dataset, device_id, label, token_hash, created_at) VALUES (?, ?, ?, ?, ?)').run(DEFAULT_DATASET, deviceId, label, hashToken(token), now);
+    const color = nextDeviceColor(db);
+    db.handle.prepare('INSERT INTO devices (dataset, device_id, label, token_hash, created_at, color) VALUES (?, ?, ?, ?, ?, ?)').run(DEFAULT_DATASET, deviceId, label, hashToken(token), now, color);
     return {
         device: {
             deviceId,
             label,
-            createdAt: now
+            createdAt: now,
+            color
         },
         token
     };
 }
 export function listDevices(db) {
-    const rows = db.handle.prepare('SELECT device_id, label, created_at, last_seen_at FROM devices WHERE dataset = ? AND revoked_at IS NULL ORDER BY created_at').all(DEFAULT_DATASET);
+    const rows = db.handle.prepare('SELECT device_id, label, created_at, last_seen_at, color FROM devices WHERE dataset = ? AND revoked_at IS NULL ORDER BY created_at').all(DEFAULT_DATASET);
     return rows.map((row)=>({
             deviceId: row.device_id,
             label: row.label,
             createdAt: row.created_at,
             ...row.last_seen_at === null ? {} : {
                 lastSeenAt: row.last_seen_at
+            },
+            ...row.color === null ? {} : {
+                color: row.color
             }
         }));
 }
@@ -375,10 +361,11 @@ export function revokeDevice(db, deviceId) {
     const result = db.handle.prepare('UPDATE devices SET revoked_at = ? WHERE dataset = ? AND device_id = ? AND revoked_at IS NULL').run(Date.now(), DEFAULT_DATASET, deviceId);
     return Number(result.changes) > 0;
 }
-export function renameDevice(db, deviceId, label) {
-    const result = db.handle.prepare('UPDATE devices SET label = ? WHERE dataset = ? AND device_id = ? AND revoked_at IS NULL').run(label, DEFAULT_DATASET, deviceId);
+export function updateDevice(db, deviceId, changes) {
+    const result = db.handle.prepare(`UPDATE devices SET label = COALESCE(?, label), color = COALESCE(?, color)
+              WHERE dataset = ? AND device_id = ? AND revoked_at IS NULL`).run(changes.label ?? null, changes.color ?? null, DEFAULT_DATASET, deviceId);
     if (Number(result.changes) === 0) return undefined;
-    const row = db.handle.prepare('SELECT device_id, label, created_at, last_seen_at FROM devices WHERE dataset = ? AND device_id = ?').get(DEFAULT_DATASET, deviceId);
+    const row = db.handle.prepare('SELECT device_id, label, created_at, last_seen_at, color FROM devices WHERE dataset = ? AND device_id = ?').get(DEFAULT_DATASET, deviceId);
     if (row === undefined) return undefined;
     return {
         deviceId: row.device_id,
@@ -386,9 +373,22 @@ export function renameDevice(db, deviceId, label) {
         createdAt: row.created_at,
         ...row.last_seen_at === null ? {} : {
             lastSeenAt: row.last_seen_at
+        },
+        ...row.color === null ? {} : {
+            color: row.color
         }
     };
 }
+export function renameDevice(db, deviceId, label) {
+    return updateDevice(db, deviceId, {
+        label
+    });
+}
+function requireDeviceColor(value) {
+    const color = typeof value === 'string' ? value.trim().toLowerCase() : '';
+    if (!/^#[0-9a-f]{6}$/u.test(color)) throw new SyncError('bad-request', '颜色必须是 #rrggbb');
+    return color;
+}
 function requireDeviceLabel(value) {
     const label = typeof value === 'string' ? value.trim() : '';
     if (label === '') throw new SyncError('bad-request', '设备名不能为空');
@@ -476,7 +476,6 @@ export function createHttpServer(options) {
                         schemaVersion: SERVER_SCHEMA_VERSION,
                         capabilities: [
                             'session-summary',
-                            'changes-cursor',
                             'conditional-get',
                             'idempotent-append',
                             'manifest-digest',
@@ -486,7 +485,8 @@ export function createHttpServer(options) {
                             'zstd-frame',
                             'me-device-info',
                             'me-counts',
-                            'device-rename'
+                            'device-rename',
+                            'attachment-index'
                         ],
                         limits: {
                             batchBytes: MAX_BATCH_BODY_BYTES,
@@ -506,7 +506,8 @@ export function createHttpServer(options) {
                 const url = new URL(req.url ?? '/', 'http://localhost');
                 const after = decodeSessionsCursor(url.searchParams.get('cursor'));
                 const limit = intParam(url.searchParams.get('limit'), 200, 1, 1000);
-                const page = listV2Sessions(db, after, limit);
+                const includeDeleted = url.searchParams.get('includeDeleted') === '1';
+                const page = listV2Sessions(db, after, limit, includeDeleted);
                 return json(res, 200, {
                     ok: true,
                     value: {
@@ -519,30 +520,6 @@ export function createHttpServer(options) {
                 });
             }
         },
-        {
-            method: 'GET',
-            path: V2_CHANGES_PATH,
-            handler: async (req, res)=>{
-                requireDevice(db, req);
-                const url = new URL(req.url ?? '/', 'http://localhost');
-                const cursor = decodeChangesCursor(url.searchParams.get('cursor'));
-                const limit = intParam(url.searchParams.get('limit'), 200, 1, 1000);
-                const page = listV2Changes(db, cursor.revision, cursor.tombstone, limit);
-                return json(res, 200, {
-                    ok: true,
-                    value: {
-                        sessions: page.sessions,
-                        tombstones: page.tombstones,
-                        nextCursor: encodeCursor({
-                            v: 2,
-                            revision: page.nextRevision,
-                            tombstone: page.nextTombstone
-                        }),
-                        hasMore: page.hasMore
-                    }
-                });
-            }
-        },
         {
             method: 'GET',
             path: V2_SUMMARY_PATH,
@@ -633,9 +610,19 @@ export function createHttpServer(options) {
                 const id = sessionIdFrom(new URL(req.url ?? '/', 'http://localhost').pathname, V2_DELETE_PATH);
                 const body = await readJson(req);
                 if (!Number.isSafeInteger(body.createdAt)) throw new SyncError('bad-request', 'createdAt 必须是整数');
+                const value = deleteSession(db, id, device.deviceId, clientId, Number(body.createdAt));
+                recordAudit(db, {
+                    actorKind: 'device',
+                    actorId: device.deviceId,
+                    action: 'session.delete',
+                    target: id,
+                    detail: {
+                        createdAt: Number(body.createdAt)
+                    }
+                }, req);
                 return json(res, 200, {
                     ok: true,
-                    value: deleteSession(db, id, device.deviceId, clientId, Number(body.createdAt))
+                    value
                 });
             }
         },
@@ -759,7 +746,7 @@ export function createHttpServer(options) {
                     if (!await hasBlob(options.dataDir, sha256)) return json(res, 404, errorBody('not-found', `没有这个 blob：${sha256}`));
                     const record = blobRecord(db, sha256);
                     if (record === undefined) return json(res, 404, errorBody('not-found', `没有这个 blob：${sha256}`));
-                    if (record.kind !== 'frame' && record.kind !== 'attachment' && record.kind !== 'vault') {
+                    if (record.kind !== 'frame' && record.kind !== 'attachment' && record.kind !== 'attachment-index' && record.kind !== 'vault') {
                         throw new SyncError('bad-request', `blob 类别非法：${record.kind}`);
                     }
                     kinds.push(record.kind);
@@ -792,8 +779,8 @@ export function createHttpServer(options) {
                 if (auth === undefined) return json(res, 401, errorBody('unauthorized', '需要设备或 setup token'));
                 const url = new URL(req.url ?? '/', 'http://localhost');
                 const kind = url.searchParams.get('kind') ?? 'frame';
-                if (kind !== 'frame' && kind !== 'attachment' && kind !== 'vault') {
-                    return json(res, 400, errorBody('bad-request', 'kind 只能是 frame、attachment 或 vault'));
+                if (kind !== 'frame' && kind !== 'attachment' && kind !== 'attachment-index' && kind !== 'vault') {
+                    return json(res, 400, errorBody('bad-request', 'kind 只能是 frame、attachment、attachment-index 或 vault'));
                 }
                 const bytes = await readRaw(req, maxBlobBytes);
                 if (bytes.length === 0) return json(res, 400, errorBody('bad-request', 'blob 不能为空'));
@@ -990,9 +977,22 @@ export function createHttpServer(options) {
                 const password = typeof body.password === 'string' ? body.password : '';
                 if (!passwordMatches(password)) {
                     noteFailure(`login:${ip}`);
+                    recordAudit(db, {
+                        actorKind: 'admin',
+                        actorId: 'admin',
+                        action: 'login_failed',
+                        detail: {
+                            reason: '密码不正确'
+                        }
+                    }, req);
                     throw new SyncError('unauthorized', '密码不正确');
                 }
                 attemptsByKey.delete(`login:${ip}`);
+                recordAudit(db, {
+                    actorKind: 'admin',
+                    actorId: 'admin',
+                    action: 'login'
+                }, req);
                 return json(res, 200, {
                     ok: true,
                     value: {
@@ -1006,7 +1006,14 @@ export function createHttpServer(options) {
             path: /^\/admin\/logout$/u,
             handler: async (req, res)=>{
                 const token = cookieValue(req, ADMIN_COOKIE);
-                if (token !== undefined) adminSessionsByKey.delete(hashToken(token));
+                if (token !== undefined) {
+                    adminSessionsByKey.delete(hashToken(token));
+                    recordAudit(db, {
+                        actorKind: 'admin',
+                        actorId: 'admin',
+                        action: 'logout'
+                    }, req);
+                }
                 writeAdminCookie(res, '', 0);
                 return json(res, 200, {
                     ok: true,
@@ -1016,6 +1023,48 @@ export function createHttpServer(options) {
                 });
             }
         },
+        {
+            method: 'POST',
+            path: /^\/admin\/password$/u,
+            handler: async (req, res)=>{
+                requireAdmin(req);
+                const body = await readJson(req);
+                const current = typeof body.currentPassword === 'string' ? body.currentPassword : '';
+                if (!passwordMatches(current)) {
+                    recordAudit(db, {
+                        actorKind: 'admin',
+                        actorId: 'admin',
+                        action: 'password.change_failed',
+                        detail: {
+                            reason: '当前密码不正确'
+                        }
+                    }, req);
+                    throw new SyncError('bad-request', '当前密码不正确');
+                }
+                const problem = validateAdminPassword(body.newPassword);
+                if (problem !== undefined) throw new SyncError('bad-request', problem);
+                const salt = newSalt();
+                setAdminPassword(db, deriveMasterKey(String(body.newPassword), salt).toString('hex'), salt.toString('hex'));
+                const token = cookieValue(req, ADMIN_COOKIE);
+                const currentKey = token === undefined ? undefined : hashToken(token);
+                for (const key of [
+                    ...adminSessionsByKey.keys()
+                ]){
+                    if (key !== currentKey) adminSessionsByKey.delete(key);
+                }
+                recordAudit(db, {
+                    actorKind: 'admin',
+                    actorId: 'admin',
+                    action: 'password.change'
+                }, req);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        changed: true
+                    }
+                });
+            }
+        },
         {
             method: 'GET',
             path: /^\/setup\/state$/u,
@@ -1073,6 +1122,11 @@ export function createHttpServer(options) {
                 if (problem !== undefined) throw new SyncError('bad-request', problem);
                 const salt = newSalt();
                 setAdminPassword(db, deriveMasterKey(String(body.password), salt).toString('hex'), salt.toString('hex'));
+                recordAudit(db, {
+                    actorKind: 'system',
+                    actorId: 'setup',
+                    action: 'setup.password'
+                }, req);
                 return json(res, 200, {
                     ok: true,
                     value: {
@@ -1092,6 +1146,14 @@ export function createHttpServer(options) {
                 const maxBytes = Number(body.maxBytes);
                 if (maxBytes < MIN_MAX_BYTES || maxBytes > MAX_MAX_BYTES) throw new SyncError('bad-request', '配额超出允许范围');
                 writeMaxBytes(db, maxBytes);
+                recordAudit(db, {
+                    actorKind: 'system',
+                    actorId: 'setup',
+                    action: 'setup.quota',
+                    detail: {
+                        maxBytes
+                    }
+                }, req);
                 return json(res, 200, {
                     ok: true,
                     value: {
@@ -1108,9 +1170,19 @@ export function createHttpServer(options) {
                 if (isAdminInitialized(db)) throw new SyncError('conflict', '已经完成初始化');
                 const body = await readJson(req);
                 const label = typeof body.label === 'string' && body.label.trim() !== '' ? body.label.trim() : 'device';
+                const created = createDevice(db, label);
+                recordAudit(db, {
+                    actorKind: 'system',
+                    actorId: 'setup',
+                    action: 'setup.device',
+                    target: created.device.deviceId,
+                    detail: {
+                        label
+                    }
+                }, req);
                 return json(res, 201, {
                     ok: true,
-                    value: createDevice(db, label)
+                    value: created
                 });
             }
         },
@@ -1128,6 +1200,11 @@ export function createHttpServer(options) {
                     force: true
                 });
                 writeSetupCookie(res, '', 0);
+                recordAudit(db, {
+                    actorKind: 'system',
+                    actorId: 'setup',
+                    action: 'setup.complete'
+                }, req);
                 return json(res, 200, {
                     ok: true,
                     value: {
@@ -1146,7 +1223,17 @@ export function createHttpServer(options) {
                 if (!Number.isSafeInteger(body.maxBytes)) throw new SyncError('bad-request', '配额必须是整数');
                 const maxBytes = Number(body.maxBytes);
                 if (maxBytes < MIN_MAX_BYTES || maxBytes > MAX_MAX_BYTES) throw new SyncError('bad-request', '配额超出允许范围');
+                const from = effectiveMaxBytes();
                 writeMaxBytes(db, maxBytes);
+                recordAudit(db, {
+                    actorKind: 'admin',
+                    actorId: 'admin',
+                    action: 'quota.change',
+                    detail: {
+                        from,
+                        to: maxBytes
+                    }
+                }, req);
                 return json(res, 200, {
                     ok: true,
                     value: {
@@ -1166,7 +1253,6 @@ export function createHttpServer(options) {
                     value: {
                         version,
                         protocol: PROTOCOL_VERSION,
-                        revision: readRevision(db),
                         devices: listDevices(db).length,
                         sessions: counts.total,
                         deletedSessions: counts.deleted,
@@ -1194,9 +1280,19 @@ export function createHttpServer(options) {
                 requireAdmin(req);
                 const body = await readJson(req);
                 const label = typeof body.label === 'string' && body.label.trim() !== '' ? body.label.trim() : 'device';
+                const created = createDevice(db, label);
+                recordAudit(db, {
+                    actorKind: 'admin',
+                    actorId: 'admin',
+                    action: 'device.create',
+                    target: created.device.deviceId,
+                    detail: {
+                        label
+                    }
+                }, req);
                 return json(res, 201, {
                     ok: true,
-                    value: createDevice(db, label)
+                    value: created
                 });
             }
         },
@@ -1207,13 +1303,24 @@ export function createHttpServer(options) {
                 requireAdmin(req);
                 const match = ADMIN_DEVICE_PATH.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
                 if (match === null) return json(res, 404, errorBody('not-found', '没有这个设备'));
-                return revokeDevice(db, match[1]) ? json(res, 200, {
+                const before = listDevices(db).find((device)=>device.deviceId === match[1]);
+                if (!revokeDevice(db, match[1])) return json(res, 404, errorBody('not-found', '没有这个设备'));
+                recordAudit(db, {
+                    actorKind: 'admin',
+                    actorId: 'admin',
+                    action: 'device.revoke',
+                    target: match[1],
+                    detail: {
+                        label: before?.label
+                    }
+                }, req);
+                return json(res, 200, {
                     ok: true,
                     value: {
                         deviceId: match[1],
                         revoked: true
                     }
-                }) : json(res, 404, errorBody('not-found', '没有这个设备'));
+                });
             }
         },
         {
@@ -1224,9 +1331,31 @@ export function createHttpServer(options) {
                 const match = ADMIN_DEVICE_PATH.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
                 if (match === null) return json(res, 404, errorBody('not-found', '没有这个设备'));
                 const body = await readJson(req);
-                const label = requireDeviceLabel(body.label);
-                const device = renameDevice(db, match[1], label);
+                const label = body.label === undefined ? undefined : requireDeviceLabel(body.label);
+                const color = body.color === undefined ? undefined : requireDeviceColor(body.color);
+                if (label === undefined && color === undefined) throw new SyncError('bad-request', '需要 label 或 color');
+                const before = listDevices(db).find((device)=>device.deviceId === match[1]);
+                const device = updateDevice(db, match[1], {
+                    ...label === undefined ? {} : {
+                        label
+                    },
+                    ...color === undefined ? {} : {
+                        color
+                    }
+                });
                 if (device === undefined) return json(res, 404, errorBody('not-found', '没有这个设备'));
+                if (label !== undefined) {
+                    recordAudit(db, {
+                        actorKind: 'admin',
+                        actorId: 'admin',
+                        action: 'device.rename',
+                        target: match[1],
+                        detail: {
+                            from: before?.label,
+                            to: label
+                        }
+                    }, req);
+                }
                 return json(res, 200, {
                     ok: true,
                     value: {
@@ -1235,6 +1364,77 @@ export function createHttpServer(options) {
                 });
             }
         },
+        {
+            method: 'GET',
+            path: /^\/admin\/activity$/u,
+            handler: async (req, res)=>{
+                requireAdmin(req);
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const now = Date.now();
+                const to = intParam(url.searchParams.get('to'), now, 1, Number.MAX_SAFE_INTEGER);
+                const from = intParam(url.searchParams.get('from'), to - 90 * 24 * 60 * 60 * 1000, 0, Number.MAX_SAFE_INTEGER);
+                if (to <= from) throw new SyncError('bad-request', 'to 必须大于 from');
+                const tzOffset = intParam(url.searchParams.get('tzOffset'), 0, -14 * 60, 14 * 60);
+                const deviceId = url.searchParams.get('deviceId') ?? undefined;
+                const sessionId = url.searchParams.get('sessionId') ?? undefined;
+                return json(res, 200, {
+                    ok: true,
+                    value: listActivity(db, {
+                        from,
+                        to,
+                        tzOffset,
+                        ...deviceId === undefined ? {} : {
+                            deviceId
+                        },
+                        ...sessionId === undefined ? {} : {
+                            sessionId
+                        }
+                    })
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: /^\/admin\/activity\/sessions$/u,
+            handler: async (req, res)=>{
+                requireAdmin(req);
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const day = url.searchParams.get('day') ?? '';
+                if (!/^\d{4}-\d{2}-\d{2}$/u.test(day)) throw new SyncError('bad-request', 'day 必须是 YYYY-MM-DD');
+                const tzOffset = intParam(url.searchParams.get('tzOffset'), 0, -14 * 60, 14 * 60);
+                return json(res, 200, {
+                    ok: true,
+                    value: listActivitySessions(db, {
+                        day,
+                        tzOffset
+                    })
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: /^\/admin\/audit$/u,
+            handler: async (req, res)=>{
+                requireAdmin(req);
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const limit = intParam(url.searchParams.get('limit'), 50, 1, 200);
+                const beforeRaw = url.searchParams.get('before');
+                const before = beforeRaw === null ? undefined : intParam(beforeRaw, 0, 0, Number.MAX_SAFE_INTEGER);
+                const action = url.searchParams.get('action') ?? undefined;
+                return json(res, 200, {
+                    ok: true,
+                    value: listAudit(db, {
+                        limit,
+                        ...before === undefined ? {} : {
+                            before
+                        },
+                        ...action === undefined ? {} : {
+                            action
+                        }
+                    })
+                });
+            }
+        },
         {
             method: 'GET',
             path: /^\/admin\/sessions$/u,
@@ -1246,6 +1446,154 @@ export function createHttpServer(options) {
                 });
             }
         },
+        {
+            method: 'GET',
+            path: ADMIN_SESSION_HISTORY_PATH,
+            handler: async (req, res)=>{
+                requireAdmin(req);
+                const match = ADMIN_SESSION_HISTORY_PATH.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
+                if (match === null) return json(res, 404, errorBody('not-found', '没有这个会话'));
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const limit = intParam(url.searchParams.get('limit'), 100, 1, 200);
+                const beforeRaw = url.searchParams.get('before');
+                const before = beforeRaw === null ? undefined : intParam(beforeRaw, 0, 0, Number.MAX_SAFE_INTEGER);
+                const sessionId = decodeURIComponent(match[1]);
+                return json(res, 200, {
+                    ok: true,
+                    value: listSessionHistory(db, sessionId, {
+                        limit,
+                        ...before === undefined ? {} : {
+                            before
+                        }
+                    })
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: ADMIN_SESSION_ACTION_PATH,
+            handler: async (req, res)=>{
+                requireAdmin(req);
+                const match = ADMIN_SESSION_ACTION_PATH.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
+                if (match === null) return json(res, 404, errorBody('not-found', '没有这个会话'));
+                const sessionId = decodeURIComponent(match[1]);
+                const action = match[2];
+                const body = await readJson(req);
+                if (!Number.isSafeInteger(body.createdAt)) throw new SyncError('bad-request', 'createdAt 必须是整数');
+                const createdAt = Number(body.createdAt);
+                if (action === 'clear-reset') {
+                    const result = db.handle.prepare('DELETE FROM session_resets WHERE dataset = ? AND session_id = ?').run(DEFAULT_DATASET, sessionId);
+                    if (Number(result.changes) === 0) throw new SyncError('not-found', '没有等待重建的重置记录');
+                    recordAudit(db, {
+                        actorKind: 'admin',
+                        actorId: 'admin',
+                        action: 'session.reset_cleared',
+                        target: sessionId
+                    }, req);
+                    return json(res, 200, {
+                        ok: true,
+                        value: {
+                            sessionId,
+                            action,
+                            cleared: true
+                        }
+                    });
+                }
+                if (action === 'reset') {
+                    const requested = body.deviceId;
+                    if (requested !== undefined && requested !== null && typeof requested !== 'string') {
+                        throw new SyncError('bad-request', 'deviceId 必须是字符串或 null');
+                    }
+                    if (typeof requested === 'string' && requested !== '') {
+                        const device = db.handle.prepare('SELECT 1 FROM devices WHERE dataset = ? AND device_id = ? AND revoked_at IS NULL').get(DEFAULT_DATASET, requested);
+                        if (device === undefined) throw new SyncError('bad-request', '指定设备不存在或已吊销');
+                    }
+                }
+                if (action === 'archive') {
+                    archiveSession(db, sessionId, createdAt);
+                    recordAudit(db, {
+                        actorKind: 'admin',
+                        actorId: 'admin',
+                        action: 'session.archive',
+                        target: sessionId,
+                        detail: {
+                            createdAt
+                        }
+                    }, req);
+                    return json(res, 200, {
+                        ok: true,
+                        value: {
+                            sessionId,
+                            action,
+                            archived: true
+                        }
+                    });
+                }
+                if (action === 'restore') {
+                    restoreSession(db, sessionId, createdAt);
+                    recordAudit(db, {
+                        actorKind: 'admin',
+                        actorId: 'admin',
+                        action: 'session.restore',
+                        target: sessionId,
+                        detail: {
+                            createdAt
+                        }
+                    }, req);
+                    return json(res, 200, {
+                        ok: true,
+                        value: {
+                            sessionId,
+                            action,
+                            restored: true
+                        }
+                    });
+                }
+                if (action === 'remove') {
+                    const purgedBytes = removeSession(db, options.dataDir, sessionId, createdAt);
+                    recordAudit(db, {
+                        actorKind: 'admin',
+                        actorId: 'admin',
+                        action: 'session.remove',
+                        target: sessionId,
+                        detail: {
+                            createdAt,
+                            purgedBytes
+                        }
+                    }, req);
+                    return json(res, 200, {
+                        ok: true,
+                        value: {
+                            sessionId,
+                            action,
+                            purgedBytes
+                        }
+                    });
+                }
+                const deviceId = typeof body.deviceId === 'string' && body.deviceId !== '' ? body.deviceId : null;
+                const purgedBytes = resetSession(db, options.dataDir, sessionId, createdAt, deviceId);
+                recordAudit(db, {
+                    actorKind: 'admin',
+                    actorId: 'admin',
+                    action: 'session.reset',
+                    target: sessionId,
+                    detail: {
+                        createdAt,
+                        purgedBytes,
+                        deviceId
+                    }
+                }, req);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        sessionId,
+                        action,
+                        purgedBytes,
+                        resetDeviceId: deviceId
+                    }
+                });
+            }
+        },
         {
             method: 'GET',
             path: ME_PATH,