fix(auth): enforce credential issuance boundaries (phase 2)

[pandemicsyn]

Stack

Depends on #5785. This PR intentionally targets feat/token-issuance-policy-contracts; its diff contains Phase 2 only. Retarget to main after Phase 1 merges, adjusting the stack if needed.

Summary

• Require current NextAuth web sessions for device authorization approval and profile/editor credential disclosure; reject bearer/mixed authentication on those surfaces.
• Gate native exchange with Phase 1 audience and exchange-eligibility policy, current primary-database account state, exact pepper equality, and environment validation. Preserve the explicit five-year legacy API migration exception and existing mobile response contract.
• Require configured same-origin requests for cookie-authenticated approval/exchange, without requiring Origin for native bearer clients; mark exchange responses no-store.
• Remove incidental token minting from customer information reads and pass only the token to the profile integrations component.
• Add real signed-token/account integration regressions, endpoint tests, and disclosure tests; enable Jest transformation of the shared policy module’s ESM jose dependency.

Compatibility and scope

• Existing ordinary API authentication and opaque refresh-grant rotation remain unchanged. No global token invalidation, signing-key rotation, or pepper reset.
• The narrow legacy exchange exception accepts both historical five-year lifetimes. Unmarked legacy automation can still be indistinguishable from human API tokens; this is a compatibility exception, not proof of human origin.
• Cloud Agent/App Builder indirect reissuance, Worker audience-reader/issuer migrations, and service renewal redesign remain deferred. This PR closes the audited direct approval/exchange/disclosure paths, not every bearer-triggered downstream mint.
• Previously approved device requests can remain redeemable until their existing approximately ten-minute expiry.

Validation

• 333 tests passed across 15 targeted web suites, including real-guard integration tests and adjacent native refresh, device sessions, device authorization, token, session-revocation, and promotional-credit regressions.
• pnpm --filter web lint passed.
• pnpm --filter web typecheck passed; declaration bundling emitted external-dependency warnings.
• Changed files formatted with pnpm format; git diff --check passed.
• No production requests or browser E2E run performed.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Phase 2 credential-issuance enforcement is consistent across approval, native exchange, and disclosure paths: session-only guards reject bearer/mixed auth, cookie flows are origin-gated, and bearer exchange applies Phase 1 audience/eligibility plus primary-DB pepper checks.

Files Reviewed (16 files)

• apps/web/jest.config.ts
• apps/web/src/app/(app)/profile/page.test.ts
• apps/web/src/app/(app)/profile/page.tsx
• apps/web/src/app/api/auth/native/exchange/route.integration.test.ts
• apps/web/src/app/api/auth/native/exchange/route.test.ts
• apps/web/src/app/api/auth/native/exchange/route.ts
• apps/web/src/app/api/device-auth/tokens/route.integration.test.ts
• apps/web/src/app/api/device-auth/tokens/route.test.ts
• apps/web/src/app/api/device-auth/tokens/route.ts
• apps/web/src/app/sign-in-to-editor/page.test.ts
• apps/web/src/app/sign-in-to-editor/page.tsx
• apps/web/src/components/profile/IntegrationsCard.tsx
• apps/web/src/lib/customerInfo.test.ts
• apps/web/src/lib/customerInfo.ts
• apps/web/src/lib/user/server.test.ts
• apps/web/src/lib/user/server.ts

Previous Review Summary (commit cbf3dd1)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit cbf3dd1)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Phase 2 credential-issuance enforcement is consistent across approval, native exchange, and disclosure paths: session-only guards reject bearer/mixed auth, cookie flows are origin-gated, and bearer exchange applies Phase 1 audience/eligibility plus primary-DB pepper checks.

Files Reviewed (16 files)

• apps/web/jest.config.ts
• apps/web/src/app/(app)/profile/page.test.ts
• apps/web/src/app/(app)/profile/page.tsx
• apps/web/src/app/api/auth/native/exchange/route.integration.test.ts
• apps/web/src/app/api/auth/native/exchange/route.test.ts
• apps/web/src/app/api/auth/native/exchange/route.ts
• apps/web/src/app/api/device-auth/tokens/route.integration.test.ts
• apps/web/src/app/api/device-auth/tokens/route.test.ts
• apps/web/src/app/api/device-auth/tokens/route.ts
• apps/web/src/app/sign-in-to-editor/page.test.ts
• apps/web/src/app/sign-in-to-editor/page.tsx
• apps/web/src/components/profile/IntegrationsCard.tsx
• apps/web/src/lib/customerInfo.test.ts
• apps/web/src/lib/customerInfo.ts
• apps/web/src/lib/user/server.test.ts
• apps/web/src/lib/user/server.ts

---

_{Reviewed by grok-4.6 · Input: 113.9K · Output: 15.4K · Cached: 515.6K}

_{Review guidance: REVIEW.md from base branch main}