fix(auth): make diagnostics bounded and portable

backend/src/auth/authentik-group-catalog.ts

@@ -1,4 +1,5 @@
 import type { AuthDiagnostic, GroupCatalog } from "./group-catalog.js";
+import { isUsableAuthenticationSecret } from "./secret-policy.js";
 import { parseConfiguredTransportUrl } from "./url-policy.js";
 
 const MAX_RESPONSE_BYTES = 1024 * 1024;
@@ -34,10 +35,6 @@ function ambiguous(name: string): AuthDiagnostic {
   return diagnostic("oidc_mapped_group_ambiguous", "A configured authorization group is ambiguous.", name);
 }
 
-function safeApiToken(value: string): boolean {
-  return typeof value === "string" && value.length > 0 && value.length <= 16 * 1024 && !/\p{Cc}/u.test(value);
-}
-
 function stableCompare(left: string, right: string): number {
   return left < right ? -1 : left > right ? 1 : 0;
 }
@@ -143,10 +140,21 @@ type GroupResult = "present" | "missing" | "ambiguous" | "unauthorized" | "unrea
 function exactResult(name: string, parsed: unknown): GroupResult {
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return "unreachable";
   const record = parsed as { results?: unknown; pagination?: unknown };
-  if (!Array.isArray(record.results) || !record.pagination || typeof record.pagination !== "object"
+  if (!Array.isArray(record.results) || record.results.length > 2
+    || !record.pagination || typeof record.pagination !== "object"
     || Array.isArray(record.pagination)) return "unreachable";
-  const next = (record.pagination as { next?: unknown }).next;
-  if (next !== null && next !== undefined) return "ambiguous";
+  if (!Object.prototype.hasOwnProperty.call(record.pagination, "next")) return "unreachable";
+  const next = (record.pagination as { next: unknown }).next;
+  if (next !== null) {
+    if (typeof next !== "string" || next.length === 0 || next.length > 2048 || /\p{Cc}/u.test(next)) return "unreachable";
+    try {
+      const continuation = new URL(next);
+      if (continuation.protocol !== "https:" || continuation.username || continuation.password || continuation.hash) return "unreachable";
+    } catch {
+      return "unreachable";
+    }
+    return "ambiguous";
+  }
   const resultNames: string[] = [];
   for (const result of record.results) {
     if (!result || typeof result !== "object" || Array.isArray(result)
@@ -161,7 +169,9 @@ function exactResult(name: string, parsed: unknown): GroupResult {
 export function createAuthentikGroupCatalog(options: AuthentikGroupCatalogOptions): GroupCatalog {
   const origin = parseConfiguredTransportUrl(options.baseUrl, { allowLoopbackHttp: false, originOnly: true });
   const fetchImplementation = options.fetch ?? globalThis.fetch;
-  const valid = origin !== undefined && safeApiToken(options.apiToken) && typeof fetchImplementation === "function";
+  const valid = origin !== undefined
+    && isUsableAuthenticationSecret("THT_AUTHENTIK_API_TOKEN", options.apiToken)
+    && typeof fetchImplementation === "function";
 
   async function verify(name: string, signal: AbortSignal): Promise<GroupResult> {
     if (!origin || !valid || signal.aborted) return "unreachable";

backend/src/auth/config.ts

@@ -21,6 +21,7 @@ import type {
   Role,
 } from "./types.js";
 import { parseConfiguredTransportUrl } from "./url-policy.js";
+import { createWindowsAuthStorageBridge, type WindowsAuthStorageBridge } from "./windows-auth-storage.js";
 
 export type {
   AuthenticationConfig,
@@ -32,6 +33,8 @@ export type {
 } from "./types.js";
 
 const MAX_AUTH_CONFIG_BYTES = 1024 * 1024;
+// Keep live catalog work within the same deterministic bound as the mandatory direct groups claim.
+const MAX_MAPPED_GROUPS = 128;
 const ROLES = ["user", "admin"] as const;
 export const PERMISSION_CATALOG: readonly Permission[] = [
   "session.use", "session.read_all", "session.manage_all", "settings.manage",
@@ -52,7 +55,8 @@ const sessionSchema = z.strictObject({
 });
 const roleSchema = z.enum(ROLES);
 const groupNameSchema = nonEmptyText.max(256);
-const groupRolesSchema = z.record(groupNameSchema, z.array(roleSchema).min(1));
+const groupRolesSchema = z.record(groupNameSchema, z.array(roleSchema).min(1))
+  .refine((value) => Object.keys(value).length <= MAX_MAPPED_GROUPS);
 
 const localSchema = z.strictObject({
   version: z.literal(1), mode: z.literal("local"), publicUrl: nonEmptyText, session: sessionSchema.optional(),
@@ -94,6 +98,11 @@ interface StorageIdentity {
   directory: DirectoryIdentity;
 }
 
+export interface AuthenticationConfigLoadOptions {
+  /** Test seam; production creates the existing bounded internal tht auth-storage bridge. */
+  windowsStorageBridge?: Pick<WindowsAuthStorageBridge, "readAuthConfig">;
+}
+
 function validateCanonicalPath(path: string): void {
   if (typeof path !== "string" || path.length === 0 || path.trim() !== path
     || path.includes("\0") || !isAbsolute(path) || normalize(path) !== path
@@ -249,11 +258,36 @@ function loadAuthenticationConfigWithIdentity(path: string): { loaded: LoadedAut
   return { loaded: { value, revision: canonicalRevision(value), sourcePath: path }, identity: read.identity };
 }
 
-export function loadAuthenticationConfig(path: string): LoadedAuthConfig {
+function loadWindowsAuthenticationConfig(
+  path: string,
+  bridge: Pick<WindowsAuthStorageBridge, "readAuthConfig">,
+): LoadedAuthConfig {
+  try {
+    const contents = bridge.readAuthConfig(path);
+    if (!Buffer.isBuffer(contents) || contents.length === 0 || contents.length > MAX_AUTH_CONFIG_BYTES) throw invalid();
+    const source = new TextDecoder("utf-8", { fatal: true }).decode(contents);
+    const value = parseAuthenticationConfig(source);
+    return { value, revision: canonicalRevision(value), sourcePath: path };
+  } catch {
+    throw invalid();
+  }
+}
+
+export function loadAuthenticationConfig(path: string, options: AuthenticationConfigLoadOptions = {}): LoadedAuthConfig {
+  if (process.platform === "win32") {
+    return loadWindowsAuthenticationConfig(path, options.windowsStorageBridge ?? createWindowsAuthStorageBridge());
+  }
   return loadAuthenticationConfigWithIdentity(path).loaded;
 }
 
-export function createAuthenticationConfigProvider(path: string): AuthenticationConfigProvider {
+export function createAuthenticationConfigProvider(
+  path: string,
+  options: AuthenticationConfigLoadOptions = {},
+): AuthenticationConfigProvider {
+  if (process.platform === "win32") {
+    const bridge = options.windowsStorageBridge ?? createWindowsAuthStorageBridge();
+    return { current: () => loadWindowsAuthenticationConfig(path, bridge) };
+  }
   let cached: { identity: StorageIdentity; loaded: LoadedAuthConfig } | undefined;
   return { current(): LoadedAuthConfig {
     const before = storageIdentity(path);

backend/src/auth/diagnostics.ts

@@ -2,10 +2,14 @@ import type { AuthenticationConfigProvider, AuthMode } from "./types.js";
 import type { LocalUserRegistry } from "./local-registry.js";
 import { OidcIssuerMismatchError, OidcJwksUnavailableError, type OidcProtocol } from "./oidc-client.js";
 import { validateAuthSessionRoot } from "./session-store.js";
+import { createWindowsAuthStorageBridge, type WindowsAuthStorageBridge } from "./windows-auth-storage.js";
+import { isUsableAuthenticationSecret, type AuthenticationSecretReference } from "./secret-policy.js";
 import type { AuthDiagnostic, AuthDiagnosticCode, AuthDiagnostics, GroupCatalog } from "./group-catalog.js";
 
 export type { AuthDiagnostic, AuthDiagnosticCode, AuthDiagnostics } from "./group-catalog.js";
 
+const LIVE_DIAGNOSTIC_TIMEOUT_MS = 30_000;
+
 export interface AuthDiagnoser {
   inspect(options: { live: boolean; interactive?: boolean; signal?: AbortSignal }): Promise<AuthDiagnostics>;
 }
@@ -15,6 +19,7 @@ export interface AuthDiagnoserDependencies {
   authStateRoot: string;
   /** Platform integrations may inject an equivalent side-effect-free owner/ACL validator. */
   sessionRootValidator?: (root: string) => void | Promise<void>;
+  windowsStorageBridge?: Pick<WindowsAuthStorageBridge, "validateRoot">;
   authentication?: AuthenticationConfigProvider;
   secrets?: ReadonlyMap<string, string>;
   localUserRegistry?: LocalUserRegistry;
@@ -26,11 +31,6 @@ function check(code: AuthDiagnosticCode, message: string, field?: string): AuthD
   return { level: "error", code, message, ...(field === undefined ? {} : { field }) };
 }
 
-function secretPresent(secrets: ReadonlyMap<string, string> | undefined, name: string): boolean {
-  const value = secrets?.get(name);
-  return typeof value === "string" && value.length > 0 && value.length <= 16 * 1024 && !/\p{Cc}/u.test(value);
-}
-
 function ordered(checks: readonly AuthDiagnostic[]): readonly AuthDiagnostic[] {
   const unique = new Map<string, AuthDiagnostic>();
   for (const item of checks) unique.set(`${item.code}\u0000${item.field ?? ""}`, item);
@@ -45,6 +45,45 @@ function stableCompare(left: string, right: string): number {
   return left < right ? -1 : left > right ? 1 : 0;
 }
 
+function abortReason(signal: AbortSignal): unknown {
+  return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
+
+function awaitWithAbort<T>(operation: Promise<T>, signal: AbortSignal): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    let settled = false;
+    const abort = () => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", abort);
+      reject(abortReason(signal));
+    };
+    if (signal.aborted) abort();
+    else signal.addEventListener("abort", abort, { once: true });
+    operation.then(
+      (value) => {
+        if (settled) return;
+        settled = true;
+        signal.removeEventListener("abort", abort);
+        resolve(value);
+      },
+      (error: unknown) => {
+        if (settled) return;
+        settled = true;
+        signal.removeEventListener("abort", abort);
+        reject(error);
+      },
+    );
+  });
+}
+
+function startBeforeAbort<T>(signal: AbortSignal, operation: () => Promise<T>): Promise<T> {
+  return Promise.resolve().then(() => {
+    if (signal.aborted) throw abortReason(signal);
+    return operation();
+  });
+}
+
 async function localRegistryIsUsable(deps: AuthDiagnoserDependencies): Promise<AuthDiagnostic | undefined> {
   try {
     if (!deps.localUserRegistry) {
@@ -60,12 +99,15 @@ async function localRegistryIsUsable(deps: AuthDiagnoserDependencies): Promise<A
 }
 
 export function createAuthDiagnoser(deps: AuthDiagnoserDependencies): AuthDiagnoser {
+  const validateSessionRoot = deps.sessionRootValidator ?? (process.platform === "win32"
+    ? (root: string) => (deps.windowsStorageBridge ?? createWindowsAuthStorageBridge()).validateRoot(root)
+    : validateAuthSessionRoot);
   return {
     async inspect(options): Promise<AuthDiagnostics> {
       const checks: AuthDiagnostic[] = [];
       const signal = options.signal ?? new AbortController().signal;
       try {
-        await (deps.sessionRootValidator ?? validateAuthSessionRoot)(deps.authStateRoot);
+        await validateSessionRoot(deps.authStateRoot);
       } catch {
         checks.push(check("auth_session_store_invalid", "The authentication session store is invalid."));
       }
@@ -103,8 +145,8 @@ export function createAuthDiagnoser(deps: AuthDiagnoserDependencies): AuthDiagno
           : { ready: false, mode: "local", checks: result };
       }
 
-      const requiredSecrets = ["THT_OIDC_CLIENT_SECRET", "THT_AUTHENTIK_API_TOKEN"];
-      if (requiredSecrets.some((name) => !secretPresent(deps.secrets, name))) {
+      const requiredSecrets: readonly AuthenticationSecretReference[] = ["THT_OIDC_CLIENT_SECRET", "THT_AUTHENTIK_API_TOKEN"];
+      if (requiredSecrets.some((name) => !isUsableAuthenticationSecret(name, deps.secrets?.get(name)))) {
         checks.push(check("oidc_secret_missing", "A required OIDC or group catalog secret is unavailable."));
       }
       if (!options.live || checks.length > 0) {
@@ -113,33 +155,44 @@ export function createAuthDiagnoser(deps: AuthDiagnoserDependencies): AuthDiagno
           ? { ready: true, mode: "oidc", checks: [{ level: "info", code: "auth_ready", message: "Authentication is ready." }] }
           : { ready: false, mode: "oidc", checks: result };
       }
+      const mappedGroupNames = Object.keys(loaded.value.authorization.groupRoles).sort(stableCompare);
 
-      if (!deps.oidcProtocol) {
-        checks.push(check("oidc_discovery_unreachable", "The OIDC provider is unavailable."));
-      } else {
-        try {
-          await deps.oidcProtocol.diagnose(signal);
-        } catch (error) {
-          checks.push(check(
-            error instanceof OidcIssuerMismatchError
-              ? "oidc_issuer_mismatch"
-              : error instanceof OidcJwksUnavailableError
-                ? "oidc_jwks_unreachable"
-                : "oidc_discovery_unreachable",
-            "The OIDC provider could not be validated.",
-          ));
+      const deadline = new AbortController();
+      const deadlineTimer = setTimeout(() => deadline.abort(), LIVE_DIAGNOSTIC_TIMEOUT_MS);
+      deadlineTimer.unref();
+      const liveSignal = AbortSignal.any([signal, deadline.signal]);
+      try {
+        if (!deps.oidcProtocol) {
+          checks.push(check("oidc_discovery_unreachable", "The OIDC provider is unavailable."));
+        } else {
+          try {
+            await awaitWithAbort(startBeforeAbort(liveSignal, () => deps.oidcProtocol!.diagnose(liveSignal)), liveSignal);
+          } catch (error) {
+            checks.push(check(
+              error instanceof OidcIssuerMismatchError
+                ? "oidc_issuer_mismatch"
+                : error instanceof OidcJwksUnavailableError
+                  ? "oidc_jwks_unreachable"
+                  : "oidc_discovery_unreachable",
+              "The OIDC provider could not be validated.",
+            ));
+          }
         }
-      }
-      if (!deps.groupCatalog) {
-        checks.push(check("oidc_group_catalog_unreachable", "The configured group catalog cannot be certified."));
-      } else {
-        try {
-          checks.push(...await deps.groupCatalog.verifyConfiguredGroups(
-            Object.keys(loaded.value.authorization.groupRoles).sort(stableCompare), signal,
-          ));
-        } catch {
-          checks.push(check("oidc_group_catalog_unreachable", "The configured group catalog is unavailable."));
+        if (!liveSignal.aborted) {
+          if (!deps.groupCatalog) {
+            checks.push(check("oidc_group_catalog_unreachable", "The configured group catalog cannot be certified."));
+          } else {
+            try {
+              checks.push(...await awaitWithAbort(startBeforeAbort(liveSignal, () => deps.groupCatalog!.verifyConfiguredGroups(
+                mappedGroupNames, liveSignal,
+              )), liveSignal));
+            } catch {
+              checks.push(check("oidc_group_catalog_unreachable", "The configured group catalog is unavailable."));
+            }
+          }
         }
+      } finally {
+        clearTimeout(deadlineTimer);
       }
       const result = ordered(checks);
       return result.length === 0

backend/src/auth/oidc-client.ts

@@ -9,6 +9,7 @@ import {
 } from "openid-client";
 import { constants, createPublicKey, verify as verifySignature } from "node:crypto";
 import { parseConfiguredTransportUrl } from "./url-policy.js";
+import { isUsableAuthenticationSecret } from "./secret-policy.js";
 
 export interface OidcIdentity {
   issuer: string;
@@ -79,6 +80,23 @@ const MAX_JWKS_TIMEOUT_MS = 30_000;
 const text = (value: unknown, maximum = 2048): value is string =>
   typeof value === "string" && value.length > 0 && value.length <= maximum && !/\p{Cc}/u.test(value);
 
+function discoveryStringList(value: unknown): value is readonly string[] {
+  return Array.isArray(value) && value.length > 0 && value.length <= 128
+    && value.every((item) => text(item, 128));
+}
+
+function schemaValidDiscoveryMetadata(value: unknown): value is Record<string, unknown> & { issuer: string } {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const metadata = value as Record<string, unknown>;
+  return text(metadata.issuer, 2048)
+    && text(metadata.authorization_endpoint, 2048)
+    && text(metadata.token_endpoint, 2048)
+    && text(metadata.jwks_uri, 2048)
+    && discoveryStringList(metadata.response_types_supported)
+    && discoveryStringList(metadata.subject_types_supported)
+    && discoveryStringList(metadata.id_token_signing_alg_values_supported);
+}
+
 function configuredHttpsUrl(value: string): URL {
   const url = parseConfiguredTransportUrl(value, { allowLoopbackHttp: false });
   if (!url) throw new OidcProtocolError();
@@ -463,7 +481,7 @@ async function verifyJwksAvailability(
 export function createOidcProtocol(options: OidcProtocolOptions): OidcProtocol {
   const issuerUrl = configuredHttpsUrl(options.issuer);
   const callbackUrl = configuredCallbackUrl(options.callbackUrl);
-  if (!text(options.clientId, 512) || !text(options.clientSecret, 4096)
+  if (!text(options.clientId, 512) || !isUsableAuthenticationSecret("THT_OIDC_CLIENT_SECRET", options.clientSecret)
     || !text(options.groupsClaim, 128) || options.scopes.length === 0 || options.scopes.length > 16
     || options.scopes.some((scope) => !text(scope, 128))
     || (options.httpTimeoutMs !== undefined && (!Number.isSafeInteger(options.httpTimeoutMs)
@@ -478,19 +496,24 @@ export function createOidcProtocol(options: OidcProtocolOptions): OidcProtocol {
   const configuration = async (): Promise<Configuration> => {
     if (!discovered) {
       discovered = (async () => {
-        let inspectingDiscovery = true;
+        let certifiedIssuerMismatch = false;
         const issuerCheckingFetch: CustomFetch = async (input, init) => {
           const response = await transport.customFetch(input, init);
-          if (inspectingDiscovery) {
-            try {
-              const metadata = await response.clone().json() as { issuer?: unknown };
-              if (typeof metadata?.issuer === "string" && metadata.issuer !== options.issuer) {
-                throw new OidcIssuerMismatchError();
-              }
-            } catch (error) {
-              if (error instanceof OidcIssuerMismatchError) throw error;
-              // The OIDC library owns all other discovery-document validation.
+          if (!response.ok) return response;
+          try {
+            const metadata: unknown = await response.clone().json();
+            if (schemaValidDiscoveryMetadata(metadata) && metadata.issuer !== options.issuer) {
+              certifiedIssuerMismatch = true;
+              const headers = new Headers(response.headers);
+              headers.delete("content-length");
+              return new Response(JSON.stringify({ ...metadata, issuer: options.issuer }), {
+                status: response.status,
+                statusText: response.statusText,
+                headers,
+              });
             }
+          } catch {
+            // The OIDC library owns malformed discovery-document classification.
           }
           return response;
         };
@@ -503,15 +526,14 @@ export function createOidcProtocol(options: OidcProtocolOptions): OidcProtocol {
             { [customFetch]: issuerCheckingFetch, timeout: httpTimeoutMs / 1000 },
           );
           const metadata = config.serverMetadata();
-          if (metadata.issuer !== options.issuer) throw new OidcIssuerMismatchError();
+          if (certifiedIssuerMismatch) throw new OidcIssuerMismatchError();
+          if (metadata.issuer !== options.issuer) throw new OidcProtocolError();
           httpsEndpoint(metadata.authorization_endpoint);
           httpsEndpoint(metadata.token_endpoint);
           httpsEndpoint(metadata.jwks_uri);
           return config;
         } catch (error) {
           throw protocolFailure(error);
-        } finally {
-          inspectingDiscovery = false;
         }
       })();
     }

backend/src/auth/secret-policy.ts

@@ -0,0 +1,19 @@
+export const AUTHENTICATION_SECRET_LIMITS = Object.freeze({
+  THT_OIDC_CLIENT_SECRET: 4096,
+  THT_AUTHENTIK_API_TOKEN: 16 * 1024,
+} as const);
+
+export type AuthenticationSecretReference = keyof typeof AUTHENTICATION_SECRET_LIMITS;
+
+export function isAuthenticationSecretReference(value: string): value is AuthenticationSecretReference {
+  return Object.prototype.hasOwnProperty.call(AUTHENTICATION_SECRET_LIMITS, value);
+}
+
+/** One policy shared by bundle loading, runtime adapters, and static diagnostics. */
+export function isUsableAuthenticationSecret(
+  name: AuthenticationSecretReference,
+  value: unknown,
+): value is string {
+  return typeof value === "string" && value.length > 0
+    && value.length <= AUTHENTICATION_SECRET_LIMITS[name] && !/\p{Cc}/u.test(value);
+}

backend/src/auth/session-store.ts

@@ -1,6 +1,6 @@
 import { createHash, hkdfSync, randomBytes } from "node:crypto";
 import {
-  chmodSync,
+  accessSync,
   closeSync,
   constants,
   fchmodSync,
@@ -297,6 +297,10 @@ function isNotFound(error: unknown): boolean {
   return (error as NodeJS.ErrnoException | undefined)?.code === "ENOENT";
 }
 
+function isAlreadyExists(error: unknown): boolean {
+  return (error as NodeJS.ErrnoException | undefined)?.code === "EEXIST";
+}
+
 function canonicalRawValue(value: string): boolean {
   if (typeof value !== "string" || !TOKEN_PATTERN.test(value)) return false;
   try {
@@ -377,26 +381,12 @@ function directoryScanIdentity(path: string): DirectoryScanIdentity {
   return { ...identity, mtimeMs: info.mtimeMs, ctimeMs: info.ctimeMs };
 }
 
-function privateDirectory(path: string): void {
-  let created = false;
-  try {
-    lstatSync(path);
-  } catch (error) {
-    if (!isNotFound(error)) throw invalid();
-    try {
-      mkdirSync(path, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
-      chmodSync(path, PRIVATE_DIRECTORY_MODE);
-      created = true;
-    } catch {
-      throw invalid();
-    }
-  }
-  try {
-    directoryIdentity(path);
-  } catch {
-    if (!created) throw invalid();
-    throw invalid();
-  }
+interface SessionRootAncestor {
+  path: string;
+  descriptor: number;
+  dev: number;
+  ino: number;
+  uid: number;
 }
 
 function validateSessionRootSyntax(root: string): void {
@@ -404,11 +394,90 @@ function validateSessionRootSyntax(root: string): void {
     || root.includes("\0") || /\p{Cc}/u.test(root) || !isAbsolute(root) || normalize(root) !== root) throw invalid();
 }
 
+function sameAncestor(ancestor: SessionRootAncestor, info: Stats): boolean {
+  return info.isDirectory() && !info.isSymbolicLink() && ancestor.dev === info.dev
+    && ancestor.ino === info.ino && ancestor.uid === info.uid;
+}
+
+function withSessionRootPreflight<T>(root: string, use: (exists: boolean) => T): T {
+  validateSessionRootSyntax(root);
+  const ancestors: SessionRootAncestor[] = [];
+  try {
+    const components = root.split("/").filter((component) => component.length > 0);
+    let current = "/";
+    for (let index = -1; index < components.length; index += 1) {
+      if (index >= 0) current = join(current, components[index]!);
+      let info: Stats;
+      try {
+        info = lstatSync(current) as Stats;
+      } catch (error) {
+        if (!isNotFound(error) || index !== components.length - 1) throw invalid();
+        accessSync(dirname(current), constants.W_OK | constants.X_OK);
+        for (const ancestor of ancestors) {
+          const observed = lstatSync(ancestor.path) as Stats;
+          if (!sameAncestor(ancestor, observed) || realpathSync(ancestor.path) !== ancestor.path) throw invalid();
+        }
+        const result = use(false);
+        for (const ancestor of ancestors) {
+          const observed = lstatSync(ancestor.path) as Stats;
+          if (!sameAncestor(ancestor, observed) || realpathSync(ancestor.path) !== ancestor.path) throw invalid();
+        }
+        return result;
+      }
+      if (!info.isDirectory() || info.isSymbolicLink() || realpathSync(current) !== current) throw invalid();
+      const descriptor = openSync(current, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0)
+        | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+      const opened = fstatSync(descriptor) as Stats;
+      if (!opened.isDirectory() || opened.dev !== info.dev || opened.ino !== info.ino || opened.uid !== info.uid) {
+        closeSync(descriptor);
+        throw invalid();
+      }
+      ancestors.push({ path: current, descriptor, dev: info.dev, ino: info.ino, uid: info.uid });
+    }
+    directoryIdentity(root);
+    const result = use(true);
+    for (const ancestor of ancestors) {
+      const observed = lstatSync(ancestor.path) as Stats;
+      if (!sameAncestor(ancestor, observed) || realpathSync(ancestor.path) !== ancestor.path) throw invalid();
+    }
+    return result;
+  } catch {
+    throw invalid();
+  } finally {
+    for (const ancestor of ancestors.reverse()) {
+      try { closeSync(ancestor.descriptor); } catch { /* preflight has already failed closed */ }
+    }
+  }
+}
+
+function privateDirectory(path: string): void {
+  withSessionRootPreflight(path, (exists) => {
+    if (exists) return;
+    try {
+      mkdirSync(path, { recursive: false, mode: PRIVATE_DIRECTORY_MODE });
+    } catch (error) {
+      if (!isAlreadyExists(error)) throw invalid();
+      directoryIdentity(path);
+      return;
+    }
+    const descriptor = openSync(path, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0)
+      | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+    try {
+      fchmodSync(descriptor, PRIVATE_DIRECTORY_MODE);
+      const opened = fstatSync(descriptor) as Stats;
+      const current = directoryIdentity(path);
+      if (opened.dev !== current.dev || opened.ino !== current.ino || opened.uid !== current.uid
+        || (opened.mode & 0o7777) !== current.mode) throw invalid();
+    } finally {
+      try { closeSync(descriptor); } catch { /* creation already fails closed */ }
+    }
+  });
+}
+
 /** Side-effect-free POSIX validator shared by runtime storage and static diagnostics. */
 export function validateAuthSessionRoot(root: string): void {
   try {
-    validateSessionRootSyntax(root);
-    directoryIdentity(root);
+    withSessionRootPreflight(root, () => undefined);
   } catch {
     throw invalid();
   }

backend/src/auth/windows-auth-storage.ts

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { win32 } from "node:path";
 import type { Readable, Writable } from "node:stream";
 import { z } from "zod";
@@ -6,6 +6,9 @@ import { z } from "zod";
 const PROTOCOL_VERSION = 1;
 const MAX_PROTOCOL_BYTES = 64 * 1024;
 const MAX_RESPONSE_BYTES = 64 * 1024;
+const MAX_AUTH_CONFIG_BYTES = 1024 * 1024;
+const MAX_AUTH_CONFIG_BASE64_BYTES = 4 * Math.ceil(MAX_AUTH_CONFIG_BYTES / 3);
+const MAX_AUTH_CONFIG_RESPONSE_BYTES = MAX_AUTH_CONFIG_BASE64_BYTES + 1024;
 const MAX_SESSION_BYTES = 16 * 1024;
 const MAX_OIDC_BYTES = 8 * 1024;
 const DEFAULT_MAX_ENTRIES = 256;
@@ -14,6 +17,7 @@ const TIMEOUT_MS = 5_000;
 const DIGEST_FILENAME = /^[a-f0-9]{64}\.json$/;
 const CLAIM_FILENAME = /^[a-f0-9]{64}\.claim$/;
 const OIDC_SLOT_FILENAME = /^slot-(?:[0-5][0-9]|6[0-3])\.json$/;
+const AUTH_CONFIG_FILENAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,249}\.yaml$/;
 
 const invalid = (): Error => new Error("auth_session_store_invalid");
 
@@ -31,6 +35,8 @@ export interface WindowsAuthStoragePage {
 
 /** Internal adapter boundary for the file-session store's native Windows path. */
 export interface WindowsAuthStorageBridge {
+  validateRoot(root: string): Promise<void>;
+  readAuthConfig(path: string): Buffer;
   create(root: string, directory: WindowsAuthStorageDirectory, filename: string, contents: Buffer): Promise<boolean>;
   read(root: string, directory: WindowsAuthStorageDirectory, filename: string): Promise<Buffer | undefined>;
   replace(root: string, directory: WindowsAuthStorageDirectory, filename: string, contents: Buffer): Promise<void>;
@@ -56,6 +62,7 @@ export interface WindowsAuthStorageInvocation {
   args: readonly string[];
   input: Buffer;
   timeoutMs: number;
+  maximumOutputBytes: number;
 }
 
 export interface WindowsAuthStorageInvocationResult {
@@ -83,6 +90,8 @@ type WindowsAuthStorageSpawn = (
 export interface WindowsAuthStorageBridgeOptions {
   /** Test-only transport seam. Production always uses the no-shell child-process invocation. */
   invoke?: (invocation: WindowsAuthStorageInvocation) => Promise<WindowsAuthStorageInvocationResult>;
+  /** Test-only synchronous seam used by the synchronous authentication-config provider. */
+  invokeSync?: (invocation: WindowsAuthStorageInvocation) => WindowsAuthStorageInvocationResult;
   /** Optional configured tht path. Defaults to THT_BIN, then the safe bare command `tht`. */
   thtExecutable?: string;
   /** Test-only child-launch seam; production uses the fixed no-shell Node child-process launcher. */
@@ -98,21 +107,22 @@ const responseSchema = z.strictObject({
   replaced: z.boolean().optional(),
   removed: z.boolean().optional(),
   found: z.boolean().optional(),
-  contentBase64: z.string().max(MAX_PROTOCOL_BYTES).optional(),
+  contentBase64: z.string().max(MAX_AUTH_CONFIG_BASE64_BYTES).optional(),
   entries: z.array(z.strictObject({
     name: z.string().max(128),
     modifiedUnixMs: z.number().int().safe().nonnegative(),
   })).max(MAX_ENTRIES).optional(),
   more: z.boolean().optional(),
+  validated: z.boolean().optional(),
 });
 
 type BridgeResponse = z.infer<typeof responseSchema>;
 
 interface BridgeRequest {
   version: typeof PROTOCOL_VERSION;
-  operation: "create" | "read" | "replace" | "remove" | "list" | "claim-consume" | "read-claim" | "remove-claim";
+  operation: "validate-root" | "read-auth-config" | "create" | "read" | "replace" | "remove" | "list" | "claim-consume" | "read-claim" | "remove-claim";
   root: string;
-  directory: WindowsAuthStorageDirectory;
+  directory?: WindowsAuthStorageDirectory;
   filename?: string;
   contentBase64?: string;
   maximumEntries?: number;
@@ -154,9 +164,10 @@ function safeThtExecutable(value: string | undefined): string {
   throw invalid();
 }
 
-function parseResponse(result: WindowsAuthStorageInvocationResult): BridgeResponse {
+function parseResponse(result: WindowsAuthStorageInvocationResult, maximumOutputBytes: number): BridgeResponse {
   if (!Number.isInteger(result.code) || result.code !== 0 || !Buffer.isBuffer(result.stdout)
-    || !Buffer.isBuffer(result.stderr) || result.stdout.length === 0 || result.stdout.length > MAX_RESPONSE_BYTES) {
+    || !Buffer.isBuffer(result.stderr) || result.stderr.length > MAX_RESPONSE_BYTES
+    || result.stdout.length === 0 || result.stdout.length > maximumOutputBytes) {
     throw invalid();
   }
   try {
@@ -169,7 +180,15 @@ function parseResponse(result: WindowsAuthStorageInvocationResult): BridgeRespon
 
 function encodedRequest(request: BridgeRequest): Buffer {
   validateRoot(request.root);
-  if (request.operation === "list") {
+  if (request.operation === "validate-root") {
+    if (request.directory !== undefined || request.filename !== undefined || request.contentBase64 !== undefined
+      || request.maximumEntries !== undefined || request.afterName !== undefined || request.continuation !== undefined) throw invalid();
+  } else if (request.operation === "read-auth-config") {
+    if (request.directory !== undefined || request.contentBase64 !== undefined || request.maximumEntries !== undefined
+      || request.afterName !== undefined || request.continuation !== undefined
+      || request.filename === undefined || !AUTH_CONFIG_FILENAME.test(request.filename)) throw invalid();
+  } else if (request.operation === "list") {
+    if (request.directory === undefined) throw invalid();
     if (request.filename !== undefined || request.contentBase64 !== undefined) throw invalid();
     if (request.maximumEntries !== undefined && (!Number.isInteger(request.maximumEntries)
       || request.maximumEntries < 1 || request.maximumEntries > MAX_ENTRIES)) throw invalid();
@@ -181,6 +200,7 @@ function encodedRequest(request: BridgeRequest): Buffer {
       throw invalid();
     }
   } else {
+    if (request.directory === undefined) throw invalid();
     if (request.maximumEntries !== undefined || request.afterName !== undefined || request.continuation !== undefined) throw invalid();
     if (request.filename === undefined) throw invalid();
     const allowClaim = request.operation === "remove" && request.directory === "oidc";
@@ -191,7 +211,10 @@ function encodedRequest(request: BridgeRequest): Buffer {
   }
   if ((request.operation === "claim-consume" || request.operation === "read-claim" || request.operation === "remove-claim")
     && request.directory !== "oidc") throw invalid();
-  if (request.contentBase64 !== undefined) canonicalBase64(request.contentBase64, directoryMaximum(request.directory));
+  if (request.contentBase64 !== undefined) {
+    if (request.directory === undefined) throw invalid();
+    canonicalBase64(request.contentBase64, directoryMaximum(request.directory));
+  }
   const encoded = Buffer.from(JSON.stringify(request), "utf8");
   if (encoded.length === 0 || encoded.length > MAX_PROTOCOL_BYTES) throw invalid();
   return encoded;
@@ -208,6 +231,25 @@ function environmentForBridge(): NodeJS.ProcessEnv {
 
 const spawnTht: WindowsAuthStorageSpawn = (executable, args, options) => spawn(executable, [...args], options);
 
+function invokeThtSync(invocation: WindowsAuthStorageInvocation): WindowsAuthStorageInvocationResult {
+  try {
+    const result = spawnSync(invocation.executable, [...invocation.args], {
+      shell: false,
+      windowsHide: true,
+      env: environmentForBridge(),
+      input: invocation.input,
+      timeout: invocation.timeoutMs,
+      maxBuffer: invocation.maximumOutputBytes,
+      encoding: "buffer",
+    });
+    if (result.error || result.signal !== null || typeof result.status !== "number"
+      || !Buffer.isBuffer(result.stdout) || !Buffer.isBuffer(result.stderr)) throw invalid();
+    return { code: result.status, stdout: result.stdout, stderr: result.stderr };
+  } catch {
+    throw invalid();
+  }
+}
+
 async function invokeTht(
   invocation: WindowsAuthStorageInvocation,
   spawnChild: WindowsAuthStorageSpawn = spawnTht,
@@ -355,20 +397,37 @@ export function createWindowsAuthStorageBridge(options: WindowsAuthStorageBridge
     options.spawnChild,
     options.beforeInputForTest,
   ));
+  const invokeSync = options.invokeSync ?? invokeThtSync;
   const request = async (value: BridgeRequest): Promise<BridgeResponse> => {
     try {
+      const maximumOutputBytes = MAX_RESPONSE_BYTES;
       const response = await invoke({
         executable,
         args: ["_auth-storage"],
         input: encodedRequest(value),
         timeoutMs: TIMEOUT_MS,
+        maximumOutputBytes,
       });
-      return parseResponse(response);
+      return parseResponse(response, maximumOutputBytes);
     } catch {
       throw invalid();
     }
   };
-  const recordRequest = (operation: BridgeRequest["operation"], root: string, directory: WindowsAuthStorageDirectory, filename: string, contents?: Buffer): BridgeRequest => ({
+  const syncRequest = (value: BridgeRequest): BridgeResponse => {
+    try {
+      const response = invokeSync({
+        executable,
+        args: ["_auth-storage"],
+        input: encodedRequest(value),
+        timeoutMs: TIMEOUT_MS,
+        maximumOutputBytes: MAX_AUTH_CONFIG_RESPONSE_BYTES,
+      });
+      return parseResponse(response, MAX_AUTH_CONFIG_RESPONSE_BYTES);
+    } catch {
+      throw invalid();
+    }
+  };
+  const recordRequest = (operation: "create" | "read" | "replace" | "remove" | "claim-consume" | "read-claim" | "remove-claim", root: string, directory: WindowsAuthStorageDirectory, filename: string, contents?: Buffer): BridgeRequest => ({
     version: PROTOCOL_VERSION,
     operation,
     root,
@@ -378,6 +437,23 @@ export function createWindowsAuthStorageBridge(options: WindowsAuthStorageBridge
   });
 
   return {
+    async validateRoot(root) {
+      const response = await request({ version: PROTOCOL_VERSION, operation: "validate-root", root });
+      if (response.validated !== true
+        || Object.keys(response).some((key) => !["version", "ok", "validated"].includes(key))) throw invalid();
+    },
+    readAuthConfig(path) {
+      if (typeof path !== "string" || path.length === 0 || /[\u0000-\u001f\u007f]/.test(path)
+        || !win32.isAbsolute(path) || win32.normalize(path) !== path) throw invalid();
+      const root = win32.dirname(path);
+      const filename = win32.basename(path);
+      if (!AUTH_CONFIG_FILENAME.test(filename) || win32.join(root, filename) !== path) throw invalid();
+      const response = syncRequest({ version: PROTOCOL_VERSION, operation: "read-auth-config", root, filename });
+      if (Object.keys(response).some((key) => !["version", "ok", "found", "contentBase64"].includes(key))) throw invalid();
+      const contents = contentFrom(response, MAX_AUTH_CONFIG_BYTES);
+      if (contents === undefined) throw invalid();
+      return contents;
+    },
     async create(root, directory, filename, contents) {
       if (!Buffer.isBuffer(contents) || contents.length === 0 || contents.length > directoryMaximum(directory)) throw invalid();
       const response = await request(recordRequest("create", root, directory, filename, contents));