Skip to content

feat(rewrite): complete Phase 2 security and browser surface - #395

Open
mira-2026 wants to merge 9 commits into
mira/greenfield-rewrite-delivery-foundationfrom
mira/greenfield-rewrite-phase-two-completion
Open

feat(rewrite): complete Phase 2 security and browser surface#395
mira-2026 wants to merge 9 commits into
mira/greenfield-rewrite-delivery-foundationfrom
mira/greenfield-rewrite-phase-two-completion

Conversation

@mira-2026

@mira-2026 mira-2026 commented Aug 7, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Complete the remaining Phase 2 server surface with bounded security-audit reads and atomic revoke-other/revoke-all session operations.
  • Add the production browser login and account-security experience using the shared accessible UI system, Headless UI, TanStack Form/Table/Virtual, Lucide icons, Valibot validation, and lazy feature routes.
  • Harden the shared Bun/browser test runtime, split coverage collection without leaking DOM globals into server tests, and fix a deployment-lock publication race exposed by the non-isolated suite.
  • Extend contract/schema documentation for the new procedures and keep the future-root package, boundaries, and generated artifacts synchronized.

Behavior and regression coverage

  • Session mutations revalidate the actor inside the immediate transaction, audit real state changes atomically, preserve the retained session for revoke-other, and clear the current cookie for revoke-all.
  • Security-audit pagination is session-only, bounded, newest-first, keyset-based, metadata-allowlisted, and fail-closed for invalid persisted rows.
  • Passwords, MFA material, recovery codes, WebAuthn ceremonies, and newly issued automation credentials remain ephemeral browser state and are never placed in the query cache.
  • Browser tests use one maintained Happy DOM setup with deterministic cleanup; all other tests run without DOM globals and against a private test project root.

Verification

  • Source boundaries: bun run check:boundaries
  • Repository lint: bun run lint
  • Browser and Bun type graphs: bun run typecheck
  • Repository formatting: bun run format:check
  • Bun suite: bun run test:bun — 1,317 passed
  • Browser suite: bun run test:browser — 28 passed
  • Coverage: bun run test:coverage — 92.03% (28,650 / 31,130 lines; threshold 85%)
  • Generated documentation: bun run docs:check
  • Database schema/manifest: bun run db:check
  • Patch hygiene: git diff --check

Risk checklist

  • No secrets, tokens, .env files, database dumps, or runtime state committed
  • Authentication, sessions, MFA, automation credentials, and audit reads were reviewed as trust-boundary changes
  • New procedures use typed contracts, validation, exact runtime error policy, and focused regression tests
  • No database migration is introduced by this layer
  • UI keeps the existing Dashboard palette/layout while centralizing reusable, accessible primitives

Deployment / operations

Notes for reviewers

Please focus on transaction-time session revalidation, cookie clearing after revoke-all, audit cursor/redaction behavior, ephemeral handling of security secrets, and the non-isolated test/coverage lifecycle.

@mira-2026
mira-2026 requested a review from rajohan as a code owner August 7, 2026 06:35
@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown

Important

Review skipped

Too many files!

This PR contains 159 files, which is 59 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e26a3637-a55c-4bb0-8ea6-4be2f61d6e7b

📥 Commits

Reviewing files that changed from the base of the PR and between f28909a and 5c05ff0.

⛔ Files ignored due to path filters (9)
  • greenfield/bun.lock is excluded by !**/*.lock and included by **/*
  • greenfield/docs/generated/packages-and-runtime.md is excluded by !**/generated/** and included by **/*
  • greenfield/docs/generated/procedures.md is excluded by !**/generated/** and included by **/*
  • greenfield/docs/generated/schemas/auth.revokeAllSessions.input.schema.json is excluded by !**/generated/** and included by **/*
  • greenfield/docs/generated/schemas/auth.revokeAllSessions.output.schema.json is excluded by !**/generated/** and included by **/*
  • greenfield/docs/generated/schemas/auth.revokeOtherSessions.input.schema.json is excluded by !**/generated/** and included by **/*
  • greenfield/docs/generated/schemas/auth.revokeOtherSessions.output.schema.json is excluded by !**/generated/** and included by **/*
  • greenfield/docs/generated/schemas/securityAudit.listEvents.input.schema.json is excluded by !**/generated/** and included by **/*
  • greenfield/docs/generated/schemas/securityAudit.listEvents.output.schema.json is excluded by !**/generated/** and included by **/*
📒 Files selected for processing (159)
  • greenfield/bunfig.toml
  • greenfield/docs/architecture/greenfield-rewrite/runtime-and-delivery.md
  • greenfield/docs/development/testing-and-prs.md
  • greenfield/docs/security/greenfield-phase-two-threat-model.md
  • greenfield/drizzle.config.ts
  • greenfield/package.json
  • greenfield/scripts/delivery/buildAdmission.test.ts
  • greenfield/scripts/delivery/deploymentLease.test.ts
  • greenfield/scripts/delivery/exclusiveProcessLock.ts
  • greenfield/scripts/delivery/productionReleaseActivation.test.ts
  • greenfield/scripts/documentation/jsonSchema.test.ts
  • greenfield/scripts/documentation/jsonSchema.ts
  • greenfield/scripts/frontendBuildArtifacts.ts
  • greenfield/scripts/runCoverage.test.ts
  • greenfield/scripts/runCoverage.ts
  • greenfield/scripts/sourceBoundaries/boundaryConfiguration.ts
  • greenfield/scripts/sourceBoundaries/lintConfiguration.test.ts
  • greenfield/scripts/testOutputPolicy.test.ts
  • greenfield/scripts/testOutputPolicy.ts
  • greenfield/src/app/dashboardServer.ts
  • greenfield/src/app/server.ts
  • greenfield/src/app/trpcHttpHandler.ts
  • greenfield/src/app/trpcRequestPolicy.test.ts
  • greenfield/src/app/trpcRequestPolicy.ts
  • greenfield/src/browser/api/queryClient.ts
  • greenfield/src/browser/api/trpcClient.test.ts
  • greenfield/src/browser/api/trpcClient.ts
  • greenfield/src/browser/api/trpcContext.tsx
  • greenfield/src/browser/api/trpcContextValue.ts
  • greenfield/src/browser/api/trpcError.ts
  • greenfield/src/browser/application.test.tsx
  • greenfield/src/browser/application.tsx
  • greenfield/src/browser/auth/AuthenticatedSessionActivity.test.tsx
  • greenfield/src/browser/auth/AuthenticatedSessionActivity.tsx
  • greenfield/src/browser/auth/AuthenticationBoundary.test.tsx
  • greenfield/src/browser/auth/AuthenticationBoundary.tsx
  • greenfield/src/browser/auth/BootstrapForm.tsx
  • greenfield/src/browser/auth/LoginPanel.tsx
  • greenfield/src/browser/auth/LoginRoute.test.tsx
  • greenfield/src/browser/auth/LoginRoute.tsx
  • greenfield/src/browser/auth/PasswordLoginForm.tsx
  • greenfield/src/browser/auth/PendingMfaForm.tsx
  • greenfield/src/browser/auth/authQueries.ts
  • greenfield/src/browser/auth/useAuthenticationAction.ts
  • greenfield/src/browser/bootstrap.tsx
  • greenfield/src/browser/hooks/useExclusiveDashboardAction.ts
  • greenfield/src/browser/index.css
  • greenfield/src/browser/index.html
  • greenfield/src/browser/layout/DashboardShell.tsx
  • greenfield/src/browser/lazyBootstrap.tsx
  • greenfield/src/browser/lib/classNames.ts
  • greenfield/src/browser/lib/formatDateTime.ts
  • greenfield/src/browser/main.test.tsx
  • greenfield/src/browser/main.tsx
  • greenfield/src/browser/routeComponents.tsx
  • greenfield/src/browser/router.tsx
  • greenfield/src/browser/routes/accountSecurity.lazy.tsx
  • greenfield/src/browser/routes/login.lazy.tsx
  • greenfield/src/browser/routes/overview.lazy.tsx
  • greenfield/src/browser/security/AccountSecurityRoute.test.tsx
  • greenfield/src/browser/security/AccountSecurityRoute.tsx
  • greenfield/src/browser/security/AutomationCapabilityPicker.tsx
  • greenfield/src/browser/security/AutomationCredentialPanel.tsx
  • greenfield/src/browser/security/AutomationPrincipalCard.test.tsx
  • greenfield/src/browser/security/AutomationPrincipalCard.tsx
  • greenfield/src/browser/security/AutomationSecuritySection.tsx
  • greenfield/src/browser/security/MfaManagementSection.tsx
  • greenfield/src/browser/security/MfaRecoveryControls.tsx
  • greenfield/src/browser/security/PasswordChangeForm.tsx
  • greenfield/src/browser/security/SecurityAuditSection.tsx
  • greenfield/src/browser/security/SecurityProofControls.tsx
  • greenfield/src/browser/security/SecurityUi.tsx
  • greenfield/src/browser/security/SecurityVerificationSection.tsx
  • greenfield/src/browser/security/SessionManagementSection.tsx
  • greenfield/src/browser/security/TotpFactorManagement.tsx
  • greenfield/src/browser/security/WebAuthnFactorManagement.tsx
  • greenfield/src/browser/security/issuedAutomationToken.test.ts
  • greenfield/src/browser/security/issuedAutomationToken.ts
  • greenfield/src/browser/security/mfaFormSchemas.ts
  • greenfield/src/browser/security/securityQueries.ts
  • greenfield/src/browser/security/webauthn/webauthnClient.test.ts
  • greenfield/src/browser/security/webauthn/webauthnClient.ts
  • greenfield/src/browser/security/webauthn/webauthnContext.tsx
  • greenfield/src/browser/security/webauthn/webauthnContextValue.ts
  • greenfield/src/browser/test/fixtures/frontendBuild/index.html
  • greenfield/src/browser/test/fixtures/frontendBuild/src/FixtureApp.tsx
  • greenfield/src/browser/test/fixtures/frontendBuild/src/LazyPanel.tsx
  • greenfield/src/browser/test/fixtures/frontendBuild/src/index.css
  • greenfield/src/browser/test/fixtures/frontendBuild/src/main.tsx
  • greenfield/src/browser/test/setup.ts
  • greenfield/src/browser/testSupport/browserTestEnvironment.ts
  • greenfield/src/browser/testSupport/browserTestPreload.ts
  • greenfield/src/browser/ui/ActionLink.tsx
  • greenfield/src/browser/ui/Alert.tsx
  • greenfield/src/browser/ui/AppErrorFallback.tsx
  • greenfield/src/browser/ui/Badge.tsx
  • greenfield/src/browser/ui/Button.tsx
  • greenfield/src/browser/ui/Card.tsx
  • greenfield/src/browser/ui/Checkbox.tsx
  • greenfield/src/browser/ui/ConfirmModal.tsx
  • greenfield/src/browser/ui/DataTable.test.tsx
  • greenfield/src/browser/ui/DataTable.tsx
  • greenfield/src/browser/ui/EmptyState.tsx
  • greenfield/src/browser/ui/ExpandableCard.tsx
  • greenfield/src/browser/ui/Form.tsx
  • greenfield/src/browser/ui/FormField.tsx
  • greenfield/src/browser/ui/Heading.tsx
  • greenfield/src/browser/ui/Icon.tsx
  • greenfield/src/browser/ui/IconOnlyButton.tsx
  • greenfield/src/browser/ui/Input.tsx
  • greenfield/src/browser/ui/LoadingState.tsx
  • greenfield/src/browser/ui/Modal.tsx
  • greenfield/src/browser/ui/NavigationLink.tsx
  • greenfield/src/browser/ui/PageHeader.tsx
  • greenfield/src/browser/ui/PageState.tsx
  • greenfield/src/browser/ui/Text.tsx
  • greenfield/src/browser/ui/Virtualizer.tsx
  • greenfield/src/browser/ui/buttonStyles.ts
  • greenfield/src/browser/ui/formErrors.ts
  • greenfield/src/browser/ui/formFieldContext.ts
  • greenfield/src/contracts/accountSecurity.test.ts
  • greenfield/src/contracts/accountSecurity.ts
  • greenfield/src/contracts/auth.test.ts
  • greenfield/src/contracts/auth.ts
  • greenfield/src/contracts/contractRegistry.ts
  • greenfield/src/contracts/registry.ts
  • greenfield/src/contracts/securityAudit.test.ts
  • greenfield/src/contracts/securityAudit.ts
  • greenfield/src/server/domains/security/audit.ts
  • greenfield/src/server/domains/security/authSessionRoutes.ts
  • greenfield/src/server/domains/security/authenticationLifecycle.sessions.test.ts
  • greenfield/src/server/domains/security/authenticationLifecycleRepository.ts
  • greenfield/src/server/domains/security/authenticationLifecycleSessions.ts
  • greenfield/src/server/domains/security/authenticationLifecycleTypes.ts
  • greenfield/src/server/domains/security/browserSessionStore.ts
  • greenfield/src/server/domains/security/mfa/lifecycleRepositoryUnitOfWork.ts
  • greenfield/src/server/domains/security/pendingLoginStore.ts
  • greenfield/src/server/domains/security/procedures.test.ts
  • greenfield/src/server/domains/security/securityAuditLifecycle.test.ts
  • greenfield/src/server/domains/security/securityAuditLifecycle.ts
  • greenfield/src/server/domains/security/securityAuditLifecycleRepository.ts
  • greenfield/src/server/domains/security/securityAuditProcedures.test.ts
  • greenfield/src/server/domains/security/securityAuditProcedures.ts
  • greenfield/src/server/domains/security/securityAuditRoutes.ts
  • greenfield/src/server/domains/security/securityAuditStore.ts
  • greenfield/src/server/test/support/requestContext.ts
  • greenfield/src/server/trpc/appRouter.ts
  • greenfield/src/server/trpc/context.test.ts
  • greenfield/src/server/trpc/context.ts
  • greenfield/src/server/trpc/procedureErrorPolicy.ts
  • greenfield/src/shared/validation.test.ts
  • greenfield/src/shared/validation.ts
  • greenfield/src/test/integration/build/frontendBuildScenario.ts
  • greenfield/src/test/parity/fixtures/greenfield-contracts.json
  • greenfield/src/test/parity/fixtures/legacy-endpoints.json
  • greenfield/src/test/parity/parityInventory.test.ts
  • greenfield/src/test/setup.test.ts
  • greenfield/src/test/setup.ts
  • greenfield/tsconfig.browser.json

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Review on demand using usage pricing

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@mira-2026 mira-2026 added the status: needs-review Ready for human or agent review label Aug 7, 2026
@mira-2026 mira-2026 changed the title mira/greenfield rewrite phase two completion feat(rewrite): complete Phase 2 security and browser surface Aug 7, 2026
@mira-2026 mira-2026 added type: feature Adds user-visible functionality type: security Security, auth, secrets, or trust-boundary work type: tests Adds or updates automated tests/coverage area: auth Authentication, sessions, pairing, or access control area: frontend Frontend UI, client state, routing, and browser behavior area: backend Backend API, server routes, services, and integrations area: ci CI, test runners, workflow checks, and release gates labels Aug 7, 2026
@mira-2026
mira-2026 force-pushed the mira/greenfield-rewrite-phase-two-completion branch from 424eea3 to 8cf561e Compare August 7, 2026 06:45

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 23041b9f64

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread greenfield/src/browser/security/AutomationSecuritySection.tsx Outdated
Comment thread greenfield/src/browser/security/AutomationPrincipalCard.tsx Outdated
Comment thread greenfield/src/browser/auth/AuthenticationBoundary.tsx Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3e0cdb2cd8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread greenfield/scripts/runCoverage.ts Outdated
Comment thread greenfield/src/browser/security/WebAuthnFactorManagement.tsx
Comment thread greenfield/src/browser/auth/useAuthenticationAction.ts Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e9d43d0fe5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread greenfield/src/browser/auth/AuthenticatedSessionActivity.tsx Outdated
Comment thread greenfield/src/browser/ui/DataTable.tsx Outdated
Comment thread greenfield/src/browser/auth/AuthenticatedSessionActivity.tsx Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 949827a68b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread greenfield/src/browser/security/AutomationCredentialPanel.tsx Outdated
Comment thread greenfield/package.json Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d0121bdc7c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread greenfield/src/browser/auth/AuthenticationBoundary.tsx Outdated
Comment thread greenfield/src/server/domains/security/authSessionRoutes.ts
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: auth Authentication, sessions, pairing, or access control area: backend Backend API, server routes, services, and integrations area: ci CI, test runners, workflow checks, and release gates area: frontend Frontend UI, client state, routing, and browser behavior status: needs-review Ready for human or agent review type: feature Adds user-visible functionality type: security Security, auth, secrets, or trust-boundary work type: tests Adds or updates automated tests/coverage

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant