Fix CI cross-platform issues, release log gate, and test dependencies (#384)

## Summary by Sourcery

Implement admin step-up MFA with backend middleware, session tracking,
and a shared frontend modal flow, introduce saver modes and
data-saver-aware endpoints, add durable upload backups, and tighten UI
layout, security, and CI workflows.

New Features:
- Add step-up MFA flow backed by session mfaVerifiedAt, dedicated auth
endpoints, and a reusable frontend modal/provider so privileged admin
actions can require recent 2FA verification.
- Introduce Data Saver and Battery Saver modes with user preferences,
global hooks, and a new settings tab, enabling lighter API responses and
reduced animations for opted-in users.
- Extend the StudyHub video player with watch-progress persistence, A-B
loop controls, and a keyboard shortcut help overlay for study-focused
playback.
- Add a daily backup job that mirrors the uploads volume to Cloudflare
R2 plus a restore script to recover user-uploaded media after volume
loss.

Bug Fixes:
- Fix admin login MFA flag handling to fail closed on missing/errored
flags and support a clearly logged emergency override, preventing silent
MFA bypass.
- Ensure saver-mode preferences are included in authenticated session
payloads so global hooks honor server-side settings across devices.
- Prevent upload path traversal issues on Windows by hardening managed
filename validation against path separators.
- Resolve spacing and layout inconsistencies (sticky offsets, grids,
skeletons, sidebars, inputs) that caused visible jitter and clipping
across key pages.

Enhancements:
- Add requireRecentMfa middleware and apply it to high-risk admin and
payment routes, with comprehensive unit tests and an emergency bypass
log trail.
- Expose WebAuthn credential last-used timestamps and enrich MFA-related
logging to support better security visibility.
- Refine moderation and admin handlers with stricter ID validation,
origin allowlisting, and safer pagination, aligning with documented
security rules.
- Migrate several bespoke modals (reports, legal enforcement, attachment
preview, AI sheet preview, confirm dialog) onto the shared focus-trapped
dialog primitive for consistent accessibility.
- Standardize layout tokens for nav height and spacing, update sticky
offsets and page scaffolds to use them, and improve mobile behavior via
dvh usage and safe-area insets.
- Adjust toast durations under battery saver and integrate data-saver
awareness into feed and messaging flows to reduce bandwidth and
background chatter.
- Tighten R2 helper APIs to support per-bucket operations, streaming
uploads with explicit content length, and configurable backup cadence
and rate limits.

Build:
- Relax CI release-log enforcement for bot-authored and lockfile-only
PRs while narrowing the code-change scope, keeping the human-facing log
gate for functional changes.
- Update production-mode test fixtures to auto-populate all required
secrets and keep security-header tests resilient to new required env
vars.

CI:
- Stop running Android and CodeQL workflows on every pull request,
limiting them to main, tags, schedule, or manual runs to reduce
unnecessary CI usage.

Tests:
- Add focused unit tests for step-up MFA middleware, recovery code
primitives, WebAuthn routes, data-saver negotiation, and admin MFA
fail-closed behavior.
- Update existing tests and skips to reflect the new role-picker, AI
permission, and prefetch mappings while preserving coverage where
behavior is unchanged.

Author: Apexone11

backend/src/modules/webauthn/webauthn.routes.js

@@ -2,7 +2,7 @@ const express = require('express')
 const requireAuth = require('../../middleware/auth')
 const requireAdmin = require('../../middleware/requireAdmin')
 const { captureError } = require('../../monitoring/sentry')
-const { signAuthToken, setAuthCookie } = require('../../lib/authTokens')
+const { issueAuthenticatedSession } = require('../auth/auth.service')
 const {
   generateRegistrationOptions,
   verifyRegistration,
@@ -174,18 +174,29 @@ router.post('/authenticate/verify', webauthnLimiter, async (req, res) => {
       data: { counter: result.newCounter, lastUsedAt: new Date() },
     })
 
-    // Issue session
-    const fullUser = await prisma.user.findUnique({
-      where: { id: user.id },
-      select: { id: true, username: true, role: true },
+    // Issue session via the canonical login helper — mirrors
+    // login.challenge.controller + login.recovery.controller. The previous
+    // hand-rolled `signAuthToken + setAuthCookie` path bypassed Session
+    // row creation, so the JWT carried no `jti` and requireAuth left
+    // `req.sessionJti` undefined. With the wave-12.11 fail-closed
+    // `requireRecentMfa` middleware, every passkey-authed admin then hit
+    // `MFA_STEP_UP_REQUIRED { reason: 'no_session' }` on PATCH role /
+    // trust-level / mfa, DELETE user, and the Stripe sync route, and the
+    // step-up /verify endpoint 401'd because there was no session row to
+    // refresh — admins were locked out of every gated route via passkey
+    // login (wave-12.15 fix from a Codex P1 finding).
+    //
+    // Passkey is an explicit AAL2 factor per NIST 800-63B ("something you
+    // have"), so passing `mfaVerified: true` stamps `Session.mfaVerifiedAt`
+    // at creation and `requireRecentMfa` permits the next 15 minutes
+    // without a separate step-up prompt.
+    const authenticatedUser = await issueAuthenticatedSession(res, user.id, req, null, {
+      mfaVerified: true,
     })
 
-    const token = signAuthToken(fullUser)
-    setAuthCookie(res, token)
-
     res.json({
       message: 'Login successful!',
-      user: { id: fullUser.id, username: fullUser.username, role: fullUser.role },
+      user: authenticatedUser,
     })
   } catch (error) {
     captureError(error, { route: req.originalUrl, method: req.method })

backend/test/unit/webauthn-routes.unit.test.js

@@ -48,11 +48,19 @@ const mocks = vi.hoisted(() => {
       }
       next()
     }),
-    authTokens: {
-      signAuthToken: vi.fn(() => 'signed-token-xyz'),
-      setAuthCookie: vi.fn((res) => res),
-      getAuthTokenFromRequest: vi.fn(() => null),
-      verifyAuthToken: vi.fn(),
+    authService: {
+      // wave-12.15 — passkey verify now delegates to the canonical
+      // login helper so a real Session row is created with the JWT
+      // carrying a `jti`. Mock returns the authenticated-user payload
+      // shape that the helper produces (id, username, role, csrfToken,
+      // counts, preferences, etc.) so the route handler's `res.json`
+      // sees a realistic body.
+      issueAuthenticatedSession: vi.fn(async () => ({
+        id: 1,
+        username: 'admin_user',
+        role: 'admin',
+        csrfToken: 'csrf-token-xyz',
+      })),
     },
     sentry: {
       captureError: vi.fn(),
@@ -67,7 +75,7 @@ const mockTargets = new Map([
   [require.resolve('../../src/lib/prisma'), mocks.prisma],
   [require.resolve('../../src/middleware/auth'), mocks.requireAuth],
   [require.resolve('../../src/middleware/requireAdmin'), mocks.requireAdmin],
-  [require.resolve('../../src/lib/authTokens'), mocks.authTokens],
+  [require.resolve('../../src/modules/auth/auth.service'), mocks.authService],
   [require.resolve('../../src/monitoring/sentry'), mocks.sentry],
   [require.resolve('../../src/lib/rateLimiters'), mocks.rateLimiters],
   [require.resolve('../../src/lib/webauthn/webauthn'), mocks.webauthnLib],
@@ -301,10 +309,12 @@ describe('POST /api/webauthn/authenticate/verify', () => {
     username: 'admin_user',
   }
 
-  it('updates counter, issues session, and returns user on success', async () => {
-    mocks.prisma.user.findUnique
-      .mockResolvedValueOnce({ id: 1, username: 'admin_user', role: 'admin' })
-      .mockResolvedValueOnce({ id: 1, username: 'admin_user', role: 'admin' })
+  it('updates counter, issues session via the canonical helper, and returns user on success', async () => {
+    mocks.prisma.user.findUnique.mockResolvedValueOnce({
+      id: 1,
+      username: 'admin_user',
+      role: 'admin',
+    })
     mocks.prisma.webAuthnCredential.findUnique.mockResolvedValue({
       id: 10,
       userId: 1,
@@ -319,15 +329,24 @@ describe('POST /api/webauthn/authenticate/verify', () => {
       message: expect.stringMatching(/successful/i),
       user: { id: 1, username: 'admin_user', role: 'admin' },
     })
-    // wave-12.11 — verify now also stamps lastUsedAt for admin-portal
-    // visibility. The Date is freshly constructed inside the handler
-    // so we assert shape, not exact value.
+    // wave-12.11 — verify also stamps lastUsedAt for admin-portal visibility.
     expect(mocks.prisma.webAuthnCredential.update).toHaveBeenCalledWith({
       where: { id: 10 },
       data: { counter: 5, lastUsedAt: expect.any(Date) },
     })
-    expect(mocks.authTokens.signAuthToken).toHaveBeenCalledTimes(1)
-    expect(mocks.authTokens.setAuthCookie).toHaveBeenCalledTimes(1)
+    // wave-12.15 — must go through issueAuthenticatedSession (creates a
+    // real Session row + JWT with `jti`) so the wave-12.11 fail-closed
+    // requireRecentMfa middleware doesn't lock passkey-authed admins out
+    // of step-up-gated routes. mfaVerified:true stamps Session.mfaVerifiedAt
+    // because passkey is an AAL2 factor per NIST 800-63B.
+    expect(mocks.authService.issueAuthenticatedSession).toHaveBeenCalledTimes(1)
+    expect(mocks.authService.issueAuthenticatedSession).toHaveBeenCalledWith(
+      expect.anything(), // res
+      1, // userId
+      expect.anything(), // req
+      null, // preComputed risk
+      { mfaVerified: true },
+    )
   })
 
   it('returns 401 when the WebAuthn library reports a counter/replay failure', async () => {
@@ -347,7 +366,9 @@ describe('POST /api/webauthn/authenticate/verify', () => {
 
     expect(res.status).toBe(401)
     expect(mocks.prisma.webAuthnCredential.update).not.toHaveBeenCalled()
-    expect(mocks.authTokens.signAuthToken).not.toHaveBeenCalled()
+    // wave-12.15 — failed auth must NOT create a session; the new
+    // issueAuthenticatedSession path stays unreached on counter/replay.
+    expect(mocks.authService.issueAuthenticatedSession).not.toHaveBeenCalled()
   })
 
   it('returns 401 when the resolved user is not an admin', async () => {

docs/release-log.md

@@ -28,6 +28,63 @@ internal log into this file when they describe user-visible behavior.
 
 ## v2.2.0 — public launch ship (2026-04-30)
 
+### Wave-12.15 — Codex P1 + P2 fixes on wave-12.11 / 12.13 (2026-05-28)
+
+Two real findings from a Codex review pass on `3b09f25a`. Both verified against actual code by our own audit loop (CLAUDE.md A21) before fixing.
+
+**P1 (CRITICAL) — Passkey login bypassed `createSession`; admins locked out of step-up-MFA-gated routes.**
+
+`POST /api/webauthn/authenticate/verify` was hand-rolling its own session emission (`signAuthToken(fullUser) + setAuthCookie(res, token)`) instead of going through `issueAuthenticatedSession`. The wave-12.11 `requireRecentMfa` middleware checks `req.sessionJti` (populated by `requireAuth` only when the JWT carries a `jti`, which is set only by `createSession`). Net effect:
+
+- Passkey-authed admins → JWT carries no `jti` → `req.sessionJti` undefined.
+- Every step-up-gated admin route (`DELETE /api/admin/users/:id`, `PATCH /api/admin/users/:id/{role,trust-level,mfa}`, `POST /api/payments/admin/sync-stripe`) rejected with `MFA_STEP_UP_REQUIRED { reason: 'no_session' }`.
+- The step-up modal's `POST /api/auth/mfa/step-up/verify` then 401'd with `'No active session to refresh.'` because there was no Session row to update.
+- Net: passkey admins could not perform ANY of the 5 protected admin actions. They had to log out and re-login via email-OTP.
+
+Fix: webauthn verify now calls `issueAuthenticatedSession(res, user.id, req, null, { mfaVerified: true })` — mirrors `login.challenge.controller` and `login.recovery.controller`. Passkey is an explicit AAL2 factor per NIST 800-63B ("something you have"), so `mfaVerified: true` is correct: the new Session row's `mfaVerifiedAt` is stamped at creation, and `requireRecentMfa` permits step-up-gated routes for the next 15 minutes without re-prompting.
+
+Updated `backend/test/unit/webauthn-routes.unit.test.js` to mock the canonical helper (`mocks.authService.issueAuthenticatedSession`) and assert it's called with `{ mfaVerified: true }` on the success path AND NOT called on counter/replay-failure paths. 21/21 tests pass.
+
+**P2 (HIGH) — Saver-mode Settings toggle silently did nothing on the current session.**
+
+The wave-12.13 fix had `DataAndBatteryTab` seeding localStorage after save, but the consumers (`SaverModeInitializer`, `useFeedData`, `useMessagingData`) all read `useDataSaver({ serverMode: sessionUser?.preferences?.dataSaverMode })`. The hooks' precedence is `serverMode || readStoredMode()` — `serverMode` wins as long as session-context holds the old value. Since `usePreferences().save()` only updated its own local React state, `sessionUser` was stale until the next `/api/auth/me` round-trip. The body `[data-battery-saver]` attribute stayed off, Feed/Messages didn't switch to lite mode, and the user thought the toggle was broken.
+
+Fix: `usePreferences().save()` now pulls `setSessionUser` from `useSession()` and pushes the persisted prefs back into session-context after the merge. Every consumer of `user?.preferences` re-derives synchronously on next render — no event plumbing, no `storage` listener (which only fires cross-tab anyway), no hook precedence change. Matches CLAUDE.md A4 ("hydrate UI from the response body's persisted value"). The `DataAndBatteryTab`'s explicit `setStored*` calls stay as belt-and-suspenders (idempotent — the hooks' `serverMode` effect would write the same value to localStorage).
+
+**Files changed:** `backend/src/modules/webauthn/webauthn.routes.js`, `backend/test/unit/webauthn-routes.unit.test.js`, `frontend/studyhub-app/src/pages/settings/settingsState.js`.
+
+Validation: backend lint clean, frontend lint 0 errors (91 warnings = baseline), frontend build green, webauthn 21/21 unit tests pass.
+
+### Wave-12.14 — Spacing / chrome token pass + wave 12.11-12.13 production readiness verification (2026-05-28)
+
+Founder asked for a "fix the spacing everywhere + confirm everything we shipped is production-ready" pass. Two parallel audits:
+
+**Feature audit (wave 12.11-12.13) — clean.** All 11 features from `d1a3abe0` / `e9fc07e6` / `e80214b4` verified end-to-end: admin step-up MFA (`requireRecentMfa` on 5 routes + frontend interceptor + step-up modal + 12/12 unit tests), `WebAuthnCredential.lastUsedAt`, `serializeNote` allowlist (incl. wave-12.13 `revision` re-add), upload volume → R2 backup (`runWithHeartbeat`-wrapped, streamed-not-buffered, `R2_BUCKET_UPLOAD_BACKUP` REQUIRED_IN_PRODUCTION), Data Saver + Battery Saver modes (`useDataSaver` / `useBatterySaver` exports `setStored*` helpers, `SaverModeInitializer` mounted in `App.jsx`, server-side `dataSaverNegotiation` 3-signal contract, 11/11 unit tests), StudyHubPlayer (watch-progress persistence, A-B loop, `?` keyboard help overlay), feed lite mode (`?lite=1`), typing-indicator suppression, battery-saver JS gates in `animations.js` + `Toast.jsx`, session-payload preferences. CLAUDE.md A-rules A5/A6/A7/A8/A10/A11/A12/A13/A14/A16 all clean. 60/60 wave-12 unit tests pass. Nothing to finish.
+
+**Spacing / chrome pass — fixed.** A spacing audit found ~50 visual drifts; the screenshot-visible one was `.feed-page__aside { top: 86px }` floating ~30px below the actual 56px navbar. Foundation tokens added in `index.css` `:root`: `--sh-nav-h: 56px` (single source of truth for sticky offsets) and `--sh-space-xs/sm/md/lg/xl/2xl/3xl` (CANONICAL 4/8/12/16/20/24/32 step aliases — mapped to existing `--space-*` so old call sites keep working). Then migrated the worst drifts:
+
+- **Sticky offsets** — `.feed-page__aside`, `.settings-nav`, `PageShell` sidebar, `AiPage` sidebar all now compute `top` from `var(--sh-nav-h)`. No more 74 / 80 / 86px guesses.
+- **Split-panel height** — `.notes-split-panel` / `.messages-split-panel` switched from `calc(100vh - 80)` to `calc(100dvh - var(--sh-nav-h))` with `100vh` fallback so mobile Safari's URL bar doesn't clip the bottom of the panel.
+- **Grid gaps** — `.app-three-col-grid` (22 → 20), `.app-two-col-grid` (20), `.profile-cockpit` (20) all on `--sh-space-xl`. Navigating Feed ↔ Sheets ↔ Profile no longer shifts the column gutter.
+- **Duplicate `.settings-layout`** — removed the index.css copy (which conflicted on `gap`); canonical definition lives in `responsive.css` with `gap: var(--sh-space-2xl)`.
+- **Sidebar rhythm** — `.sh-sidebar-nav-link` padding `9px → 8px` (off-step). Phase 1 sectioned-nav section gap 14 → 16 (`--sh-space-lg`); label-to-link gap 6 → 8 (`--sh-space-sm`). Course-entry link padding `'6px 2px' → '10px 8px'` (WCAG 2.5.5 touch target + 8-step).
+- **Skeleton CLS** — `SkeletonCard` padding `'20px 22px' → var(--card-pad)` (matches real `.sh-card`); `SkeletonFeed` gap 14 → 16; removed the per-card padding override. The shimmer ghost no longer visibly shrinks when content loads.
+- **AiBubble** — bubble + chat window `bottom`/`right` use `calc(N + env(safe-area-inset-*, 0px))` so the iPhone home-indicator strip is clear; chat `maxHeight` switched to `100dvh` for the same URL-bar reason.
+- **iOS auto-zoom fix** — `@media (max-width: 767px) .sh-input { font-size: 16px }` floors the input font so iOS Safari doesn't auto-zoom and jolt the layout on focus. Desktop keeps `--type-sm`.
+- **FeedPage banners** — `padding: '10px 14px'`, `'12px 14px'`, `'7px 16px'` all migrated to the 16/8-step.
+
+**Code-reviewer pass — 3 real findings caught + fixed in-wave.** A code-reviewer subagent on the diff caught:
+
+1. **CRITICAL** — `AppSidebar.jsx` drawer-mode `<aside>` still had `top: 74` hardcoded (line 431). Tablet/phone traffic — most real users — would have hit a sticky drawer trigger sitting 18px below the navbar. Migrated to the token.
+2. **IMPORTANT** — `AiPage.jsx` chat-panel `height: calc(100vh - ...)` should have been `100dvh` per the inline comment intent. CSS-in-JS can't do the dual-line `100vh / 100dvh` override pattern, so swapped to `100dvh` directly (95%+ browser support since Sep 2022).
+3. **IMPORTANT** — `.settings-layout` responsive overrides at 1024px + 768px were still in index.css contradicting the "moved to responsive.css" comment, AND the 768 vs 767 breakpoint collision produced a 1-pixel window at exactly 768px where the gap dropped to 12px. Moved BOTH the tablet (768–1024px) and phone (≤767px) overrides into responsive.css with the canonical 767 phone breakpoint, plus migrated the `.settings-nav-btn` mobile overrides over so SettingsPage's phone view still renders correctly.
+
+Bonus migration during the code-reviewer fix pass: also migrated 4 pre-existing hardcoded sticky offsets that didn't ship in this wave's original scope but use the same `top: 74/80` pattern — `index.css .sh-sidebar-sticky`, `MyCoursesPage.jsx`, `ScholarLists.css .scholar-saved__rail`, `ScholarPage.css .scholar-reader__sidecar`. All now compute from `var(--sh-nav-h)`.
+
+Out of scope for this wave (documented in the audit, deferred): a shared `&lt;FormField&gt;` primitive to standardize per-tab form spacing in Settings; a shared `&lt;Modal&gt;` primitive to consolidate the 5 ConfirmDialog reimplementations; bulk migration of remaining ~30 `pageShell(top, bottom)` call sites to one default; bulk 100vh → 100dvh on 40 page roots. Those are structural changes that need founder sign-off on the primitive contract before landing.
+
+Validation: backend lint clean (no changes), frontend lint 0 errors (warning count unchanged at 91 — same warnings as baseline, all pre-existing), frontend build green (1.02s). 12 files changed, ~197 insertions / 74 deletions.
+
 ### Wave-12.13 — Codex P1 + P2 fixes on wave-12.11 / 12.12 (2026-05-28)
 
 Two real findings from a Codex review pass on `e9fc07e6`. Both vetted and fixed in our style.

frontend/studyhub-app/src/components/Skeleton.jsx

@@ -28,15 +28,20 @@ export function Skeleton({ width = '100%', height = 16, circle, size, borderRadi
   )
 }
 
-/** Card-shaped skeleton with header row + content lines. */
+/** Card-shaped skeleton with header row + content lines.
+ *
+ * Padding matches `.sh-card` (--card-pad: clamp(16px, ..., 24px)) so the
+ * loading ghost is the same width/height as the real card. Was '20px 22px'
+ * which made the shimmer ~4px wider than the resolved content, producing a
+ * visible CLS jolt the moment data loaded. */
 export function SkeletonCard({ style }) {
   return (
     <div
       style={{
         background: 'var(--sh-surface, #fff)',
         borderRadius: 16,
         border: '1px solid var(--sh-border, #e2e8f0)',
-        padding: '20px 22px',
+        padding: 'var(--card-pad)',
         ...style,
       }}
     >
@@ -116,12 +121,14 @@ export function SkeletonSheetGrid({ count = 4 }) {
   )
 }
 
-/** Feed skeleton with multiple post cards. */
+/** Feed skeleton with multiple post cards. Matches FeedPage main column
+ * gap (--sh-space-lg = 16px) so the shimmer-to-resolved transition has no
+ * visible step in the inter-card gutter. */
 export function SkeletonFeed({ count = 3 }) {
   return (
-    <div style={{ display: 'grid', gap: 14 }}>
+    <div style={{ display: 'grid', gap: 'var(--sh-space-lg)' }}>
       {Array.from({ length: count }).map((_, i) => (
-        <SkeletonCard key={i} style={{ padding: '22px 24px' }} />
+        <SkeletonCard key={i} />
       ))}
     </div>
   )

frontend/studyhub-app/src/components/ai/AiBubble.jsx

@@ -179,8 +179,11 @@ function AiBubbleInner() {
         className={!isOpen && chat?.streaming ? 'sh-ai-bubble-streaming' : undefined}
         style={{
           position: 'fixed',
-          bottom: 24,
-          right: 24,
+          // env(safe-area-inset-*) keeps the bubble clear of the iPhone
+          // home-indicator strip (and any future curved-edge devices).
+          // Falls back to 0px on platforms that don't expose insets.
+          bottom: 'calc(24px + env(safe-area-inset-bottom, 0px))',
+          right: 'calc(24px + env(safe-area-inset-right, 0px))',
           width: 56,
           height: 56,
           borderRadius: '50%',
@@ -232,11 +235,15 @@ function AiBubbleInner() {
           aria-label="Hub AI mini chat"
           style={{
             position: 'fixed',
-            bottom: 88,
-            right: 24,
+            // Anchor above the bubble (which itself respects safe-area-inset-bottom).
+            // 88 = bubble height (56) + bubble margin (24) + 8px gap.
+            bottom: 'calc(88px + env(safe-area-inset-bottom, 0px))',
+            right: 'calc(24px + env(safe-area-inset-right, 0px))',
             width: 'min(420px, calc(100vw - 48px))',
             height: 600,
-            maxHeight: 'calc(100vh - 120px)',
+            // 100dvh on mobile Safari so the chat doesn't get clipped behind
+            // the dynamic URL bar.
+            maxHeight: 'calc(100dvh - 120px - env(safe-area-inset-bottom, 0px))',
             background: 'var(--sh-surface)',
             borderRadius: 16,
             border: '1px solid var(--sh-border)',