fix(auth): resolve confirmed findings from the Fable-5 security audit

Fixes 31 of 32 confirmed findings from the adversarially-verified ultracode audit
of the auth-ui rebuild; #16 is partially fixed with a documented residual. All
changes typecheck clean and pass the mirrored cypress component specs. See
docs/AUDIT-FINDINGS.md for the full per-finding detail and status.

Highlights by subsystem:
- session/device: device-authorization grants no longer auto-complete from the
  forgeable GET /signed-in; they route to the CSRF-protected /device/authorize
  consent screen (explicit Approve showing app + scope). (#10)
- rate-limit: limiters mount on '*' and self-guard on a normalized (lowercased,
  .data-stripped) path, closing the case-variant and single-fetch bypasses. (#1, #11)
- verify: email-code resend is gated on server-verified session ownership and never
  500s / enumerates; requestId validated + encoded into the /authorize hand-back.
  (#9, #25, #30)
- signup: registration policy (allowRegister/allowPassword/passkeysType) enforced in
  the actions; duplicate-email responses emit a Set-Cookie (presence oracle closed,
  content/size residual documented — #16); fingerprintId used instead of the MaxMind
  token; requestId resumed on email-link complete. (#3, #4, #14, #16, #17)
- sso: guarded getSession/startIdpIntent (graceful branded errors, not 500s); LDAP
  reauth cookie cleared; ProviderError on sign-in mapped to the branded page;
  deviceTrackingToken threaded on auto-link. (#2, #5, #6, #13, #19, #20, #21)
- providers/mappers: U2F factor derived from the webAuthN proto factor (fixes the
  U2F login loop); failedAttempts extracted with the proper schema; forceMfaLocalOnly
  kept distinct from forceMfa. (#0, #7, #22)
- session cookie: dual-format (ISO/epoch) timestamp parsing in the eviction pre-pass
  so the 2KB budget is respected. (#8)
- webauthn: real browsers without WebAuthn see the unsupported message instead of
  submitting the Cypress fake credential. (#27)
- fraud: MaxMind token falls back to the cookie when it lands after the poll budget;
  default-org cache keyed per service URL. (#28, #29)
- audit logging: raw loginName replaced with hashActor across OTP/webauthn/password
  reset events. (#23, #24, #26)
- setup: safeParse on tampered skip params; TOTP register guarded. (#12, #31)

Verification (2026-07-04): the 12 findings applied in the prior batch were
independently re-verified (verifier + adversary per finding). 9 closed cleanly;
#10 (device-auth) was incomplete and #30 (resend test) was a regression — both
re-fixed here; #16 (signup enumeration) is partial, with the residual documented
and full closure (sessions-cookie encryption) deferred by owner decision.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017UhyUkaSmoNFax5wu2aHfi

Author: yahyafakhroji

app/components/webauthn-button/webauthn-button.tsx

@@ -90,7 +90,13 @@ export function WebAuthnButton({
       let credential: Record<string, unknown>;
 
       const isCypress = typeof window !== 'undefined' && 'Cypress' in window;
-      if (isCypress || !isWebAuthnSupported()) {
+      if (!isCypress && !isWebAuthnSupported()) {
+        // Real browser without WebAuthn — surface the unsupported message immediately
+        // instead of submitting the fake Cypress credential to the production backend.
+        setError('webauthn-unsupported');
+        return;
+      }
+      if (isCypress) {
         // Cypress fake-credential path: no publicKey needed.
         // The pre-baked credential works for both assertion and attestation because
         // the fake provider accepts any payload for both verifyPasskey and verifyU2F.

app/modules/auth/providers/zitadel/index.ts

@@ -59,9 +59,12 @@ export class ZitadelAuthProvider implements AuthProvider {
     oidc: true,
     registration: true,
   };
+  /** Exposed so resolve-org can key the default-org memo per Zitadel instance URL. */
+  readonly serviceUrl: string;
   private readonly ctx: ZitadelCtx;
   constructor(opts: ZitadelOpts) {
     this.ctx = createZitadelCtx(opts);
+    this.serviceUrl = opts.serviceUrl;
   }
 
   // settings

app/modules/auth/providers/zitadel/mappers.ts

@@ -21,6 +21,7 @@ import {
 import type { JsonObject } from '@bufbuild/protobuf';
 import { timestampDate } from '@bufbuild/protobuf/wkt';
 import type { Timestamp } from '@bufbuild/protobuf/wkt';
+import { CredentialsCheckErrorSchema } from '@zitadel/proto/zitadel/message_pb';
 import { UserVerificationRequirement } from '@zitadel/proto/zitadel/session/v2/challenge_pb';
 
 // gRPC status code → ProviderError code
@@ -82,7 +83,11 @@ export function normalizeError(error: unknown): ProviderError {
 
 function extractFailedAttempts(e: ConnectErrorLike): number | undefined {
   try {
-    const details = e.findDetails?.() ?? [];
+    // ConnectError.findDetails REQUIRES a message schema (or registry): it dereferences
+    // `arg.kind` immediately, so calling it with no argument throws — the catch would then
+    // swallow it and failedAttempts would never surface. Zitadel returns the count in a
+    // zitadel.v1.CredentialsCheckError detail, so pass its schema explicitly.
+    const details = e.findDetails?.(CredentialsCheckErrorSchema) ?? [];
     for (const d of details) {
       if (d && typeof d === 'object' && 'failedAttempts' in d) {
         const v = (d as { failedAttempts: unknown }).failedAttempts;
@@ -177,7 +182,6 @@ export function toSession(
       totp?: { verifiedAt?: unknown };
       otpSms?: { verifiedAt?: unknown };
       otpEmail?: { verifiedAt?: unknown };
-      u2f?: { verifiedAt?: unknown; userVerified?: unknown };
     };
     expirationDate?: unknown;
     changeDate?: unknown;
@@ -201,6 +205,16 @@ export function toSession(
   };
   const v = (x?: { verifiedAt?: unknown }): Date | null =>
     x?.verifiedAt ? tsToDate(x.verifiedAt) : null;
+  // Real Zitadel reports BOTH passwordless passkeys and U2F security keys through the single
+  // `webAuthN` proto factor — the session Factors message has no `u2f` field. `userVerified` is
+  // the discriminator: passkeys verify the user (true); U2F 2nd-factor keys do not (the app
+  // requests 'discouraged' user verification for U2F). Split that one proto factor into the two
+  // neutral factors so passwordlessPasskeyFresh (passkey) and secondFactorFresh (u2f) each see
+  // their own signal — without the split a completed U2F check satisfies neither rule and the
+  // security-key login loops forever.
+  const webAuthN = proto.factors?.webAuthN;
+  const webAuthNVerifiedAt = v(webAuthN);
+  const webAuthNUserVerified = Boolean(webAuthN?.userVerified);
   return {
     id: proto.id ?? '',
     token,
@@ -213,20 +227,22 @@ export function toSession(
       : undefined,
     factors: {
       password: { verifiedAt: v(proto.factors?.password) },
-      // passkey factor carries userVerified, which drives the passwordless-passkey MFA-satisfied rule
+      // passkey factor carries userVerified, which drives the passwordless-passkey MFA-satisfied
+      // rule. Only a user-verified webAuthN check is a passkey; a non-verified one is a U2F key.
       passkey: {
-        verifiedAt: v(proto.factors?.webAuthN),
-        userVerified: Boolean(proto.factors?.webAuthN?.userVerified),
+        verifiedAt: webAuthNUserVerified ? webAuthNVerifiedAt : null,
+        userVerified: webAuthNUserVerified,
       },
       idpIntent: { verifiedAt: v(proto.factors?.intent) },
-      // Real Zitadel populates these after an OTP/TOTP/U2F check; without
+      // Real Zitadel populates these after an OTP/TOTP check; without
       // mapping them, mfa-routing.secondFactorFresh never sees a completed second factor.
       totp: { verifiedAt: v(proto.factors?.totp) },
       otpSms: { verifiedAt: v(proto.factors?.otpSms) },
       otpEmail: { verifiedAt: v(proto.factors?.otpEmail) },
+      // A U2F security key surfaces as a non-user-verified webAuthN check (see split above).
       u2f: {
-        verifiedAt: v(proto.factors?.u2f),
-        userVerified: Boolean(proto.factors?.u2f?.userVerified),
+        verifiedAt: webAuthN && !webAuthNUserVerified ? webAuthNVerifiedAt : null,
+        userVerified: false,
       },
     },
     expiresAt: proto.expirationDate ? tsToIso(proto.expirationDate) : '',
@@ -340,7 +356,9 @@ export function toLoginSettings(proto: Record<string, unknown>): LoginSettings {
     allowRegister: Boolean(proto.allowRegister),
     allowExternalIdp: Boolean(proto.allowExternalIdp),
     passkeysType: proto.passkeysType === 1 ? 'allowed' : 'not_allowed',
-    forceMfa: Boolean(proto.forceMfa) || Boolean(proto.forceMfaLocalOnly),
+    forceMfa: Boolean(proto.forceMfa),
+    // Kept distinct from forceMfa: local-only must NOT force MFA on IdP-authenticated sessions.
+    forceMfaLocalOnly: Boolean(proto.forceMfaLocalOnly),
     hidePasswordReset: Boolean(proto.hidePasswordReset),
     ignoreUnknownUsernames: Boolean(proto.ignoreUnknownUsernames),
     disableLoginWithEmail: Boolean(proto.disableLoginWithEmail),

app/modules/auth/session/cookie.ts

@@ -6,6 +6,7 @@ import {
   listSessions,
   byId,
   byLoginName,
+  tsMs,
   type SessionEntry,
 } from './session';
 import type { Session } from '@/modules/auth/types';
@@ -89,12 +90,14 @@ export async function readSessions(request: Request): Promise<SessionEntry[]> {
 export async function serializeSessions(list: SessionEntry[]): Promise<string> {
   // Async pre-pass: measure the REAL signed payload for each newest-k candidate list,
   // then let the pure capSessions pick the survivors via a lookup-based sizeOf.
-  const byNewest = [...list].sort((a, b) => Number(b.changeTs) - Number(a.changeTs));
+  // changeTs is a string (numeric-epoch OR ISO-8601). Number(ISO) is NaN, which made this sort
+  // a no-op — the "newest-k" pre-pass then measured an arbitrary subset, so the eviction size
+  // table was computed over the wrong sessions and the emitted cookie could exceed the byte
+  // budget or over-evict. tsMs parses both formats (shared with mostRecent/listSessions).
+  const byNewest = [...list].sort((a, b) => tsMs(b.changeTs) - tsMs(a.changeTs));
   const sizeByLength = new Map<number, number>();
   for (let k = list.length; k >= 0; k--) {
-    const candidate = [...byNewest.slice(0, k)].sort(
-      (a, b) => Number(a.changeTs) - Number(b.changeTs)
-    );
+    const candidate = [...byNewest.slice(0, k)].sort((a, b) => tsMs(a.changeTs) - tsMs(b.changeTs));
     const bytes = new TextEncoder().encode(await sessionsCookie.serialize(candidate)).byteLength;
     sizeByLength.set(k, bytes);
     if (bytes <= MAX_COOKIE_BYTES) break; // smaller suffixes can only be smaller; no need to measure them

app/modules/auth/session/session.ts

@@ -22,7 +22,7 @@ export function removeSession(list: SessionEntry[], id: string): SessionEntry[]
  * which silently broke expiry filtering and recency sorting — parse both.
  * Unparseable values map to NaN → treated as expired / oldest.
  */
-function tsMs(value: string): number {
+export function tsMs(value: string): number {
   const n = Number(value);
   return Number.isNaN(n) ? Date.parse(value) : n;
 }

app/modules/auth/types.ts

@@ -68,9 +68,7 @@ export interface U2FCreationOptions {
  *                     `SessionChallenges.otpEmailCode` so callers can complete the factor in-band.
  */
 export type OtpEmailChallenge =
-  | { kind: 'send' }
-  | { kind: 'send-template'; urlTemplate: string }
-  | { kind: 'return-code' };
+  { kind: 'send' } | { kind: 'send-template'; urlTemplate: string } | { kind: 'return-code' };
 
 // OIDC (Phase 1) — SAML fields added in Phase 5.
 export interface AuthRequest {
@@ -134,7 +132,15 @@ export interface LoginSettings {
   allowRegister: boolean;
   allowExternalIdp: boolean;
   passkeysType: 'not_allowed' | 'allowed';
+  /** Login policy: MFA is mandatory for all sessions (local and IdP). Proto `forceMfa`. */
   forceMfa: boolean;
+  /**
+   * Login policy: MFA is mandatory only for local (username/password) logins; sessions
+   * authenticated via an external IdP are exempt. Proto `forceMfaLocalOnly`. Optional,
+   * default-off. Kept distinct from `forceMfa` so IdP sessions the policy exempts are not
+   * wrongly forced into MFA setup.
+   */
+  forceMfaLocalOnly?: boolean;
   /** Login policy: hide the "Forgot password?" entry point. Proto `hidePasswordReset`. Optional (undefined ⇒ show). */
   hidePasswordReset?: boolean;
   /**

app/modules/fraud/maxmind-tracker.tsx

@@ -69,12 +69,30 @@ export function MaxMindTracker({ accountId }: MaxMindTrackerProps) {
   return null;
 }
 
-/** Reads the mirrored device-tracking token at form-submit time. */
+/**
+ * Reads the device-tracking token at form-submit time.
+ *
+ * Checks sessionStorage first (the fast path — the tracker polls the cookie and mirrors it
+ * there on success). If the mirror is absent (e.g. the MaxMind cookie landed after the poll
+ * budget expired), falls back to reading the cookie directly and mirrors it so future reads
+ * are fast. This prevents the token from being permanently lost on slow connections.
+ */
 export function readMaxMindTrackingToken(): string | undefined {
   if (typeof window === 'undefined') return undefined;
   try {
-    return window.sessionStorage.getItem(MAXMIND_TOKEN_STORAGE_KEY) || undefined;
+    const mirrored = window.sessionStorage.getItem(MAXMIND_TOKEN_STORAGE_KEY);
+    if (mirrored) return mirrored;
+  } catch {
+    // sessionStorage unavailable — fall through to cookie read
+  }
+  // Fallback: cookie may have arrived after the poll budget expired.
+  const fromCookie = readMaxMindCookie();
+  if (!fromCookie) return undefined;
+  // Mirror it so subsequent reads (e.g. the signup interval) find it immediately.
+  try {
+    window.sessionStorage.setItem(MAXMIND_TOKEN_STORAGE_KEY, fromCookie);
   } catch {
-    return undefined;
+    // sessionStorage unavailable; the cookie read still returns the token this call.
   }
+  return fromCookie;
 }