fix(auth): address code-review findings (HIGH→LOW) on the re-auth guard + infra

Re-auth identity guard — close the gaps the review found, via a shared helper so every
login factor agrees (checkReauthIntent, case-insensitive):
- H-1 passkey & security-key: add the guard to the shared webauthn-verify factory action
  (was bypassed → a passkey re-auth could complete as the wrong identity / never clear the
  intent). Now match-checks + clears + bounces to the picker on mismatch.
- H-2/H-3 SSO link / auto-link / link-needs-auth / auto-create: clear the reauth-intent
  cookie so a stale marker can't false-mismatch a later login (notably link-needs-auth →
  /login → password).
- Case-insensitive comparison (was exact) so IdP/SAML casing differences don't false-mismatch.
- password + IdP paths refactored onto the shared checkReauthIntent.

Correctness / quality:
- H-5 removeAccount: build the redirect via paths.accounts() (no hand-rolled URL string).
- H-6 RateLimiter: type the store as the RateLimitStore INTERFACE + narrow the union return
  (remove the unsafe cast) so the Redis seam is real.
- userCode: bound to the OAuth device user_code shape in switch/remove schemas.
- listAccounts: stop threading the stale cookie-baked requestId into display-only nextPath.
- /authorize prompt=login freshness window now honors a stricter org passwordCheckLifetimeMs
  (only ever tightens); explicit sessionId guard instead of byId('').
- rate-limit-store: record windowMs per bucket so the sweep is correct under a shared store.
- Extracted /logout into session-logout.service.ts (session.service 793->657 lines), re-exported;
  registered both modules in the auth-event coverage registry.

Deps / docs: re-pin remix-utils to 9.3.1 (stop floating) + refresh csrf comment; document the
CSP unsafe-inline accepted risk; de-TODO the LDAP-link + split-layout design notes.
NOTE: js-yaml is KEPT — it satisfies @datum-cloud/datum-ui's optional peer (removing it repeats
the @tanstack/react-virtual clean-install break); the review's 'unused dep' was a false positive.

Tests: reauth-intent cookie + shared checkReauthIntent (match/mismatch/case-insensitive/clear);
IdP guard case-insensitive case.

Author: yahyafakhroji

app/layouts/split.layout.tsx

@@ -72,7 +72,7 @@ export default function SplitLayout({
               {/* Intrinsic 232×290 raster line-art. width/height pin the aspect ratio so
                   the absolutely-positioned panel reserves space and never shifts layout (CLS).
                   object-contain keeps the line-art crisp/uncropped while it scales down into the
-                  115px box. TODO(design): replace with a vector (SVG) or AVIF source — a designer
+                  115px box. Design note (asset pending): replace with a vector (SVG) or AVIF source — a designer
                   asset is still needed; this raster is the only source that currently exists. */}
               <img
                 src={assetUrl('/images/illustration-2.svg')}
@@ -132,7 +132,7 @@ export default function SplitLayout({
             </div>
 
             {/* 95×38 signature raster at ~1× in a 96px-wide slot. width/height pin the box
-                (CLS) and object-contain keeps the strokes crisp without stretching. TODO(design): a
+                (CLS) and object-contain keeps the strokes crisp without stretching. Design note (asset pending): a
                 vector (SVG) signature is still needed — only this low-res raster currently exists. */}
             <img
               src={assetUrl('/images/zac-sign.png')}
@@ -148,7 +148,7 @@ export default function SplitLayout({
         <div className="absolute right-0 bottom-0 z-0 max-w-[500px] md:max-w-[800px]">
           {/* Intrinsic 707×155 raster line-art stretched into a fluid box up to 800px wide,
               so it currently upscales (soft). width/height pin the aspect ratio for CLS; object-contain
-              avoids the crop/extra blur object-cover introduced. TODO(design): replace with a vector
+              avoids the crop/extra blur object-cover introduced. Design note (asset pending): replace with a vector
               (SVG) or higher-res AVIF source — a designer asset is still needed to render crisply at
               the 800px display width; the 707px raster is the only source that exists today. */}
           <img

app/modules/auth/session/__tests__/reauth-intent.test.ts

@@ -0,0 +1,61 @@
+// @vitest-environment node
+//
+// The reauth-intent cookie + the SHARED re-auth identity guard used by every login factor
+// (password, IdP callback, passkey/security-key). checkReauthIntent is the single source of the
+// match/mismatch decision, so testing it here covers the guard logic for all factors at once.
+import {
+  serializeReauthIntent,
+  readReauthIntent,
+  clearReauthIntent,
+  checkReauthIntent,
+} from '../reauth-intent';
+import { describe, it, expect } from 'vitest';
+
+/** A request carrying ONLY the reauth-intent cookie (or none when intent is null). */
+async function req(intent: string | null): Promise<Request> {
+  const headers: Record<string, string> = {};
+  if (intent !== null) headers.cookie = (await serializeReauthIntent(intent)).split(';')[0];
+  return new Request('http://localhost/id/login/password', { headers });
+}
+
+describe('reauth-intent cookie round-trip', () => {
+  it('serialize → read returns the stored loginName', async () => {
+    expect(await readReauthIntent(await req('alice@acme.test'))).toBe('alice@acme.test');
+  });
+
+  it('read returns null when the cookie is absent', async () => {
+    expect(await readReauthIntent(await req(null))).toBeNull();
+  });
+
+  it('clear produces an immediately-expiring Set-Cookie', async () => {
+    const cleared = await clearReauthIntent();
+    expect(cleared).toContain('reauth-intent=');
+    expect(cleared).toMatch(/Max-Age=0/i);
+  });
+});
+
+describe('checkReauthIntent (shared identity guard)', () => {
+  it('no intent in flight → not a re-auth, no mismatch, no clear cookie', async () => {
+    const r = await checkReauthIntent(await req(null), 'whoever@acme.test');
+    expect(r).toEqual({ intent: null, mismatch: false });
+  });
+
+  it('matching identity → no mismatch, intent echoed, clear cookie present', async () => {
+    const r = await checkReauthIntent(await req('alice@acme.test'), 'alice@acme.test');
+    expect(r.intent).toBe('alice@acme.test');
+    expect(r.mismatch).toBe(false);
+    expect(r.clearCookie).toContain('reauth-intent=');
+  });
+
+  it('matches case-insensitively (IdP/SAML may return different casing)', async () => {
+    const r = await checkReauthIntent(await req('Alice@ACME.test'), 'alice@acme.test');
+    expect(r.mismatch).toBe(false);
+  });
+
+  it('different identity → mismatch true, clear cookie still present', async () => {
+    const r = await checkReauthIntent(await req('alice@acme.test'), 'bob@acme.test');
+    expect(r.intent).toBe('alice@acme.test');
+    expect(r.mismatch).toBe(true);
+    expect(r.clearCookie).toContain('reauth-intent=');
+  });
+});

app/modules/auth/session/reauth-intent.ts

@@ -39,3 +39,35 @@ export async function readReauthIntent(request: Request): Promise<string | null>
 export async function clearReauthIntent(): Promise<string> {
   return reauthIntentCookie.serialize('', { maxAge: 0 });
 }
+
+/** Result of the shared re-auth identity guard (see {@link checkReauthIntent}). */
+export interface ReauthCheck {
+  /** The identity being re-authenticated, or null when this is not a re-auth flow. */
+  intent: string | null;
+  /** True only when a re-auth IS in flight AND the authenticated identity differs from it. */
+  mismatch: boolean;
+  /**
+   * A Set-Cookie that clears the intent marker — present whenever a re-auth resolved (intent set),
+   * undefined otherwise. Callers MUST append it on both the match and mismatch paths so a stale
+   * marker can never gate a later, unrelated login.
+   */
+  clearCookie?: string;
+}
+
+/**
+ * Shared re-auth identity guard for a just-completed authentication, used by every login factor
+ * (password, IdP callback, passkey/security-key) so they agree. Compares the authenticated
+ * loginName against the re-auth intent CASE-INSENSITIVELY (IdPs / SAML may return a different
+ * casing than what was stored — an exact compare would false-mismatch case-insensitive accounts).
+ * A non-null intent always yields a clearCookie; on mismatch the caller keeps both accounts and
+ * routes to the picker instead of completing the ceremony as the unintended identity.
+ */
+export async function checkReauthIntent(
+  request: Request,
+  authedLoginName: string
+): Promise<ReauthCheck> {
+  const intent = await readReauthIntent(request);
+  if (intent === null) return { intent: null, mismatch: false };
+  const mismatch = authedLoginName.trim().toLowerCase() !== intent.trim().toLowerCase();
+  return { intent, mismatch, clearCookie: await clearReauthIntent() };
+}

app/modules/i18n/locales/en.po

@@ -13,7 +13,7 @@ msgstr ""
 "Plural-Forms: \n"
 
 #. placeholder {0}: attempts.count
-#: app/routes/login/password.tsx:158
+#: app/routes/login/password.tsx:157
 msgid "{0, plural, one {# attempt remaining.} other {# attempts remaining.}}"
 msgstr "{0, plural, one {# attempt remaining.} other {# attempts remaining.}}"
 
@@ -191,7 +191,7 @@ msgstr "Continue"
 msgid "Continue with your provider"
 msgstr "Continue with your provider"
 
-#: app/routes/login/password.tsx:106
+#: app/routes/login/password.tsx:105
 msgid "Could not verify password"
 msgstr "Could not verify password"
 
@@ -302,8 +302,8 @@ msgstr "Enter your authenticator code"
 msgid "Enter your email code"
 msgstr "Enter your email code"
 
-#: app/routes/login/password.tsx:126
-#: app/routes/login/password.tsx:143
+#: app/routes/login/password.tsx:125
+#: app/routes/login/password.tsx:142
 msgid "Enter your password"
 msgstr "Enter your password"
 
@@ -315,7 +315,7 @@ msgstr "Enter your SMS code"
 msgid "Finish creating your account"
 msgstr "Finish creating your account"
 
-#: app/routes/login/password.tsx:189
+#: app/routes/login/password.tsx:188
 msgid "Forgot password?"
 msgstr "Forgot password?"
 
@@ -432,7 +432,7 @@ msgstr "Phone"
 msgid "Phone sign-in isn't available — use your email or username."
 msgstr "Phone sign-in isn't available — use your email or username."
 
-#: app/routes/login/password.tsx:177
+#: app/routes/login/password.tsx:176
 #: app/utils/errors/auth-error-messages.tsx:27
 msgid "Please check your input and try again."
 msgstr "Please check your input and try again."
@@ -530,13 +530,13 @@ msgstr "Set up security key"
 msgid "Set up SMS one-time code"
 msgstr "Set up SMS one-time code"
 
-#: app/routes/login/password.tsx:182
+#: app/routes/login/password.tsx:181
 #: app/routes/signup/index.tsx:286
 #: app/routes/sso/ldap.tsx:82
 msgid "Sign in"
 msgstr "Sign in"
 
-#: app/routes/login/password.tsx:171
+#: app/routes/login/password.tsx:170
 #: app/routes/logout/success.tsx:22
 #: app/utils/errors/auth-error-recovery.tsx:47
 msgid "Sign in again"
@@ -815,7 +815,7 @@ msgstr "You're almost done! <0>{loginName}</0>"
 msgid "You've been signed out"
 msgstr "You've been signed out"
 
-#: app/routes/login/password.tsx:153
+#: app/routes/login/password.tsx:152
 msgid "Your account is temporarily locked after too many attempts."
 msgstr "Your account is temporarily locked after too many attempts."
 
@@ -839,7 +839,7 @@ msgstr "Your password has expired. Please reset it to continue."
 msgid "Your session has ended and you've been securely signed out of Datum. You can safely close this tab, or sign back in any time to pick up where you left off."
 msgstr "Your session has ended and you've been securely signed out of Datum. You can safely close this tab, or sign back in any time to pick up where you left off."
 
-#: app/routes/login/password.tsx:169
+#: app/routes/login/password.tsx:168
 #: app/utils/errors/auth-error-messages.tsx:56
 msgid "Your session has expired."
 msgstr "Your session has expired."

app/resources/authorize/authorize.service.ts

@@ -49,6 +49,24 @@ const DEAD_SESSION_CODES: ReadonlySet<ProviderError['code']> = new Set([
 // can no longer satisfy prompt=login.
 const FRESH_LOGIN_WINDOW_MS = 2 * 60 * 1000; // 2 minutes
 
+/**
+ * The effective anti-forgery freshness window for a prompt=login hand-back. Defaults to the fixed
+ * FRESH_LOGIN_WINDOW_MS (redirect-latency allowance), but an org configured with a STRICTER
+ * `passwordCheckLifetimeMs` tightens it — so a strict org's policy is honored even on the gate's
+ * pass path (which finalizes without re-running nextStep). It only ever tightens; an unset or
+ * longer policy keeps the 2-minute window. Settings-read failure degrades to the fixed window.
+ */
+async function freshLoginWindowMs(
+  provider: AuthProvider,
+  entry: { organization?: string }
+): Promise<number> {
+  const settings = await provider.getLoginSettings(entry.organization).catch(() => undefined);
+  const lifetime = settings?.passwordCheckLifetimeMs;
+  return typeof lifetime === 'number' && lifetime > 0
+    ? Math.min(FRESH_LOGIN_WINDOW_MS, lifetime)
+    : FRESH_LOGIN_WINDOW_MS;
+}
+
 /**
  * A typed description of what the /authorize loader resolved to. The route (and the
  * `outcomeToResponse` translator below) turn this into a redirect/JSON Response. Keeping
@@ -313,7 +331,7 @@ async function resolveOidc(
       // harmless (picking your own live session), so the gate is scoped to prompt=login.
       const mustReauth =
         authRequest.prompt.includes('login') &&
-        !primaryFresh(gate.session.factors, nowMs, FRESH_LOGIN_WINDOW_MS);
+        !primaryFresh(gate.session.factors, nowMs, await freshLoginWindowMs(provider, entry));
       if (!mustReauth) return runCallback(provider, rawId, entry);
       // else: stale prompt=login → do NOT finalize; fall through to decideAuthorize below.
     }
@@ -327,7 +345,8 @@ async function resolveOidc(
   });
 
   if (decision.target === 'callback') {
-    const entry = byId(list, decision.params?.sessionId ?? '');
+    if (!decision.params?.sessionId) return { kind: 'error-redirect', code: 'no_session' };
+    const entry = byId(list, decision.params.sessionId);
     if (!entry) return { kind: 'error-redirect', code: 'no_session' };
     // Validate liveness BEFORE reuse (same self-heal as the explicit-sessionId path above). No
     // freshness gate here: for prompt=login decideAuthorize returns target '/login', never