feat(auth): session userAgent (Device/Location) + last-used login badge

Repopulate the Zitadel session userAgent on createSession for login,
signup, and SSO so cloud-portal Active Sessions shows real Device (and
Location where the gateway geo-IP is enabled) instead of "-". Restore the
"Last used" badge on the login page, extended to all login actions
(IdP / email / passkey) and rendered with the datum-ui Badge.

Part A — session userAgent:
- userAgentFromRequest util: IP from x-forwarded-for using the same
  trust model as the rate-limit middleware (no newly-trusted spoofable
  header); UA header + parsed browser/OS description + fingerprintId.
- SessionOpts.userAgent forwarded to the Zitadel v2 CreateSession proto.
- Threaded into all 9 createSession callsites (login identifier x2,
  signup x6, SSO sign-in + auto-link).

Part B — last-used login badge:
- Signed last-used-login cookie (idp:<idpId> | email | passkey),
  appended as a second Set-Cookie on each successful sign-in
  (login password, login/signup email-link, SSO sign-in/auto-link/
  auto-create, passkey verify).
- Login loader reads the cookie; the page renders a datum-ui "Last used"
  Badge on the matching action (at most one).

Tests: 127 files / 908 tests green; tsc clean. Final whole-feature
review: 0 critical / 0 important.

Author: yahyafakhroji

app/modules/auth/auth-provider.ts

@@ -59,6 +59,25 @@ export interface SessionOpts {
    * the key 'maxmind/tracking-token'.
    */
   metadata?: Record<string, string>;
+  /**
+   * Device/browser context — forwarded to the Zitadel CreateSession proto
+   * `userAgent` field (zitadel.session.v2.UserAgent). Enables the cloud-portal
+   * "Active Sessions → Device/Location" view. Built by `userAgentFromRequest()`
+   * in `app/server/user-agent.ts`. Omit when no request context is available
+   * (e.g. server-side-only session refresh paths).
+   *
+   * Shape mirrors ZitadelUserAgent from user-agent.ts:
+   *   fingerprintId? — opaque client fingerprint id
+   *   ip?            — client IP (last-hop XFF)
+   *   description?   — human-readable browser/device/OS string
+   *   header?        — map<string, { values: string[] }> (proto HeaderValues)
+   */
+  userAgent?: {
+    fingerprintId?: string;
+    ip?: string;
+    description?: string;
+    header?: Record<string, { values: string[] }>;
+  };
 }
 
 export interface RegisterInput {

app/modules/auth/providers/fake/fake-provider.user-agent.test.ts

@@ -0,0 +1,35 @@
+import { FakeAuthProvider } from './fake-provider';
+import { describe, it, expect } from 'vitest';
+
+describe('FakeAuthProvider — userAgent forwarding', () => {
+  it('records userAgent on lastCreateSessionOpts when passed', async () => {
+    const p = new FakeAuthProvider();
+    const ua = {
+      fingerprintId: 'fp-abc',
+      ip: '1.2.3.4',
+      description: 'Chrome, , , , Blink, , macOS, , ',
+      header: { 'user-agent': { values: ['Mozilla/5.0'] } },
+    };
+
+    await p.createSession({}, { userAgent: ua });
+
+    expect(p.lastCreateSessionOpts?.userAgent).toEqual(ua);
+  });
+
+  it('leaves userAgent undefined on lastCreateSessionOpts when not passed', async () => {
+    const p = new FakeAuthProvider();
+
+    await p.createSession({});
+
+    expect(p.lastCreateSessionOpts?.userAgent).toBeUndefined();
+  });
+
+  it('accepts a partial userAgent with only fingerprintId', async () => {
+    const p = new FakeAuthProvider();
+    const ua = { fingerprintId: 'fp-only' };
+
+    await p.createSession({}, { userAgent: ua });
+
+    expect(p.lastCreateSessionOpts?.userAgent).toEqual({ fingerprintId: 'fp-only' });
+  });
+});

app/modules/auth/providers/zitadel/index.ts

@@ -67,7 +67,11 @@ import {
   SAMLService,
   SessionSchema as SamlSessionSchema,
 } from '@zitadel/proto/zitadel/saml/v2/saml_service_pb';
-import { SearchQuerySchema as SessionSearchQuerySchema } from '@zitadel/proto/zitadel/session/v2/session_pb';
+import {
+  SearchQuerySchema as SessionSearchQuerySchema,
+  UserAgentSchema,
+  UserAgent_HeaderValuesSchema,
+} from '@zitadel/proto/zitadel/session/v2/session_pb';
 import {
   ChecksSchema,
   SessionService,
@@ -444,11 +448,36 @@ export class ZitadelAuthProvider implements AuthProvider {
       const metadata = opts?.metadata
         ? Object.fromEntries(Object.entries(opts.metadata).map(([k, v]) => [k, encoder.encode(v)]))
         : undefined;
+      // Forward Zitadel UserAgent so cloud-portal shows Device/Location on active sessions.
+      // Map our ZitadelUserAgent shape onto the proto UserAgent message.
+      // header values are repeated strings wrapped in a HeaderValues sub-message.
+      const userAgent = opts?.userAgent
+        ? create(UserAgentSchema, {
+            ...(opts.userAgent.fingerprintId !== undefined
+              ? { fingerprintId: opts.userAgent.fingerprintId }
+              : {}),
+            ...(opts.userAgent.ip !== undefined ? { ip: opts.userAgent.ip } : {}),
+            ...(opts.userAgent.description !== undefined
+              ? { description: opts.userAgent.description }
+              : {}),
+            ...(opts.userAgent.header !== undefined
+              ? {
+                  header: Object.fromEntries(
+                    Object.entries(opts.userAgent.header).map(([k, v]) => [
+                      k,
+                      create(UserAgent_HeaderValuesSchema, { values: v.values }),
+                    ])
+                  ),
+                }
+              : {}),
+          })
+        : undefined;
       const created = await sessions.createSession(
         {
           checks: builtChecks,
           lifetime: { seconds: BigInt(lifetimeSeconds) },
           ...(metadata ? { metadata } : {}),
+          ...(userAgent ? { userAgent } : {}),
         },
         {}
       );

app/modules/auth/session/__tests__/last-used-login.test.ts

@@ -0,0 +1,46 @@
+import {
+  serializeLastUsedLogin,
+  lastUsedLoginCookie,
+} from '@/modules/auth/session/last-used-login';
+import { describe, it, expect } from 'vitest';
+
+/**
+ * Extract the raw `name=value` pair from a Set-Cookie header string so it can be
+ * passed directly to `lastUsedLoginCookie.parse()` as a Cookie request header.
+ * (happy-dom blocks `cookie` as a forbidden header on `new Request()`, so we parse
+ * via `lastUsedLoginCookie.parse(cookieHeader)` directly instead of via `readLastUsedLogin`.)
+ */
+function setCookieToCookieHeader(setCookieHeader: string): string {
+  return setCookieHeader.split(';')[0].trim();
+}
+
+describe('last-used-login cookie', () => {
+  it('round-trips a token through serialize → parse', async () => {
+    const token = 'idp:g';
+    const setCookieValue = await serializeLastUsedLogin(token);
+    const cookieHeader = setCookieToCookieHeader(setCookieValue);
+    const parsed = await lastUsedLoginCookie.parse(cookieHeader);
+    expect(parsed).toBe(token);
+  });
+
+  it('returns null when the cookie is absent', async () => {
+    const parsed = await lastUsedLoginCookie.parse(null);
+    expect(parsed).toBeNull();
+  });
+
+  it('round-trips email token', async () => {
+    const token = 'email';
+    const setCookieValue = await serializeLastUsedLogin(token);
+    const cookieHeader = setCookieToCookieHeader(setCookieValue);
+    const parsed = await lastUsedLoginCookie.parse(cookieHeader);
+    expect(parsed).toBe(token);
+  });
+
+  it('round-trips passkey token', async () => {
+    const token = 'passkey';
+    const setCookieValue = await serializeLastUsedLogin(token);
+    const cookieHeader = setCookieToCookieHeader(setCookieValue);
+    const parsed = await lastUsedLoginCookie.parse(cookieHeader);
+    expect(parsed).toBe(token);
+  });
+});

app/modules/auth/session/last-used-login.ts

@@ -0,0 +1,35 @@
+import { env } from '@/utils/env/env.server';
+import { createCookie } from 'react-router';
+
+/**
+ * UX hint: records the last-used login method (idp:<idpId> | email | passkey).
+ * Never an auth signal — purely per-browser preference tracking.
+ * httpOnly: true (never accessible to scripts), sameSite: lax, 1-year maxAge.
+ * Signed with SESSION_SECRET to prevent tampering.
+ */
+export const lastUsedLoginCookie = createCookie('last-used-login', {
+  httpOnly: true,
+  sameSite: 'lax',
+  path: '/',
+  secure: env.NODE_ENV === 'production',
+  secrets: [env.SESSION_SECRET],
+  maxAge: 60 * 60 * 24 * 365, // 1 year
+});
+
+/**
+ * Serialize a last-used login token to a Set-Cookie string.
+ * Token ∈ 'idp:<idpId>' | 'email' | 'passkey'
+ */
+export async function serializeLastUsedLogin(token: string): Promise<string> {
+  return lastUsedLoginCookie.serialize(token);
+}
+
+/**
+ * Read the last-used login token from a request.
+ * Returns null if the cookie is absent or invalid.
+ */
+export async function readLastUsedLogin(request: Request): Promise<string | null> {
+  const cookieHeader = request.headers.get('cookie');
+  const token = await lastUsedLoginCookie.parse(cookieHeader);
+  return token ?? null;
+}