feat(web-next): resolve the session user + live compliance context

The tRPC createContext was () => ({}) — the mounted dsr/consent routers
401'd every call and the dsr singleton stub threw (audit finding A11).
createTrpcContext now accepts an app resolveUser hook; web-next resolves
the session cookie through the auth feature's validateSession (denylist
included) plus a role snapshot, and threads bindProductionDsr/Consent
(or dev-seed) bindings into every request. The dsr router resolves its
binding from ctx.dsrBinding per request instead of a throwing proxy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/web-next/src/app/api/trpc/[trpc]/route.ts

@@ -1,15 +1,17 @@
 import { fetchRequestHandler } from "@trpc/server/adapters/fetch";
 import { appRouter } from "@repo/core-api";
-import { createTrpcContext } from "@repo/core-shared/trpc/context";
+import { createWebNextTrpcContext } from "../../../../server/trpc-context";
 
 const handler = async (req: Request) => {
   return fetchRequestHandler({
     endpoint: "/api/trpc",
     req,
     router: appRouter,
-    // Threads server-derived fields (clientIp from proxy headers — see the
-    // trust caveat in core-shared/trpc/context.ts) into every procedure (B2).
-    createContext: () => createTrpcContext(req),
+    // Real per-request context (A11): server-derived clientIp (B2, trust
+    // caveat in core-shared/trpc/context.ts), the authenticated user resolved
+    // from the session cookie (B7), and the consent/dsr bindings that make
+    // the mounted compliance routers live.
+    createContext: () => createWebNextTrpcContext(req),
   });
 };
 

apps/web-next/src/server/bind-production.test.ts

@@ -1,5 +1,9 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 
+// bindAllProduction wires core-audit, which fails fast in NODE_ENV=production
+// without a pseudonym salt (by design). Provide one for the whole suite.
+process.env.AUDIT_PSEUDONYM_SALT ??= "test-salt-not-for-production";
+
 vi.mock("@repo/core-cms", () => ({ default: Promise.resolve({}) }));
 vi.mock("payload", () => ({
   getPayload: vi.fn(async () => ({ jobs: { queue: vi.fn() } })),

apps/web-next/src/server/bind-production.ts

@@ -21,6 +21,17 @@ import {
   NoopRateLimit,
   type RateLimitBudget,
 } from "@repo/core-shared/rate-limit";
+import { bindAudit, type IAuditLog } from "@repo/core-audit";
+import {
+  bindProductionConsent,
+  bindDevSeedConsent,
+  type ConsentFactory,
+} from "@repo/core-consent";
+import {
+  bindProductionDsr,
+  bindDevSeedDsr,
+  type DsrBinding,
+} from "@repo/core-dsr";
 import { authManifest } from "@repo/auth";
 import { bindProductionBlog } from "@repo/blog/di/bind-production";
 import { bindProductionAuth } from "@repo/auth/di/bind-production";
@@ -44,6 +55,45 @@ let resolvedTracer: ITracer | null = null;
 let resolvedLogger: ILogger | null = null;
 let resolvedQueue: IJobQueue | null = null;
 
+/**
+ * Compliance bindings constructed once per boot (audit finding A11): the
+ * consent factory and DSR binding that the tRPC createContext threads into
+ * every request so the mounted consent/dsr routers are live. `auditLog` is
+ * present only on the production path.
+ */
+export type ComplianceBindings = {
+  consentFactory: ConsentFactory;
+  dsrBinding: DsrBinding;
+  auditLog?: IAuditLog;
+};
+
+let complianceBindings: ComplianceBindings | null = null;
+
+export type BindingMode = "production" | "dev-seed";
+
+/** Env → binding mode, mirroring bindAll()'s resolution rules. */
+export function resolveBindingMode(): BindingMode {
+  if (process.env.USE_DEV_SEED === "false") return "production";
+  if (process.env.USE_DEV_SEED === "true") return "dev-seed";
+  if (process.env.NODE_ENV === "production") return "production";
+  return "dev-seed";
+}
+
+/**
+ * Resolve the boot-time compliance bindings, running bindAll() first if
+ * needed. Called by the app's tRPC createContext on every request (cheap
+ * after the first call — bindAll is memoized).
+ */
+export async function getComplianceBindings(): Promise<ComplianceBindings> {
+  await bindAll();
+  if (!complianceBindings) {
+    throw new Error(
+      "compliance bindings missing after bindAll() — binder did not construct them",
+    );
+  }
+  return complianceBindings;
+}
+
 /** Rule 0: pick instrumentation backend from DSN env (orthogonal to repo mode). */
 function resolveInstrumentation(): { tracer: ITracer; logger: ILogger } {
   if (resolvedTracer && resolvedLogger) {
@@ -108,11 +158,28 @@ export async function bindAllProduction(): Promise<void> {
   const { queue } = await resolveJobsProduction();
   const resolvedConfig = await config;
 
+  // Compliance cores (A6/A11): the audit log fans into the Payload
+  // `audit-logs` collection + stdout; consent + DSR bindings share it so
+  // every grant/withdraw/export/delete leaves an audit trail.
+  const { auditLog } = bindAudit(sharedContainer, {
+    payloadConfig: resolvedConfig,
+  });
+  const { consentFactory } = bindProductionConsent({
+    config: resolvedConfig,
+    auditLog,
+  });
+  const dsrBinding = bindProductionDsr({ config: resolvedConfig, auditLog });
+  complianceBindings = { consentFactory, dsrBinding, auditLog };
+
   const ctx: BindProductionContext = {
     config: resolvedConfig,
     tracer,
     logger,
     queue,
+    auditLog,
+    // Enables the anonymous→authenticated consent migration inside the auth
+    // sign-up use case (audit finding A12).
+    consentFactory,
     // Real limiter in production (audit finding A4/B3): budgets come from the
     // feature manifests, so manifest edits change enforcement without touching
     // this file. In-memory ⇒ per-process counters; multi-instance deployments
@@ -136,10 +203,17 @@ export async function bindAllDevSeed(): Promise<void> {
   const { tracer, logger } = resolveInstrumentation(); // Rule 0
   const { queue } = resolveJobsDevSeed();
 
+  // In-memory compliance bindings so the mounted consent/dsr routers work
+  // without Payload booted (A11). No audit sink in dev seed.
+  const { consentFactory } = bindDevSeedConsent();
+  const dsrBinding = bindDevSeedDsr();
+  complianceBindings = { consentFactory, dsrBinding };
+
   const ctx: BindContext = {
     tracer,
     logger,
     queue,
+    consentFactory,
     // Dev seed intentionally keeps the no-op limiter so local iteration and
     // seeded demos are never throttled; production binds InMemoryRateLimit.
     rateLimit: new NoopRateLimit(),
@@ -172,15 +246,10 @@ export async function bindAllDevSeed(): Promise<void> {
 export function bindAll(): Promise<void> {
   if (bindPromise) return bindPromise;
 
-  if (process.env.USE_DEV_SEED === "false") {
-    bindPromise = bindAllProduction();
-  } else if (process.env.USE_DEV_SEED === "true") {
-    bindPromise = bindAllDevSeed();
-  } else if (process.env.NODE_ENV === "production") {
-    bindPromise = bindAllProduction();
-  } else {
-    bindPromise = bindAllDevSeed();
-  }
+  bindPromise =
+    resolveBindingMode() === "production"
+      ? bindAllProduction()
+      : bindAllDevSeed();
 
   return bindPromise;
 }
@@ -191,6 +260,7 @@ export function __resetBindStateForTests(): void {
   resolvedTracer = null;
   resolvedLogger = null;
   resolvedQueue = null;
+  complianceBindings = null;
 }
 
 /** Test-only accessor for resolved instrumentation. */

apps/web-next/src/server/trpc-context.test.ts

@@ -0,0 +1,90 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+const findByID = vi.fn();
+vi.mock("payload", () => ({
+  getPayload: vi.fn(async () => ({ findByID })),
+}));
+vi.mock("@repo/core-cms", () => ({ default: Promise.resolve({}) }));
+
+const validateSession = vi.fn();
+vi.mock("@repo/auth/di/container", () => ({
+  authContainer: { get: () => ({ validateSession }) },
+}));
+
+const consentFactory = vi.fn(async () => ({}));
+const dsrBinding = { marker: "dsr-binding" };
+const resolveBindingMode = vi.fn<() => "production" | "dev-seed">(
+  () => "production",
+);
+vi.mock("./bind-production", () => ({
+  bindAll: vi.fn(async () => {}),
+  getComplianceBindings: vi.fn(async () => ({ consentFactory, dsrBinding })),
+  resolveBindingMode: () => resolveBindingMode(),
+}));
+
+import { createWebNextTrpcContext } from "./trpc-context";
+
+function makeRequest(headers: Record<string, string> = {}): Request {
+  return new Request("https://example.test/api/trpc", { headers });
+}
+
+describe("createWebNextTrpcContext (A11)", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    resolveBindingMode.mockReturnValue("production");
+    findByID.mockResolvedValue({ id: "user-1", role: "admin" });
+    validateSession.mockResolvedValue({ user: { id: "user-1" } });
+  });
+
+  it("threads compliance bindings for anonymous requests", async () => {
+    const ctx = await createWebNextTrpcContext(makeRequest());
+    expect(ctx.user).toBeUndefined();
+    expect(ctx.userId).toBeUndefined();
+    expect(ctx.consentFactory).toBe(consentFactory);
+    expect(ctx.dsrBinding).toBe(dsrBinding);
+    expect(validateSession).not.toHaveBeenCalled();
+  });
+
+  it("derives clientIp from proxy headers (B2)", async () => {
+    const ctx = await createWebNextTrpcContext(
+      makeRequest({ "x-forwarded-for": "203.0.113.9" }),
+    );
+    expect(ctx.clientIp).toBe("203.0.113.9");
+  });
+
+  it("resolves the user + role snapshot from the payload-token cookie", async () => {
+    const ctx = await createWebNextTrpcContext(
+      makeRequest({ cookie: "payload-token=jwt-abc; other=1" }),
+    );
+    expect(validateSession).toHaveBeenCalledWith("jwt-abc");
+    expect(ctx.user).toEqual({ id: "user-1", roles: ["admin"] });
+    expect(ctx.userId).toBe("user-1");
+  });
+
+  it("resolves the dev-seed session cookie name too", async () => {
+    resolveBindingMode.mockReturnValue("dev-seed");
+    const ctx = await createWebNextTrpcContext(
+      makeRequest({ cookie: "session=session_user-1" }),
+    );
+    expect(validateSession).toHaveBeenCalledWith("session_user-1");
+    // dev-seed has no Payload — role snapshot is empty
+    expect(ctx.user).toEqual({ id: "user-1", roles: [] });
+    expect(findByID).not.toHaveBeenCalled();
+  });
+
+  it("treats an invalid/expired session as anonymous", async () => {
+    validateSession.mockRejectedValue(new Error("Invalid or expired"));
+    const ctx = await createWebNextTrpcContext(
+      makeRequest({ cookie: "payload-token=tampered" }),
+    );
+    expect(ctx.user).toBeUndefined();
+  });
+
+  it("yields no roles when the users doc has none", async () => {
+    findByID.mockResolvedValue({ id: "user-1" });
+    const ctx = await createWebNextTrpcContext(
+      makeRequest({ cookie: "payload-token=jwt-abc" }),
+    );
+    expect(ctx.user).toEqual({ id: "user-1", roles: [] });
+  });
+});

apps/web-next/src/server/trpc-context.ts

@@ -0,0 +1,111 @@
+// apps/web-next/src/server/trpc-context.ts
+// SERVER-ONLY: builds the per-request tRPC context (audit finding A11).
+//
+// Extends the shared `createTrpcContext` (which derives `clientIp`, B2) with:
+//   - the authenticated user, resolved server-side from the session cookie via
+//     the auth feature's IAuthenticationService.validateSession (never from
+//     client input), plus a role snapshot for role-gated procedures (B7/A1);
+//   - the boot-time compliance bindings (consent factory + DSR binding) so
+//     the mounted consent/dsr routers are live instead of dead stubs.
+import "reflect-metadata";
+import { getPayload } from "payload";
+import config from "@repo/core-cms";
+import {
+  createTrpcContext,
+  type TrpcSessionUser,
+} from "@repo/core-shared/trpc/context";
+import { authContainer } from "@repo/auth/di/container";
+import { AUTH_SYMBOLS } from "@repo/auth/di/symbols";
+import {
+  bindAll,
+  getComplianceBindings,
+  resolveBindingMode,
+} from "./bind-production";
+
+/**
+ * Structural view of IAuthenticationService — only the method the context
+ * needs. Resolved from the auth container so production requests hit the
+ * same denylist-aware service instance that sign-in/sign-out use (B5).
+ */
+type SessionValidator = {
+  validateSession(token: string): Promise<{ user: { id: string } }>;
+};
+
+/**
+ * Cookie names carrying the session token: "payload-token" is written by the
+ * production AuthenticationService; "session" (SESSION_COOKIE) by the
+ * dev-seed MockAuthenticationService.
+ */
+const SESSION_COOKIE_NAMES = ["payload-token", "session"] as const;
+
+function parseCookieHeader(cookieHeader: string): Map<string, string> {
+  const map = new Map<string, string>();
+  for (const part of cookieHeader.split(";")) {
+    const eqIdx = part.indexOf("=");
+    if (eqIdx === -1) continue;
+    const name = part.slice(0, eqIdx).trim();
+    const value = part.slice(eqIdx + 1).trim();
+    if (name) map.set(name, value);
+  }
+  return map;
+}
+
+/**
+ * Role snapshot for the authenticated user. The auth entity model carries no
+ * role, so production reads it from the users collection; dev seed has no
+ * Payload and yields no roles (admin-gated procedures are production-only).
+ */
+async function resolveRoles(userId: string): Promise<string[]> {
+  if (resolveBindingMode() !== "production") return [];
+  const resolvedConfig = await config;
+  const payload = await getPayload({ config: resolvedConfig });
+  const doc = (await payload.findByID({
+    collection: "users" as never,
+    id: userId,
+    overrideAccess: true,
+  })) as { role?: unknown };
+  return typeof doc.role === "string" && doc.role.length > 0 ? [doc.role] : [];
+}
+
+/**
+ * Resolve the authenticated user from the request's session cookie.
+ * Returns null for anonymous/invalid/expired sessions — createTrpcContext
+ * treats resolver failures as anonymous, and procedures gate with
+ * UNAUTHORIZED/FORBIDDEN as needed.
+ */
+async function resolveUser(req: Request): Promise<TrpcSessionUser | null> {
+  const cookieHeader = req.headers.get("cookie");
+  if (!cookieHeader) return null;
+  const cookies = parseCookieHeader(cookieHeader);
+
+  const validator = authContainer.get<SessionValidator>(
+    AUTH_SYMBOLS.IAuthenticationService,
+  );
+
+  for (const name of SESSION_COOKIE_NAMES) {
+    const token = cookies.get(name);
+    if (!token) continue;
+    try {
+      const { user } = await validator.validateSession(token);
+      return { id: user.id, roles: await resolveRoles(user.id) };
+    } catch {
+      // invalid/expired/revoked token under this cookie name — try the next
+    }
+  }
+  return null;
+}
+
+/**
+ * Per-request tRPC context for web-next. Ensures DI is bound, then threads
+ * the server-derived fields + compliance bindings into every procedure.
+ */
+export async function createWebNextTrpcContext(req: Request) {
+  await bindAll();
+  const { consentFactory, dsrBinding } = await getComplianceBindings();
+  const base = await createTrpcContext(req, { resolveUser });
+  return { ...base, consentFactory, dsrBinding };
+}
+
+export type WebNextTrpcContext = Awaited<
+  ReturnType<typeof createWebNextTrpcContext>
+>;