From 10d831b204b6315fb2dfe422a6034b7c40e6a809 Mon Sep 17 00:00:00 2001
From: Edouard Vanbelle <opensource@edouard.vanbelle.fr>
Date: Sun, 9 Aug 2026 05:00:30 +0200
Subject: [PATCH] feat(session): ensure dpop even with OIDC

---
 frontend/src/lib/api/types.ts                 |  5 ++
 frontend/src/lib/stores/session.svelte.ts     | 16 +++++--
 .../src/routes/admin/[[tab]]/+page.svelte     | 47 +++++++++++++++----
 frontend/src/routes/login/+page.svelte        |  9 ++++
 src/application/dtos/session_dto.rs           | 23 +++++++++
 .../services/auth_application_service.rs      |  8 +++-
 src/interfaces/api/handlers/admin_handler.rs  |  9 ++++
 7 files changed, 103 insertions(+), 14 deletions(-)

diff --git a/frontend/src/lib/api/types.ts b/frontend/src/lib/api/types.ts
index 51ee665e..37f8ca14 100644
--- a/frontend/src/lib/api/types.ts
+++ b/frontend/src/lib/api/types.ts
@@ -754,6 +754,11 @@ export interface SessionSummary {
 	is_revoked: boolean;
 	is_active: boolean;
 	oidc_sid: string | null;
+	/** `true` when this row IS the admin's currently-active session —
+	 *  compared server-side by `dpop_jkt`. Panel uses this to warn
+	 *  before revoking ("this will log you out"). Always `false` when
+	 *  the admin's own session is unbound. */
+	is_current: boolean;
 }
 
 /** Wire response of `GET /api/admin/sessions`. */
diff --git a/frontend/src/lib/stores/session.svelte.ts b/frontend/src/lib/stores/session.svelte.ts
index 8a78e6cc..86148641 100644
--- a/frontend/src/lib/stores/session.svelte.ts
+++ b/frontend/src/lib/stores/session.svelte.ts
@@ -6,7 +6,7 @@
  * routing: externals (magic-link / OIDC-only / OCM recipients) have no home
  * folder and land on the shared-with-me view.
  */
-import { fetchMe, tryRefresh } from '$lib/api/endpoints/auth';
+import { bindDpopIfPossible, fetchMe, tryRefresh } from '$lib/api/endpoints/auth';
 import { drives } from '$lib/stores/drives.svelte';
 import type { User } from '$lib/api/types';
 import { ensureActiveUser } from '$lib/utils/localStoragePrefs';
@@ -45,8 +45,18 @@ class SessionStore {
 			if (!me && (await tryRefresh())) {
 				me = await fetchMe();
 			}
-			if (me) this.setUser(me);
-			else this.user = null;
+			if (me) {
+				this.setUser(me);
+				// Post-redirect DPoP bind — catches OIDC / magic-link
+				// flows whose server-side callback creates the session
+				// UNBOUND (no way for the redirect to carry the JKT in
+				// the callback body). One-shot per SPA lifetime because
+				// `this.loaded` guard makes `load()` a singleton;
+				// server returns 409 if the session is already bound
+				// (harmless — result is swallowed). Fire-and-forget so
+				// a slow IndexedDB open doesn't stall the app boot.
+				void bindDpopIfPossible();
+			} else this.user = null;
 		} catch {
 			this.user = null;
 		}
diff --git a/frontend/src/routes/admin/[[tab]]/+page.svelte b/frontend/src/routes/admin/[[tab]]/+page.svelte
index 081979c6..5621f386 100644
--- a/frontend/src/routes/admin/[[tab]]/+page.svelte
+++ b/frontend/src/routes/admin/[[tab]]/+page.svelte
@@ -879,16 +879,21 @@
 		}
 	}
 
-	async function onRevokeSession(id: string) {
-		if (
-			!confirm(
-				t(
+	async function onRevokeSession(id: string, isCurrent: boolean) {
+		// Escalated warning for the caller's own session — revoking it
+		// bricks the tab (all subsequent requests 401 → nav-guard bounces
+		// to /login). A plain "are you sure" was too easy to click
+		// through by muscle memory on a table of revoke buttons.
+		const message = isCurrent
+			? t(
+					'admin.sessions.revoke_self_confirm',
+					"⚠️  This is YOUR current session. Revoking it will log YOU out immediately and you'll have to sign back in. Continue?"
+				)
+			: t(
 					'admin.sessions.revoke_confirm',
 					'Revoke this session? The next request from that browser will 401.'
-				)
-			)
-		)
-			return;
+				);
+		if (!confirm(message)) return;
 		sessionRevokingId = id;
 		try {
 			await revokeAdminSession(id);
@@ -3024,8 +3029,22 @@
 							<tr
 								data-testid={`admin-sessions-row-${s.id}`}
 								class:muted={!s.is_active}
+								class:current-session={s.is_current}
 							>
-								<td class="mono" title={s.user_id}>{s.user_id.slice(0, 8)}…</td>
+								<td class="mono" title={s.user_id}>
+									{s.user_id.slice(0, 8)}…
+									{#if s.is_current}
+										<span
+											class="badge badge-info"
+											title={t(
+												'admin.sessions.current_tooltip',
+												"This is the session you're using right now — revoking it will log you out."
+											)}
+										>
+											{t('admin.sessions.current', 'you')}
+										</span>
+									{/if}
+								</td>
 								<td>{new Date(s.created_at).toLocaleString()}</td>
 								<td>{new Date(s.expires_at).toLocaleString()}</td>
 								<td class="mono">{s.ip_address ?? '—'}</td>
@@ -3065,7 +3084,7 @@
 										<button
 											class="btn btn-danger btn-sm"
 											data-testid={`admin-sessions-revoke-btn-${s.id}`}
-											onclick={() => void onRevokeSession(s.id)}
+											onclick={() => void onRevokeSession(s.id, s.is_current)}
 											disabled={sessionRevokingId === s.id}
 										>
 											{sessionRevokingId === s.id
@@ -4147,6 +4166,14 @@
 </Modal>
 
 <style>
+	/* Admin sessions panel — accent the caller's own row so revoking
+	   it can't happen by muscle memory. Left border + tinted bg pull
+	   the eye; JS confirms with an escalated message on top of that. */
+	.current-session {
+		background: var(--color-bg-accent-subtle, color-mix(in srgb, var(--color-accent) 8%, transparent));
+		border-left: 3px solid var(--color-accent);
+	}
+
 	.logs-toolbar {
 		display: flex;
 		gap: var(--space-2);
diff --git a/frontend/src/routes/login/+page.svelte b/frontend/src/routes/login/+page.svelte
index 813a8e2d..fcb911f7 100644
--- a/frontend/src/routes/login/+page.svelte
+++ b/frontend/src/routes/login/+page.svelte
@@ -9,6 +9,7 @@
 	import { onMount } from 'svelte';
 	import { ApiError } from '$lib/api/client';
 	import {
+		bindDpopIfPossible,
 		exchangeOidcCode,
 		fetchMe,
 		getAuthStatus,
@@ -378,6 +379,14 @@
 			const user = await exchangeOidcCode(oidcCode);
 			if (user) {
 				session.setUser(user);
+				// OIDC callback creates the session UNBOUND (redirect flow can't
+				// carry a JKT in the callback body). Post-redirect bind here
+				// attaches the browser keypair — one-shot, idempotent (server
+				// returns 409 if already bound). Awaited so subsequent requests
+				// under `DPOP=required` land with a bound session, not an
+				// unbound one that would 401 on the very next thumbnail. See
+				// `docs/plan/dpop.md` Gate 3.
+				await bindDpopIfPossible();
 				await goto(resolve(redirectTarget), { replaceState: true });
 				return;
 			}
diff --git a/src/application/dtos/session_dto.rs b/src/application/dtos/session_dto.rs
index 0554f6a1..b6a4056a 100644
--- a/src/application/dtos/session_dto.rs
+++ b/src/application/dtos/session_dto.rs
@@ -50,16 +50,38 @@ pub struct SessionSummaryDto {
     /// IdP emitted `sid` — otherwise `None`. Useful when an operator is
     /// correlating with the upstream IdP's session log.
     pub oidc_sid: Option<String>,
+    /// `true` when this row IS the caller's currently-active session —
+    /// set by the service layer by comparing the row's `dpop_jkt` with
+    /// the caller's own bound thumbprint. Lets the admin panel flag
+    /// "revoking this cuts your own branch" so an admin doesn't
+    /// accidentally log themselves out. `false` when either side is
+    /// unbound (can't correlate) or when the jkts don't match.
+    pub is_current: bool,
 }
 
 impl From<Session> for SessionSummaryDto {
     fn from(s: Session) -> Self {
+        Self::from_session(s, None)
+    }
+}
+
+impl SessionSummaryDto {
+    /// Build the DTO with an optional `caller_jkt` used to compute
+    /// `is_current`. Pass the admin caller's DPoP thumbprint to have
+    /// the panel highlight the caller's own row; pass `None` when
+    /// the caller is unbound (no jkt = no correlation) or from
+    /// non-admin contexts.
+    pub fn from_session(s: Session, caller_jkt: Option<&str>) -> Self {
         let is_revoked = s.is_revoked();
         let is_expired = s.is_expired();
         let jkt = s.dpop_jkt().map(|s| s.to_owned());
         let dpop_jkt_prefix = jkt
             .as_ref()
             .map(|t| t.chars().take(8).collect::<String>());
+        let is_current = match (jkt.as_deref(), caller_jkt) {
+            (Some(row), Some(caller)) => row == caller,
+            _ => false,
+        };
         Self {
             id: s.id(),
             user_id: s.user_id(),
@@ -72,6 +94,7 @@ impl From<Session> for SessionSummaryDto {
             is_revoked,
             is_active: !is_revoked && !is_expired,
             oidc_sid: s.oidc_sid().map(str::to_owned),
+            is_current,
         }
     }
 }
diff --git a/src/application/services/auth_application_service.rs b/src/application/services/auth_application_service.rs
index 528119c7..ee700931 100644
--- a/src/application/services/auth_application_service.rs
+++ b/src/application/services/auth_application_service.rs
@@ -2963,6 +2963,7 @@ impl AuthApplicationService {
         &self,
         authorization: &A,
         caller_id: Uuid,
+        caller_dpop_jkt: Option<&str>,
         user_id_filter: Option<Uuid>,
         include_revoked: bool,
         limit: i64,
@@ -2975,7 +2976,12 @@ impl AuthApplicationService {
             .await?;
         Ok(sessions
             .into_iter()
-            .map(crate::application::dtos::session_dto::SessionSummaryDto::from)
+            .map(|s| {
+                crate::application::dtos::session_dto::SessionSummaryDto::from_session(
+                    s,
+                    caller_dpop_jkt,
+                )
+            })
             .collect())
     }
 
diff --git a/src/interfaces/api/handlers/admin_handler.rs b/src/interfaces/api/handlers/admin_handler.rs
index cea20273..cdfbe976 100644
--- a/src/interfaces/api/handlers/admin_handler.rs
+++ b/src/interfaces/api/handlers/admin_handler.rs
@@ -1238,11 +1238,20 @@ pub async fn list_sessions(
         None => None,
     };
 
+    // Pass the caller's DPoP thumbprint so the DTO can flag which
+    // row is the admin's own current session (`is_current = true`).
+    // Rendered as a "this is you" badge — prevents the admin from
+    // accidentally revoking the session they're clicking from.
+    // `None` when the admin is unbound (rare — legacy / migration
+    // window sessions), in which case no row highlights.
+    let caller_jkt = auth_user.dpop_jkt.as_deref();
+
     let sessions = auth
         .auth_application_service
         .admin_list_sessions_with_perms(
             state.authorization.as_ref(),
             auth_user.id,
+            caller_jkt,
             user_id_filter,
             include_revoked,
             limit,