pgkiln 0.63.0 → 0.65.0

package/src/mfa.ts

@@ -94,6 +94,75 @@ export function newRecoveryCode(): string {
 export const normaliseCode = (code: string) => code.toLowerCase().replace(/[^a-z0-9]/g, '');
 export const hashCode = (code: string) => createHash('sha256').update(normaliseCode(code)).digest('hex');
 
+// ---------------------------------------------------------------- where factors are kept
+
+/**
+ * (sprint 130, SEC-3) The tables of one kind of user: developers (128, by user name) or application accounts
+ * (132, by account id). The code checks, recovery codes and the "each step once" rule are the same for both.
+ */
+export interface FactorStore { factors: string; codes: string; key: string }
+export const DEVELOPERS: FactorStore = { factors: 'meta.developer_factor', codes: 'meta.developer_recovery_code', key: 'username' };
+export const ACCOUNTS: FactorStore = { factors: 'meta.account_factor', codes: 'meta.account_recovery_code', key: 'account_id' };
+type Who = string | number;
+
+export async function storeCodesLeft(st: FactorStore, who: Who): Promise<number> {
+  return (await owner.one<{ n: number }>(`select count(*)::int as n from ${st.codes} where ${st.key} = $1 and confirmed and used_at is null`, [who]))!.n;
+}
+
+export async function storeHasFactor(st: FactorStore, who: Who): Promise<boolean> {
+  return !!(await owner.one(`select 1 as ok from ${st.factors} where ${st.key} = $1`, [who]));
+}
+
+export async function storeAddTotp(st: FactorStore, who: Who, name: string, secret: string, step: number) {
+  await owner.query(
+    `insert into ${st.factors} (${st.key}, kind, name, secret_enc, last_step, last_used_at) values ($1, 'totp', $2, $3, $4, now())`,
+    [who, name.trim().slice(0, 60) || 'Authenticator', encryptSecret(secret), step],
+  );
+}
+
+export async function storeNewCodes(st: FactorStore, who: Who): Promise<string[]> {
+  const codes = Array.from({ length: RECOVERY_CODES }, newRecoveryCode);
+  await owner.tx(async (c) => {
+    await c.query(`delete from ${st.codes} where ${st.key} = $1`, [who]);
+    for (const code of codes) await c.query(`insert into ${st.codes} (${st.key}, code_hash) values ($1, $2)`, [who, hashCode(code)]);
+  });
+  return codes;
+}
+
+export async function storeConfirmCodes(st: FactorStore, who: Who) {
+  await owner.query(`update ${st.codes} set confirmed = true where ${st.key} = $1 and used_at is null`, [who]);
+}
+
+/**
+ * Check a second-factor code: an authenticator code (each step once) or a confirmed, unused recovery code
+ * (then used up). Returns what matched, or null.
+ */
+export async function storeCheck(st: FactorStore, who: Who, code: string): Promise<{ kind: 'totp' | 'recovery'; name?: string } | null> {
+  const digits = code.replace(/\s/g, '');
+  if (/^\d{6}$/.test(digits)) {
+    const rows = (await owner.query<{ id: number; name: string; secret_enc: string; last_step: string | null }>(
+      `select id, name, secret_enc, last_step from ${st.factors} where ${st.key} = $1 and kind = 'totp'`, [who])).rows;
+    for (const f of rows) {
+      let secret: Buffer;
+      try {
+        secret = unbase32(decryptSecret(f.secret_enc));
+      } catch {
+        continue; // the instance key changed: recovery codes still work
+      }
+      const step = matchTotp(secret, digits, f.last_step === null ? null : Number(f.last_step));
+      // the update only wins once per step, also with two requests at the same time
+      if (step !== null && (await owner.query(`update ${st.factors} set last_step = $2, last_used_at = now() where id = $1 and (last_step is null or last_step < $2)`, [f.id, step])).rowCount)
+        return { kind: 'totp', name: f.name };
+    }
+    return null;
+  }
+  if (normaliseCode(code).length !== 10) return null;
+  const used = await owner.query(
+    `update ${st.codes} set used_at = now() where ${st.key} = $1 and code_hash = $2 and confirmed and used_at is null`,
+    [who, hashCode(code)]);
+  return used.rowCount ? { kind: 'recovery' } : null;
+}
+
 // ---------------------------------------------------------------- the developer's factors
 
 export interface Factor { id: number; kind: 'totp' | 'passkey'; name: string; created_at: string; last_used_at: string | null; rp_id: string | null }
@@ -103,44 +172,45 @@ export async function factorsOf(username: string, db: Pick<pg.ClientBase, 'query
 }
 
 /** Recovery codes left (confirmed, unused). */
-export async function codesLeft(username: string): Promise<number> {
-  return (await owner.one<{ n: number }>('select count(*)::int as n from meta.developer_recovery_code where username = $1 and confirmed and used_at is null', [username]))!.n;
-}
+export const codesLeft = (username: string) => storeCodesLeft(DEVELOPERS, username);
 
 /** Whether the developer has a working second factor (an authenticator app; recovery codes back it up). */
-export async function hasFactor(username: string): Promise<boolean> {
-  return !!(await owner.one('select 1 as ok from meta.developer_factor where username = $1', [username]));
-}
+export const hasFactor = (username: string) => storeHasFactor(DEVELOPERS, username);
 
 /** Add an authenticator app (after the developer confirmed a code from it). */
-export async function addTotp(username: string, name: string, secret: string, step: number) {
-  await owner.query(
-    `insert into meta.developer_factor (username, kind, name, secret_enc, last_step, last_used_at) values ($1, 'totp', $2, $3, $4, now())`,
-    [username, name.trim().slice(0, 60) || 'Authenticator', encryptSecret(secret), step],
-  );
-}
+export const addTotp = (username: string, name: string, secret: string, step: number) => storeAddTotp(DEVELOPERS, username, name, secret, step);
 
 // ---------------------------------------------------------------- passkeys (sprint 127)
 
 export interface Passkey { id: number; name: string; credential_id: string; public_key: Record<string, string>; alg: number; sign_count: string; transports: string[] }
 
 /** Add a passkey (after src/webauthn.ts checked the browser's answer). */
-export async function addPasskey(username: string, name: string, p: { credentialId: string; jwk: Record<string, string>; alg: number; signCount: number; rpId: string; transports: string[] }) {
+export async function storeAddPasskey(st: FactorStore, who: Who, name: string, p: { credentialId: string; jwk: Record<string, string>; alg: number; signCount: number; rpId: string; transports: string[] }) {
   await owner.query(
-    `insert into meta.developer_factor (username, kind, name, credential_id, public_key, alg, sign_count, rp_id, transports, last_used_at)
+    `insert into ${st.factors} (${st.key}, kind, name, credential_id, public_key, alg, sign_count, rp_id, transports, last_used_at)
      values ($1, 'passkey', $2, $3, $4, $5, $6, $7, $8, now())`,
-    [username, name.trim().slice(0, 60) || 'Passkey', p.credentialId, JSON.stringify(p.jwk), p.alg, p.signCount, p.rpId,
+    [who, name.trim().slice(0, 60) || 'Passkey', p.credentialId, JSON.stringify(p.jwk), p.alg, p.signCount, p.rpId,
      p.transports.filter((t) => /^[a-z-]{1,20}$/.test(t)).slice(0, 8)],
   );
 }
 
-/** The developer's passkeys for this relying party (a passkey only works on the domain it was made for). */
-export async function passkeysOf(username: string, rpId: string): Promise<Passkey[]> {
+/** The passkeys for this relying party (a passkey only works on the domain it was made for). */
+export async function storePasskeys(st: FactorStore, who: Who, rpId: string): Promise<Passkey[]> {
   return (await owner.query<Passkey>(
-    `select id, name, credential_id, public_key, alg, sign_count, transports from meta.developer_factor
-      where username = $1 and kind = 'passkey' and rp_id = $2 order by id`, [username, rpId])).rows;
+    `select id, name, credential_id, public_key, alg, sign_count, transports from ${st.factors}
+      where ${st.key} = $1 and kind = 'passkey' and rp_id = $2 order by id`, [who, rpId])).rows;
 }
 
+/** Record a sign-in with a passkey; false when another sign-in moved the counter first (a replay or a clone). */
+export async function storeUsePasskey(st: FactorStore, id: number, oldCount: string, newCount: number): Promise<boolean> {
+  return !!(await owner.query(
+    `update ${st.factors} set sign_count = $3, last_used_at = now() where id = $1 and sign_count = $2::bigint`,
+    [id, oldCount, newCount])).rowCount;
+}
+
+export const addPasskey = (username: string, name: string, p: Parameters<typeof storeAddPasskey>[3]) => storeAddPasskey(DEVELOPERS, username, name, p);
+export const passkeysOf = (username: string, rpId: string) => storePasskeys(DEVELOPERS, username, rpId);
+
 /** (sprint 128) The passkey with this credential id for this relying party, and whose it is (sign-in without a user name). */
 export async function passkeyByCredential(credentialId: string, rpId: string): Promise<(Passkey & { username: string }) | null> {
   if (!credentialId || credentialId.length > 1400) return null;
@@ -161,12 +231,7 @@ export async function setPasskeySignin(on: boolean) {
   await owner.query(`insert into meta.setting (name, value) values ('mfa_passkey_signin', $1) on conflict (name) do update set value = excluded.value`, [on ? 'on' : 'off']);
 }
 
-/** Record a sign-in with a passkey; false when another sign-in moved the counter first (a replay or a clone). */
-export async function usePasskey(id: number, oldCount: string, newCount: number): Promise<boolean> {
-  return !!(await owner.query(
-    'update meta.developer_factor set sign_count = $3, last_used_at = now() where id = $1 and sign_count = $2::bigint',
-    [id, oldCount, newCount])).rowCount;
-}
+export const usePasskey = (id: number, oldCount: string, newCount: number) => storeUsePasskey(DEVELOPERS, id, oldCount, newCount);
 
 // ---------------------------------------------------------------- trusted browsers (sprint 127)
 
@@ -211,48 +276,12 @@ export async function forgetBrowsers(username: string) {
 }
 
 /** New recovery codes (the old ones stop working); shown once, counted only when confirmed. */
-export async function newRecoveryCodes(username: string): Promise<string[]> {
-  const codes = Array.from({ length: RECOVERY_CODES }, newRecoveryCode);
-  await owner.tx(async (c) => {
-    await c.query('delete from meta.developer_recovery_code where username = $1', [username]);
-    for (const code of codes) await c.query('insert into meta.developer_recovery_code (username, code_hash) values ($1, $2)', [username, hashCode(code)]);
-  });
-  return codes;
-}
+export const newRecoveryCodes = (username: string) => storeNewCodes(DEVELOPERS, username);
 
-export async function confirmRecoveryCodes(username: string) {
-  await owner.query('update meta.developer_recovery_code set confirmed = true where username = $1 and used_at is null', [username]);
-}
+export const confirmRecoveryCodes = (username: string) => storeConfirmCodes(DEVELOPERS, username);
 
-/**
- * Check a second-factor code at sign-in: an authenticator code (each step once) or a confirmed, unused
- * recovery code (then used up). Returns what matched, or null.
- */
-export async function checkSecondFactor(username: string, code: string): Promise<{ kind: 'totp' | 'recovery'; name?: string } | null> {
-  const digits = code.replace(/\s/g, '');
-  if (/^\d{6}$/.test(digits)) {
-    const rows = (await owner.query<{ id: number; name: string; secret_enc: string; last_step: string | null }>(
-      'select id, name, secret_enc, last_step from meta.developer_factor where username = $1 and kind = $2', [username, 'totp'])).rows;
-    for (const f of rows) {
-      let secret: Buffer;
-      try {
-        secret = unbase32(decryptSecret(f.secret_enc));
-      } catch {
-        continue; // the instance key changed: recovery codes still work
-      }
-      const step = matchTotp(secret, digits, f.last_step === null ? null : Number(f.last_step));
-      // the update only wins once per step, also with two requests at the same time
-      if (step !== null && (await owner.query('update meta.developer_factor set last_step = $2, last_used_at = now() where id = $1 and (last_step is null or last_step < $2)', [f.id, step])).rowCount)
-        return { kind: 'totp', name: f.name };
-    }
-    return null;
-  }
-  if (normaliseCode(code).length !== 10) return null;
-  const used = await owner.query(
-    'update meta.developer_recovery_code set used_at = now() where username = $1 and code_hash = $2 and confirmed and used_at is null',
-    [username, hashCode(code)]);
-  return used.rowCount ? { kind: 'recovery' } : null;
-}
+/** Check a developer's second-factor code at sign-in (see storeCheck). */
+export const checkSecondFactor = (username: string, code: string) => storeCheck(DEVELOPERS, username, code);
 
 // ---------------------------------------------------------------- policy
 

package/src/remember.ts

@@ -56,7 +56,7 @@ export async function useRemember(req: FastifyRequest, reply: FastifyReply, a: R
   );
   if (!row || !row.active) return clear(), null;
   // an expired password needs the password form; access may have been withdrawn
-  if (row.method === 'password' && (await passwordDaysLeft(row.username)) === 0) return clear(), null;
+  if (row.method.split('+')[0] === 'password' && (await passwordDaysLeft(row.username)) === 0) return clear(), null;
   const access = await ssoAccess(a.id, row.username, row.groups);
   if (!access.allowed) return clear(), null;
   return { username: row.username, roles: access.roles, groups: row.groups, method: row.method, expiresAt: new Date(row.expires_at) };

package/src/runtime/account.ts

@@ -12,11 +12,15 @@ import { chrome, clientTexts } from './render.ts';
 import { appStyles, choosable, chosenStyleName, styleChoice } from './styles.ts';
 import { loadApp } from '../metadata.ts';
 import { pushSection } from './push.ts';
+import { relyingParty } from '../webauthn.ts';
+import { tokenSection, twoStepSection } from './two-step.ts';
 import { appWithLocale, loadContext, safeNext, txContext, type Req } from './routes.ts';
 
 // "My account": details, own password, and preferences (light/dark and
 // language). APEX has the APIs for this (APEX_UTIL.CHANGE_CURRENT_USER_PW,
-// theme style per user); pgkiln provides the page itself.
+// theme style per user); pgkiln provides the page itself. (sprint 130)
+// Two-step sign-in: authenticator apps and recovery codes (two-step.ts). (sprint 131) Passkeys, and a REST API
+// token the user creates (when the application allows it).
 
 /** Keep a signed-in user's style variant for this app (meta.account_style; '' = the base colours). */
 async function saveStyle(appId: number, username: string, style: string) {
@@ -115,6 +119,8 @@ async function accountPage(ctx: PageContext, reply: FastifyReply, error?: string
               <form method="post" action="${ctx.base}/account/devices">${csrf}<button class="btn">${t('account.forget_devices')}</button></form>
             </div></section>`
           : ''}
+        ${await twoStepSection(ctx, relyingParty(reply.request).rpId)}
+        ${await tokenSection(ctx)}
         ${await pushSection(ctx)}
       </div>
     </div>

package/src/runtime/authz.ts

@@ -1,10 +1,14 @@
+import { secondStepWithin } from '../account-mfa.ts';
 import { applyBinds } from '../binds.ts';
+import type { AuthzScheme } from '../metadata.ts';
 import { savepoint } from '../db.ts';
 import { bindValues, publicError, stripSemicolon, type PageContext, type Visibility } from './context.ts';
 import { saveButton, saveRequest } from './grid.ts';
 import { selectionOf } from './report.ts';
 
 export class Forbidden extends Error {}
+/** (sprint 131) The page needs a second step more recent than the session's: ask for one, then come back. */
+export class StepUp extends Forbidden {}
 
 /**
  * Evaluate an authorization reference ("ADMIN", "!ADMIN", or the built-in
@@ -20,15 +24,28 @@ export async function isAuthorized(ctx: PageContext, ref: string | null | undefi
     if (name === 'MUST_NOT_BE_PUBLIC_USER') ok = ctx.user !== 'nobody';
     else {
       const scheme = ctx.app.authz_schemes.find((s) => s.name === name);
-      if (!scheme) ok = false;
-      else if (scheme.type === 'role') ok = ctx.roles.includes(scheme.value.toLowerCase());
-      else ok = await sqlTrue(ctx, scheme.value, `authorization ${name}`);
+      ok = !!scheme && (await schemePasses(ctx, scheme)) && (!scheme.mfa_minutes || secondStepWithin(ctx.session?.state ?? {}, scheme.mfa_minutes));
     }
     ctx.authzCache.set(name, ok);
   }
   return negate ? !ok : ok;
 }
 
+async function schemePasses(ctx: PageContext, scheme: AuthzScheme): Promise<boolean> {
+  if (scheme.type === 'role') return ctx.roles.includes(scheme.value.toLowerCase());
+  return sqlTrue(ctx, scheme.value, `authorization ${scheme.name}`);
+}
+
+/**
+ * (sprint 131) Whether a reference fails only for its step-up: a scheme with mfa_minutes that the user passes, in a
+ * session whose last second step is too old (or never happened).
+ */
+export async function onlyStepUpMissing(ctx: PageContext, ref: string | null | undefined): Promise<boolean> {
+  if (!ref || ref.startsWith('!') || ctx.user === 'nobody') return false;
+  const scheme = ctx.app.authz_schemes.find((s) => s.name === ref.trim().toUpperCase());
+  return !!scheme?.mfa_minutes && !secondStepWithin(ctx.session?.state ?? {}, scheme.mfa_minutes) && (await schemePasses(ctx, scheme));
+}
+
 /**
  * Evaluate a SQL boolean expression with binds. Errors yield `onError`
  * (false by default: a broken condition hides a region or button).
@@ -51,7 +68,9 @@ export function authzMessage(ctx: PageContext, ref: string | null) {
 }
 
 export async function checkPageAccess(ctx: PageContext) {
-  if (!(await isAuthorized(ctx, ctx.page.authz))) throw new Forbidden(authzMessage(ctx, ctx.page.authz));
+  if (await isAuthorized(ctx, ctx.page.authz)) return;
+  if (await onlyStepUpMissing(ctx, ctx.page.authz)) throw new StepUp(authzMessage(ctx, ctx.page.authz));
+  throw new Forbidden(authzMessage(ctx, ctx.page.authz));
 }
 
 /** Can the current user open this page? Used to hide links and menu entries. */

package/src/runtime/routes.ts

@@ -18,7 +18,7 @@ import { english, type Translate } from '../i18n.ts';
 import { checksumValid, loginWindowMinutes, urlChecksum } from '../security.ts';
 import { builderSsoFinish, enabledProviders, finishSignIn, loadProvider, ssoAccess, SsoError, startSignIn, type Provider, type SsoResult } from '../sso.ts';
 import { sessionLimits, clientIp, createSession, destroySession, getSession, loginThrottled, logActivity, saveState, takeFlash, type Session } from '../session.ts';
-import { checkPageAccess, computeVisibility, Forbidden, isAuthorized } from './authz.ts';
+import { checkPageAccess, computeVisibility, Forbidden, isAuthorized, StepUp } from './authz.ts';
 import { bindValues, dbg, publicError, stripSemicolon, timed, toState, writeOut, type PageContext } from './context.ts';
 import { startDebug } from '../debug.ts';
 import { assignable, clearPageItems, fetchForms, processConditionHolds, ProcessFailed, runAppProcesses, runProcesses, runSql, validate, ValidationFailed } from './engine.ts';
@@ -48,6 +48,8 @@ import { resolveLocale, THEME_COOKIE, themeCookieOptions, translateApp, translat
 import { chrome, dialogClosePage, languagePicker, renderPage } from './render.ts';
 import { LOGIN_ERROR, LOGIN_USER, safeNext, signInForm } from './signin.ts';
 import { passwordResetRoutes } from './password-reset.ts';
+import { passwordSignIn, twoStepRoutes } from './two-step.ts';
+import { carriesSecondStep } from '../account-mfa.ts';
 import { devbarOf, devbarRoutes, sessionDebugLevel } from './devbar.ts';
 import { availabilityRefusal } from './availability.ts';
 import { feedbackRoutes } from './feedback.ts';
@@ -229,7 +231,8 @@ export async function loadContext(req: Req, reply: FastifyReply, { json = false,
   // the session ended, but the browser was remembered: sign in again silently (a new token each time)
   if (app.authentication === 'app_users' && !session.username) {
     const remembered = await useRemember(req, reply, app);
-    if (remembered)
+    // (sprint 130) one made before the application asked this user for a second step doesn't stand in for it
+    if (remembered && (await carriesSecondStep(app, remembered.username, remembered.roles, remembered.method)))
       session = await signIn(req, reply, app, session, remembered.username, {
         extraRoles: remembered.roles, groups: remembered.groups, method: remembered.method,
         remember: true, rememberUntil: remembered.expiresAt, detail: 'remember me',
@@ -238,7 +241,7 @@ export async function loadContext(req: Req, reply: FastifyReply, { json = false,
   // (067) another application of the session sharing group was signed in to: sign in here too
   if (!session.username && sharingGroup(app)) {
     const shared = await useShared(req, reply, app);
-    if (shared)
+    if (shared && (await carriesSecondStep(app, shared.username, shared.roles, shared.method)))
       session = await signIn(req, reply, app, session, shared.username, {
         extraRoles: shared.roles, groups: shared.groups, method: shared.method, shared: shared.hash, detail: 'shared sign-in',
       });
@@ -313,6 +316,13 @@ export async function loadContext(req: Req, reply: FastifyReply, { json = false,
   };
 }
 
+/** (sprint 131) Step-up: the page's authorization needs a recent second step; ask for it, then come back. */
+async function stepUp(ctx: PageContext, reply: FastifyReply, next: string) {
+  dbg(ctx, 2, 'access', `step-up: a second step is needed for page ${ctx.page.page_no}`);
+  await saveState(ctx.session);
+  return reply.redirect(`${ctx.base}/login/2fa?next=${encodeURIComponent(next)}`, 303);
+}
+
 async function forbidden(ctx: PageContext, reply: FastifyReply, message: string, detail: string) {
   dbg(ctx, 2, 'access', `refused (403): ${detail}`);
   logActivity({ appId: ctx.app.id, pageNo: ctx.page.page_no, username: ctx.user, event: 'forbidden', ip: ctx.ip, detail });
@@ -484,6 +494,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
         return { html: await timed(ctx, 4, 'page', 'render page', () => renderPage(ctx)) };
       });
     } catch (e) {
+      if (e instanceof StepUp) return stepUp(ctx, reply, req.url);
       if (e instanceof Forbidden) return forbidden(ctx, reply, e.message, `page ${ctx.page.page_no}`);
       throw e;
     }
@@ -580,6 +591,8 @@ export async function runtimeRoutes(app: FastifyInstance) {
         return pressed;
       });
     } catch (e) {
+      // the second step expired while the page was open: ask again, then back to the page (the input is lost)
+      if (e instanceof StepUp) return stepUp(ctx, reply, `${ctx.base}/${ctx.page.page_no}`);
       if (e instanceof Forbidden) return forbidden(ctx, reply, e.message, `forged or unavailable request "${body.__request}" on page ${ctx.page.page_no}`);
       if (e instanceof ValidationFailed) {
         ctx.errors = e.errors;
@@ -619,6 +632,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
   fileRoutes(app, loadContext, txContext, forbidden);
   // (087) "Forgot password?"
   passwordResetRoutes(app);
+  twoStepRoutes(app);
   // (079) the developer toolbar's session state viewer and actions
   devbarRoutes(app, loadContext);
   // (084) users' feedback
@@ -1272,7 +1286,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
           logActivity({ appId: a.id, username: account, event: 'login_failed', ip, detail: `ldap:${d.name}: no access` });
           return fail(locale.t('login.no_access', { user: account, app: a.name }), 403);
         }
-        return completeLogin(req, reply, a, session, account, {
+        return passwordSignIn(req, reply, a, session, account, {
           next, remember, extraRoles: access.roles, groups: user.groups, method: `ldap:${d.name}`, detail: `ldap:${d.name}`,
         });
       }
@@ -1283,7 +1297,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
       logActivity({ appId: a.id, username: r.username, event: 'password_expired', ip });
       return reply.type('text/html').send(expiredPage(a, locale, session, r.username, safeNext(a, next)));
     }
-    return completeLogin(req, reply, a, session, r.username, { next, remember });
+    return passwordSignIn(req, reply, a, session, r.username, { next, remember });
   });
 
   app.post('/a/:alias/password', async (req: Req, reply) => {
@@ -1309,7 +1323,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
     }
     logActivity({ appId: a.id, username, event: 'password_changed', ip });
     const canonical = (await runtime.one<{ username: string }>('select username from meta.account where lower(username) = lower($1)', [username]))!.username;
-    return completeLogin(req, reply, a, session, canonical, { next });
+    return passwordSignIn(req, reply, a, session, canonical, { next });
   });
 
   // ---------------------------------------------------------------- single sign-on (OpenID Connect)
@@ -1374,7 +1388,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
       return simplePage(reply, 403, locale.t('login.no_access_title'), locale.t('login.no_access', { user: result.username, app: a.name }), `/a/${a.alias}/login`, locale);
     }
     const session = await getSession(req, reply, a.id, `/a/${a.alias}`);
-    return completeLogin(req, reply, a, session, result.username, { extraRoles: access.roles, next: result.next ?? undefined, detail: `sso:${p.name}` });
+    return completeLogin(req, reply, a, session, result.username, { extraRoles: access.roles, next: result.next ?? undefined, method: `sso:${p.name}`, detail: `sso:${p.name}` });
   };
 
   // SAML: the IdP posts the response cross-site, where SameSite=Lax cookies aren't sent; post it on