From 85c135d18a35844caa43772b7c2ce1e382ac3f22 Mon Sep 17 00:00:00 2001
From: Lyon <88232613+pikasTech@users.noreply.github.com>
Date: Mon, 22 Jun 2026 09:19:24 +0800
Subject: [PATCH] fix(auth): issue local sessions for user billing web login
 (#1863)

---
 internal/cloud/access-control.ts | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/internal/cloud/access-control.ts b/internal/cloud/access-control.ts
index 2e335b57..8ddecaee 100644
--- a/internal/cloud/access-control.ts
+++ b/internal/cloud/access-control.ts
@@ -943,13 +943,21 @@ class AccessController {
           valuesRedacted: login.valuesRedacted
         };
       }
-      const token = textOr(login.body.token, "");
-      const auth = await this.authenticateUserBillingToken(token);
+      const upstreamToken = textOr(login.body.token, "");
+      const auth = await this.authenticateUserBillingToken(upstreamToken);
       if (!auth.ok) {
         return { ok: false, status: auth.status, error: auth.error };
       }
-      setSessionCookie(response, token, SESSION_MAX_AGE_SECONDS, request, this.env);
-      return { ok: true, auth, token, status: login.status, retryCount: login.retryCount, transientObserved: login.transientObserved };
+      const localSession = await this.issueWebSessionForActor(auth.actor);
+      const localAuth = {
+        ok: true,
+        actor: auth.actor,
+        session: publicSession({ ...localSession.session, user: auth.actor }),
+        authMethod: AUTH_METHOD_WEB_SESSION,
+        userBilling: auth.userBilling ? { active: true, principal: auth.userBilling.principal, valuesRedacted: true } : undefined
+      };
+      setSessionCookie(response, localSession.token, SESSION_MAX_AGE_SECONDS, request, this.env);
+      return { ok: true, auth: localAuth, token: localSession.token, upstreamTokenPrefix: redactedTokenPrefix(upstreamToken), status: login.status, retryCount: login.retryCount, transientObserved: login.transientObserved, valuesRedacted: true };
     } catch (error) {
       thrownCode = textOr(error?.code, "user_billing_login_exception");
       throw error;