fix: harden auth with refresh token session binding, logging, and router state

- Add session_id to refresh tokens and enforce it during validation,
  preventing stolen refresh tokens from being usable without the
  originating browser session
- Set router.isAuthenticated via auth:login event after successful
  login (previously only set at page load)
- Add console.warn logging to WS message parse/handler errors
- Improve _refreshPromise error handling in token refresh flow
- Document rate limiter in-memory limitation and CSP connect-src
  same-origin requirement
- Add 3 tests for session-bound refresh token validation

daemon/handlers/auth.py

@@ -155,10 +155,11 @@ def auth_refresh(_request: Any, body: Any) -> dict[str, Any]:
     """Handle token refresh.
 
     Validates the refresh token, blacklists it, and issues a new access token.
+    Requires refresh_token and session_id in the request body for session binding.
 
     Args:
         _request: Unused.
-        body: Dict with ``refresh_token``.
+        body: Dict with ``refresh_token`` and ``session_id``.
 
     Returns:
         Dict with new access token, refresh token, user, and permissions.
@@ -173,7 +174,8 @@ def auth_refresh(_request: Any, body: Any) -> dict[str, Any]:
     if not refresh_token:
         raise ValueError("refresh_token is required")
 
-    payload = validate_token(refresh_token, token_type="refresh")
+    session_id = body.get("session_id")
+    payload = validate_token(refresh_token, token_type="refresh", session_id=session_id)
     if payload is None:
         raise ValueError("Invalid or expired refresh token")
 

lib/auth.py

@@ -126,11 +126,15 @@ def generate_access_token(
     return jwt.encode(payload, secret, algorithm=algorithm)
 
 
-def generate_refresh_token(username: str) -> str:
+def generate_refresh_token(username: str, session_id: str | None = None) -> str:
     """Generate a new refresh token for *username*.
 
     Args:
         username: The authenticated username.
+        session_id: Session binding ID included in the token payload.
+            When present, the refresh endpoint requires a matching session_id,
+            preventing a stolen refresh token from being usable without the
+            originating browser session.
 
     Returns:
         JWT refresh token string.
@@ -150,6 +154,8 @@ def generate_refresh_token(username: str) -> str:
         "jti": str(uuid.uuid4()),
         "type": "refresh",
     }
+    if session_id:
+        payload["session_id"] = session_id
     return jwt.encode(payload, secret, algorithm=algorithm)
 
 
@@ -165,7 +171,7 @@ def generate_tokens(username: str, permissions: dict[str, str]) -> dict[str, str
     """
     session_id = secrets.token_urlsafe(16)
     access_token = generate_access_token(username, permissions, session_id)
-    refresh_token = generate_refresh_token(username)
+    refresh_token = generate_refresh_token(username, session_id)
     _persist_refresh_token(username, refresh_token)
     return {
         "access_token": access_token,
@@ -397,7 +403,9 @@ class RateLimiter:
                 del self.failures[key]
 
 
-# Global rate limiters
+# Global rate limiters — in-memory only. Counts reset on daemon restart
+# (SIGHUP reload, process restart). Acceptable for a single-user appliance
+# where restarts are rare; brute-force windows briefly reset post-restart.
 _login_limiter = RateLimiter(max_attempts=10, window_seconds=300)
 _webauthn_limiter = RateLimiter(max_attempts=5, window_seconds=600)
 

tests/test_auth.py

@@ -811,6 +811,30 @@ class TestTokenValidationEdgeCases:
         payload = validate_token(token, "refresh")
         assert payload is None
 
+    def test_refresh_token_with_session_id_validates(self) -> None:
+        """Refresh token with session_id validates when matching session_id provided."""
+        create_user("sessuser", "password123")
+        token = generate_refresh_token("sessuser", session_id="mysession")
+        payload = validate_token(token, "refresh", session_id="mysession")
+        assert payload is not None
+        assert payload["sub"] == "sessuser"
+        assert payload["session_id"] == "mysession"
+
+    def test_refresh_token_with_wrong_session_id_rejected(self) -> None:
+        """Refresh token with session_id is rejected when wrong session_id provided."""
+        create_user("sessuser", "password123")
+        token = generate_refresh_token("sessuser", session_id="mysession")
+        payload = validate_token(token, "refresh", session_id="wrongsession")
+        assert payload is None
+
+    def test_refresh_token_generate_tokens_includes_session_id(self) -> None:
+        """generate_tokens produces refresh token with session_id."""
+        create_user("tokuser", "password123")
+        tokens = generate_tokens("tokuser", {"firewall": "rw"})
+        refresh = decode_token(tokens["refresh_token"])
+        assert refresh is not None
+        assert refresh["session_id"] == tokens["session_id"]
+
 
 # ═══════════════════════════════════════════════════════════════════════════
 # Multi-user tests (Phase 3)

webui/server.py

@@ -259,6 +259,9 @@ def _log_request_finish(response):
     )
 
     # Content Security Policy — prevent inline script execution and XSS
+    # NOTE: connect-src 'self' is safe because all XHR/fetch/WS calls go through
+    # nginx on the same origin. If WS or API routing ever changes to use a
+    # different host/port directly, the CSP must be updated accordingly.
     if "Content-Security-Policy" not in response.headers:
         response.headers["Content-Security-Policy"] = (
             "default-src 'self'; "

webui/static/app.js

@@ -263,6 +263,14 @@ export async function initApp() {
         render(mainEl, MainContent);
     }
 
+    // Listen for login events to update router state after auth
+    window.addEventListener('auth:login', () => {
+        router.isAuthenticated = true;
+        if (!router.state.path.startsWith('/login')) {
+            fetchInitialData();
+        }
+    });
+
     // Check auth state before connecting WS
     const ok = await initAuth();
     if (ok) {

webui/static/hoover/api.js

@@ -83,8 +83,9 @@ let _refreshPromise = null;
  *
  * @returns {Promise<boolean>} ``true`` if refresh succeeded
  */
-async function tryRefreshToken() {
-    _refreshPromise = _refreshPromise || (async () => {
+ async function tryRefreshToken() {
+    if (!_refreshPromise) {
+        _refreshPromise = (async () => {
             try {
                 const stored = getStoredAuth();
                 if (!stored.refresh) return false;
@@ -92,7 +93,7 @@ async function tryRefreshToken() {
                 const res = await fetch('/api/auth/refresh', {
                     method: 'POST',
                     headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-                body: JSON.stringify({ refresh_token: stored.refresh }),
+                    body: JSON.stringify({ refresh_token: stored.refresh, session_id: stored.session_id }),
                     credentials: 'same-origin',
                 });
                 if (res.status !== 200) {
@@ -113,11 +114,13 @@ async function tryRefreshToken() {
                     sessionStorage.setItem('vw:user', JSON.stringify(json.data.user));
                 }
                 return true;
-        } catch {
+            } catch (err) {
+                console.warn('[Auth] Token refresh failed:', err);
                 clearAuthTokens();
                 return false;
             }
         })();
+    }
     return _refreshPromise.finally(() => { _refreshPromise = null; });
 }
 

webui/static/hoover/components/auth.js

@@ -130,6 +130,13 @@ export function handleLoginSuccess(data, redirectPath = '/dashboard') {
         }
         scheduleTokenRefresh();
     }
+    // Notify app.js that auth is established (used to set router.isAuthenticated)
+    window.dispatchEvent(new CustomEvent('auth:login', {
+        detail: {
+            permissions: sessionStorage.getItem('vw:permissions') ?
+                JSON.parse(sessionStorage.getItem('vw:permissions')) : {},
+        },
+    }));
     window.location.hash = redirectPath;
 }
 

webui/static/hoover/websocket.js

@@ -91,7 +91,9 @@ function _wsConnect() {
         try {
             const msg = typeof ev.data === 'string' ? JSON.parse(ev.data) : ev.data;
             handleMessage(msg);
-        } catch (_) {}
+        } catch (err) {
+            console.warn('[WS] Failed to parse message:', err);
+        }
     };
 }
 
@@ -124,7 +126,7 @@ function handleMessage(msg) {
     for (const h of _directHandlers) {
         if (h.unsubscribed) continue;
         if (topics.some(t => h.topics.includes(t) || h.topics.includes('*'))) {
-            try { h.handler(msg); } catch (_) {}
+            try { h.handler(msg); } catch (err) { console.warn('[WS] Handler error:', err); }
         }
     }
 }