security(session): do not expose 'sid' from OIDC

prefer exposing origin of the session: passwod, opaque, magic_link, oidc, unknown
2026-08-09 15:14:59 +02:00
parent c28eb9b42e
commit 763ee82028
8 changed files with 225 additions and 17 deletions
@@ -0,0 +1,36 @@
+-- Session origin — how the row was minted.
+--
+-- Populated at session-mint time by each login handler (legacy password,
+-- OPAQUE aPAKE, magic-link redemption, OIDC callback, RFC 8628 device
+-- authorization). Refresh copies the parent session's origin (a refresh
+-- doesn't change how the user originally authenticated). Existing rows
+-- predating this column default to `unknown`.
+--
+-- Purpose: gives admins a first-class filter on the sessions panel
+-- ("show me only the OIDC sessions", "spot the magic-link ones during
+-- a suspected phishing wave") without them having to infer from
+-- adjacent fields (`oidc_id_token IS NOT NULL` etc.). Also drives
+-- correlation with audit lines that already carry the same enum.
+--
+-- Stored as `text` rather than a PG ENUM: enums lock the schema (adding
+-- a new variant needs a migration + release coordination), whereas a
+-- checked text column can gain values by editing the constraint. The
+-- Rust `SessionOrigin` enum uses `#[serde(rename_all = "snake_case")]`
+-- so wire values match column values one-to-one.
+--
+-- No index — origin is a display column read alongside the row by PK;
+-- filtering happens client-side in the admin panel (page size caps at
+-- 100, so scanning is fine).
+ALTER TABLE auth.sessions
+    ADD COLUMN IF NOT EXISTS origin TEXT NOT NULL DEFAULT 'unknown';
+
+-- Enforce the known values at the storage layer so a rogue INSERT
+-- can't smuggle an arbitrary string that would then confuse the
+-- serde-typed enum deserialize on read. Adding a new variant is a
+-- one-line ALTER + Rust enum change.
+ALTER TABLE auth.sessions
+    ADD CONSTRAINT sessions_origin_known
+    CHECK (origin IN ('password', 'opaque', 'magic_link', 'oidc', 'device', 'unknown'));
+
+COMMENT ON COLUMN auth.sessions.origin IS
+    'How this session was minted: password | opaque | magic_link | oidc | device | unknown. Set at INSERT time by the login handler; carried over on refresh.';