feat(ui): machine binding status, toggle and reset per token on the Users page

[CallMeTechie]

Why

Machine binding (licence feature machine_binding) binds an API token to the hardware fingerprint of the client device that first connects with it. The per-token UI for it (switch, status, reset) only existed in the old theme and went away in 66a4418 ("Aurora is the only theme"). Since then the admin could not see whether a token is bound, the individual mode had no way to switch binding on for a token, and a binding could not be released when someone got a new PC. On the Users page "binding" also only meant token→peer binding, which is a different thing.

What

Users page (edit user → API tokens)

Each client token (scopes client, client:* or full-access, or any token with a stored fingerprint) gets a Gerätebindung area:

• Status: Gebunden an Gerät ab12cd34… seit 14.09.2026 / Noch nicht gebunden – wird beim nächsten Verbinden gebunden / Nicht aktiv (plus the stored device when the binding is off but a fingerprint is kept)
• Effective state: für dieses Token aktiv, or durch globale Einstellung aktiv in global mode
• Per-token switch: enabled only in individual mode. In global and off it is disabled and the reason is shown, with a link to Settings → Gerätebindung for off.
• Bindung zurücksetzen… with a gc-dialog confirmation, shown only when a fingerprint is stored
• Without the licence: Pro chip, lock note, and dimmed, disabled controls. The area stays visible.
• One line above the list explains that this is not the token→peer binding

Page-local i18n island (#mb-users-i18n), same pattern as the 2FA strings on this page; CSS prefix mb-; the switch reuses .st-switch.

API

• GET /api/v1/users/:id, GET /api/v1/users/unassigned-tokens, GET /api/v1/tokens: per token machine_fingerprint (shortened to 8 hex chars, the full hash no longer leaves the server), machine_binding_enabled, machine_bound_at, machine_binding_mode, machine_binding_active; top level machine_binding: { licensed, mode }
• PUT /api/v1/tokens/:id/binding: returns 409 { code: 'binding_mode', mode } outside individual mode, so it no longer stores a flag that has no effect. Returns the updated token.
• DELETE /api/v1/tokens/:id/binding: clears the fingerprint and machine_bound_at, and returns the updated token
• Both routes now pass details/source/severity to activity.log correctly. Before this they used a 4-argument call, so the details were dropped.
• The /tokens router is admin-session only, with no ownership check, so an admin can already switch or reset tokens owned by other users. This is now covered by a test, and the users router needed no change.
• One shared rule tokens.isMachineBindingActive() / machineBindingState() is now used by the client routes (verifyMachineBinding), the enrollment redeem and the lists.

Data

• Migration 88 add_machine_bound_at: api_tokens.machine_bound_at. It is set by bindMachineFingerprint (client request or setup code) and cleared by the reset. Tokens bound before this migration keep NULL, so the page shows no "seit".
• The first binding logs machine_binding_bound once per binding. The UPDATE has a WHERE machine_fingerprint IS NULL guard, so concurrent first requests cannot double-log. machine_binding_reset now carries the short fingerprint. Both events fall into the existing machine_binding_ security category.

Settings → Gerätebindung

The description and hints are rewritten:

• this binds a token to the device (hardware fingerprint) the client first connects from;
• it is not the same as the peer binding;
• status and reset are on the Benutzer page (linked);
• the Windows client and the Android app from version 1.16 send the fingerprint;
• older clients are rejected once binding is active for their token.

New keys are added in both de.json and en.json.

Dependency fix (not related to the feature)

Dependency Audit and Trivy failed because of new advisories that also affect master:

• proxy-addr <= 2.0.7, critical, GHSA-jqcg-44mw-7w3h (pulled in by express)
• fast-copy 4.0.0–4.0.4, moderate, GHSA-jggr-w7fw-pc2j

npm audit fix --package-lock-only bumps them to 2.0.8 and 4.1.2. These are patch releases inside the existing ranges, and package.json is unchanged. This is a separate commit.

Tests

tests/machine_binding_ui.test.js covers:

• migration 88
• bound_at and the machine_binding_bound event, logged once
• first-use binding through verifyMachineBinding
• list fields, and that the full hash is never in a response
• global mode makes every token active
• an admin toggles another user's token in individual mode
• 409 in global and off
• reset clears the fingerprint and bound_at and logs
• behaviour without the licence (403, lists still return the state)
• de/en key parity
• /users and /settings render without raw keys (withoutScripts), and every island string the JS uses is translated

There is no users scenario under tests/e2e, so no browser scenario was extended.

🤖 Generated with Claude Code

https://claude.ai/code/session_016xX1efcZF1f6G9rhmaJNLD

---

Generated by Claude Code