@camstack/addon-auth 1.2.130 → 1.2.131

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,41 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_hub_browser_origin = require("../hub-browser-origin-C-u2l9VC.js");
+const require_hub_browser_origin = require("../hub-browser-origin-CCWSbHYb.js");
+//#region src/magic-link/retire-enabled-flag.ts
+/** The retired settings key. */
+var RETIRED_ENABLED_KEY = "enabled";
+/** Store key marking the retirement as done. Not a schema field. */
+var RETIREMENT_MARKER_KEY = "enabledFlagRetired";
+function deferred(reason) {
+	return {
+		kind: "deferred",
+		reason
+	};
+}
+function isMarked(read) {
+	return read.kind === "present" && read.value === true;
+}
+async function retireEnabledFlag(deps) {
+	const marker = await deps.readStoredKey(RETIREMENT_MARKER_KEY);
+	if (marker.kind === "unreadable") return deferred("settings store unreadable (marker)");
+	if (isMarked(marker)) return { kind: "already-retired" };
+	const flag = await deps.readStoredKey(RETIRED_ENABLED_KEY);
+	if (flag.kind === "unreadable") return deferred("settings store unreadable (enabled)");
+	const wasOn = flag.kind === "present" && flag.value === true;
+	if (!wasOn) try {
+		await deps.disableAtCapability();
+	} catch (err) {
+		return deferred(`capability toggle refused: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	await deps.commit();
+	if (!isMarked(await deps.readStoredKey("enabledFlagRetired"))) return deferred("retirement write did not land");
+	return {
+		kind: "retired",
+		capDisabled: !wasOn
+	};
+}
+//#endregion
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -18,10 +52,10 @@ const require_hub_browser_origin = require("../hub-browser-origin-C-u2l9VC.js");
 *   3. Email click hits `/login?bridge=…` → 302 to `/api/auth/sso/finish?bridge=…`
 *      → hub verifies the bridge token and mints the real session.
 *
-* Delivery is pluggable. This addon ships a "log-only" mode by default
-* (writes the URL to the addon log so operators can copy it during
-* setup before SMTP is configured). Production deployments configure
-* the SMTP relay via global settings.
+* Delivery is pluggable. This addon ships a "log-only" mode by default,
+* which records that a link was requested but never writes the link
+* itself (it is a login credential — D783). Production deployments
+* configure the SMTP relay via global settings.
 *
 * Open follow-ups:
 *   - Wire `nodemailer` for real SMTP delivery (peer dep; the framework
@@ -29,16 +63,30 @@ const require_hub_browser_origin = require("../hub-browser-origin-C-u2l9VC.js");
 *   - Throttle requests per-email (rate-limit window).
 *   - Auto-provision unknown emails (currently rejected for safety).
 */
+/** Capability whose per-provider toggle is magic-link's ONE enable (Identity → Authentication). */
+var GOVERNING_CAPABILITY = "auth-provider";
+/** Backoff between retirement attempts — the first ones are refused until the
+*  provider registration reaches the hub. After the last, the next boot retries. */
+var RETIREMENT_RETRY_DELAYS_MS = [
+	1e3,
+	2e3,
+	5e3,
+	1e4,
+	3e4,
+	6e4
+];
 var DEFAULT_CONFIG = {
-	enabled: false,
 	displayName: "Email magic link",
-	icon: "mail",
+	icon: "mailbox",
 	publicOrigin: "",
 	deliveryMode: "log-only",
 	defaultRole: "viewer",
 	ttlSec: 600
 };
 var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
+	enabledFlagRetired = false;
+	retirementTimer = null;
+	shuttingDown = false;
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
@@ -78,6 +126,8 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 		]);
 		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
+		this.shuttingDown = false;
+		this.attemptEnabledFlagRetirement(0);
 		return [
 			{
 				capability: require_hub_browser_origin.authProviderCapability,
@@ -94,16 +144,70 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 		];
 	}
 	buildLoginMethods() {
-		if (!this.config.enabled) return [];
+		if (!this.enabledFlagRetired) return [];
 		return [{
 			kind: "redirect",
 			id: "auth-magic-link",
 			label: this.config.displayName || DEFAULT_CONFIG.displayName,
-			icon: this.config.icon || DEFAULT_CONFIG.icon,
+			icon: require_hub_browser_origin.isDisplayIconKey(this.config.icon) ? this.config.icon : DEFAULT_CONFIG.icon,
 			startUrl: "/addon/auth-magic-link/start",
 			stage: "primary"
 		}];
 	}
+	async onShutdown() {
+		this.shuttingDown = true;
+		if (this.retirementTimer !== null) clearTimeout(this.retirementTimer);
+		this.retirementTimer = null;
+	}
+	/** One attempt of the D777 carry-over; reschedules itself while deferred. */
+	async attemptEnabledFlagRetirement(attempt) {
+		if (this.shuttingDown) return;
+		let outcome;
+		try {
+			outcome = await retireEnabledFlag({
+				readStoredKey: (key) => this.readStoredGlobalKey(key),
+				disableAtCapability: async () => {
+					await this.ctx.api.addons.setCapabilityProviderEnabled.mutate({
+						capName: GOVERNING_CAPABILITY,
+						addonId: this.ctx.id,
+						enabled: false
+					});
+				},
+				commit: async () => {
+					const patch = {
+						[RETIRED_ENABLED_KEY]: void 0,
+						[RETIREMENT_MARKER_KEY]: true
+					};
+					await this.updateGlobalSettings(patch);
+				}
+			});
+		} catch (err) {
+			outcome = {
+				kind: "deferred",
+				reason: require_hub_browser_origin.errMsg(err)
+			};
+		}
+		if (outcome.kind !== "deferred") {
+			this.enabledFlagRetired = true;
+			if (outcome.kind === "retired") this.ctx.logger.info(outcome.capDisabled ? "Magic-link: the retired `enabled` setting was off — the provider is now DISABLED on Identity → Authentication; enable it there to offer magic-link login." : "Magic-link: the retired `enabled` setting was on — the provider stays enabled on Identity → Authentication.");
+			return;
+		}
+		const delay = RETIREMENT_RETRY_DELAYS_MS[attempt];
+		if (delay === void 0) {
+			this.ctx.logger.warn("Magic-link: carrying the retired `enabled` setting over to the capability toggle failed — login button withheld until the next boot", { meta: { reason: outcome.reason } });
+			return;
+		}
+		this.ctx.logger.debug("Magic-link: enabled-flag retirement deferred", { meta: {
+			reason: outcome.reason,
+			attempt,
+			retryInMs: delay
+		} });
+		this.retirementTimer = setTimeout(() => {
+			this.retirementTimer = null;
+			this.attemptEnabledFlagRetirement(attempt + 1);
+		}, delay);
+		this.retirementTimer.unref?.();
+	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
 			id: "magic-link",
@@ -111,13 +215,6 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
 			columns: 1,
 			fields: [
-				this.field({
-					type: "boolean",
-					key: "enabled",
-					label: "Enabled",
-					description: "Offer the magic-link button on the login page. Leave off until email delivery is configured.",
-					default: DEFAULT_CONFIG.enabled
-				}),
 				this.field({
 					type: "text",
 					key: "displayName",
@@ -125,9 +222,10 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 					default: DEFAULT_CONFIG.displayName
 				}),
 				this.field({
-					type: "text",
+					type: "icon",
 					key: "icon",
 					label: "Icon",
+					description: "Shown on the login button.",
 					default: DEFAULT_CONFIG.icon
 				}),
 				this.field({
@@ -141,7 +239,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 					type: "select",
 					key: "deliveryMode",
 					label: "Delivery mode",
-					description: "log-only writes the URL to the addon log (setup only). smtp uses the configured SMTP relay.",
+					description: "log-only records the request in the addon log but never the link (it is a login credential). smtp uses the configured SMTP relay.",
 					default: DEFAULT_CONFIG.deliveryMode,
 					options: [{
 						value: "log-only",
@@ -278,15 +376,15 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 				reply.send({ error: "sso-bridge capability unavailable" });
 				return;
 			}
-			const link = `${await this.buildPublicOrigin()}/addon/auth-magic-link/login?bridge=${encodeURIComponent(token)}`;
-			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated (log-only mode — NOT delivered via email)", { meta: {
+			`${await this.buildPublicOrigin()}${encodeURIComponent(token)}`;
+			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated — not delivered (log-only mode, link withheld)", { meta: {
 				email,
-				link,
-				ttlSec: this.config.ttlSec
+				ttlSec: this.config.ttlSec,
+				delivered: false
 			} });
-			else this.ctx.logger.warn("Magic link delivery: SMTP mode requested but no smtp-provider cap registered. Falling back to log.", { meta: {
+			else this.ctx.logger.warn("Magic link not delivered: SMTP mode requested but no smtp-provider cap registered", { meta: {
 				email,
-				link
+				delivered: false
 			} });
 			reply.code(200);
 			reply.send(ok);

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,38 @@
-import { a as buildAddonRouteProvider, c as errMsg, i as authProviderCapability, l as BaseAddon, n as addonRoutesCapability, o as loginMethodCapability, t as hubBrowserOrigin } from "../hub-browser-origin-B1o5vmQX.mjs";
+import { a as buildAddonRouteProvider, i as authProviderCapability, l as errMsg, n as addonRoutesCapability, o as isDisplayIconKey, s as loginMethodCapability, t as hubBrowserOrigin, u as BaseAddon } from "../hub-browser-origin-BRU-HVqq.mjs";
+//#region src/magic-link/retire-enabled-flag.ts
+/** The retired settings key. */
+var RETIRED_ENABLED_KEY = "enabled";
+/** Store key marking the retirement as done. Not a schema field. */
+var RETIREMENT_MARKER_KEY = "enabledFlagRetired";
+function deferred(reason) {
+	return {
+		kind: "deferred",
+		reason
+	};
+}
+function isMarked(read) {
+	return read.kind === "present" && read.value === true;
+}
+async function retireEnabledFlag(deps) {
+	const marker = await deps.readStoredKey(RETIREMENT_MARKER_KEY);
+	if (marker.kind === "unreadable") return deferred("settings store unreadable (marker)");
+	if (isMarked(marker)) return { kind: "already-retired" };
+	const flag = await deps.readStoredKey(RETIRED_ENABLED_KEY);
+	if (flag.kind === "unreadable") return deferred("settings store unreadable (enabled)");
+	const wasOn = flag.kind === "present" && flag.value === true;
+	if (!wasOn) try {
+		await deps.disableAtCapability();
+	} catch (err) {
+		return deferred(`capability toggle refused: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	await deps.commit();
+	if (!isMarked(await deps.readStoredKey("enabledFlagRetired"))) return deferred("retirement write did not land");
+	return {
+		kind: "retired",
+		capDisabled: !wasOn
+	};
+}
+//#endregion
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -13,10 +47,10 @@ import { a as buildAddonRouteProvider, c as errMsg, i as authProviderCapability,
 *   3. Email click hits `/login?bridge=…` → 302 to `/api/auth/sso/finish?bridge=…`
 *      → hub verifies the bridge token and mints the real session.
 *
-* Delivery is pluggable. This addon ships a "log-only" mode by default
-* (writes the URL to the addon log so operators can copy it during
-* setup before SMTP is configured). Production deployments configure
-* the SMTP relay via global settings.
+* Delivery is pluggable. This addon ships a "log-only" mode by default,
+* which records that a link was requested but never writes the link
+* itself (it is a login credential — D783). Production deployments
+* configure the SMTP relay via global settings.
 *
 * Open follow-ups:
 *   - Wire `nodemailer` for real SMTP delivery (peer dep; the framework
@@ -24,16 +58,30 @@ import { a as buildAddonRouteProvider, c as errMsg, i as authProviderCapability,
 *   - Throttle requests per-email (rate-limit window).
 *   - Auto-provision unknown emails (currently rejected for safety).
 */
+/** Capability whose per-provider toggle is magic-link's ONE enable (Identity → Authentication). */
+var GOVERNING_CAPABILITY = "auth-provider";
+/** Backoff between retirement attempts — the first ones are refused until the
+*  provider registration reaches the hub. After the last, the next boot retries. */
+var RETIREMENT_RETRY_DELAYS_MS = [
+	1e3,
+	2e3,
+	5e3,
+	1e4,
+	3e4,
+	6e4
+];
 var DEFAULT_CONFIG = {
-	enabled: false,
 	displayName: "Email magic link",
-	icon: "mail",
+	icon: "mailbox",
 	publicOrigin: "",
 	deliveryMode: "log-only",
 	defaultRole: "viewer",
 	ttlSec: 600
 };
 var AuthMagicLinkAddon = class extends BaseAddon {
+	enabledFlagRetired = false;
+	retirementTimer = null;
+	shuttingDown = false;
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
@@ -73,6 +121,8 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 		]);
 		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
+		this.shuttingDown = false;
+		this.attemptEnabledFlagRetirement(0);
 		return [
 			{
 				capability: authProviderCapability,
@@ -89,16 +139,70 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 		];
 	}
 	buildLoginMethods() {
-		if (!this.config.enabled) return [];
+		if (!this.enabledFlagRetired) return [];
 		return [{
 			kind: "redirect",
 			id: "auth-magic-link",
 			label: this.config.displayName || DEFAULT_CONFIG.displayName,
-			icon: this.config.icon || DEFAULT_CONFIG.icon,
+			icon: isDisplayIconKey(this.config.icon) ? this.config.icon : DEFAULT_CONFIG.icon,
 			startUrl: "/addon/auth-magic-link/start",
 			stage: "primary"
 		}];
 	}
+	async onShutdown() {
+		this.shuttingDown = true;
+		if (this.retirementTimer !== null) clearTimeout(this.retirementTimer);
+		this.retirementTimer = null;
+	}
+	/** One attempt of the D777 carry-over; reschedules itself while deferred. */
+	async attemptEnabledFlagRetirement(attempt) {
+		if (this.shuttingDown) return;
+		let outcome;
+		try {
+			outcome = await retireEnabledFlag({
+				readStoredKey: (key) => this.readStoredGlobalKey(key),
+				disableAtCapability: async () => {
+					await this.ctx.api.addons.setCapabilityProviderEnabled.mutate({
+						capName: GOVERNING_CAPABILITY,
+						addonId: this.ctx.id,
+						enabled: false
+					});
+				},
+				commit: async () => {
+					const patch = {
+						[RETIRED_ENABLED_KEY]: void 0,
+						[RETIREMENT_MARKER_KEY]: true
+					};
+					await this.updateGlobalSettings(patch);
+				}
+			});
+		} catch (err) {
+			outcome = {
+				kind: "deferred",
+				reason: errMsg(err)
+			};
+		}
+		if (outcome.kind !== "deferred") {
+			this.enabledFlagRetired = true;
+			if (outcome.kind === "retired") this.ctx.logger.info(outcome.capDisabled ? "Magic-link: the retired `enabled` setting was off — the provider is now DISABLED on Identity → Authentication; enable it there to offer magic-link login." : "Magic-link: the retired `enabled` setting was on — the provider stays enabled on Identity → Authentication.");
+			return;
+		}
+		const delay = RETIREMENT_RETRY_DELAYS_MS[attempt];
+		if (delay === void 0) {
+			this.ctx.logger.warn("Magic-link: carrying the retired `enabled` setting over to the capability toggle failed — login button withheld until the next boot", { meta: { reason: outcome.reason } });
+			return;
+		}
+		this.ctx.logger.debug("Magic-link: enabled-flag retirement deferred", { meta: {
+			reason: outcome.reason,
+			attempt,
+			retryInMs: delay
+		} });
+		this.retirementTimer = setTimeout(() => {
+			this.retirementTimer = null;
+			this.attemptEnabledFlagRetirement(attempt + 1);
+		}, delay);
+		this.retirementTimer.unref?.();
+	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
 			id: "magic-link",
@@ -106,13 +210,6 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
 			columns: 1,
 			fields: [
-				this.field({
-					type: "boolean",
-					key: "enabled",
-					label: "Enabled",
-					description: "Offer the magic-link button on the login page. Leave off until email delivery is configured.",
-					default: DEFAULT_CONFIG.enabled
-				}),
 				this.field({
 					type: "text",
 					key: "displayName",
@@ -120,9 +217,10 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 					default: DEFAULT_CONFIG.displayName
 				}),
 				this.field({
-					type: "text",
+					type: "icon",
 					key: "icon",
 					label: "Icon",
+					description: "Shown on the login button.",
 					default: DEFAULT_CONFIG.icon
 				}),
 				this.field({
@@ -136,7 +234,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 					type: "select",
 					key: "deliveryMode",
 					label: "Delivery mode",
-					description: "log-only writes the URL to the addon log (setup only). smtp uses the configured SMTP relay.",
+					description: "log-only records the request in the addon log but never the link (it is a login credential). smtp uses the configured SMTP relay.",
 					default: DEFAULT_CONFIG.deliveryMode,
 					options: [{
 						value: "log-only",
@@ -273,15 +371,15 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 				reply.send({ error: "sso-bridge capability unavailable" });
 				return;
 			}
-			const link = `${await this.buildPublicOrigin()}/addon/auth-magic-link/login?bridge=${encodeURIComponent(token)}`;
-			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated (log-only mode — NOT delivered via email)", { meta: {
+			`${await this.buildPublicOrigin()}${encodeURIComponent(token)}`;
+			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated — not delivered (log-only mode, link withheld)", { meta: {
 				email,
-				link,
-				ttlSec: this.config.ttlSec
+				ttlSec: this.config.ttlSec,
+				delivered: false
 			} });
-			else this.ctx.logger.warn("Magic link delivery: SMTP mode requested but no smtp-provider cap registered. Falling back to log.", { meta: {
+			else this.ctx.logger.warn("Magic link not delivered: SMTP mode requested but no smtp-provider cap registered", { meta: {
 				email,
-				link
+				delivered: false
 			} });
 			reply.code(200);
 			reply.send(ok);

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_hub_browser_origin = require("../hub-browser-origin-C-u2l9VC.js");
+const require_hub_browser_origin = require("../hub-browser-origin-CCWSbHYb.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -733,9 +733,14 @@ function createRemoteJWKSet(url, options) {
 * — the hub verifies it with the same `jwtSecret` and only then mints
 * the user session JWT.
 *
+* Identity mapping is EXPLICIT LINKING only (D782): the bridge names the
+* identity `oidc:<instance>:<sub>`; the hub signs in the user that identity
+* was linked to, and refuses an unlinked one. A flow started by a signed-in
+* user's "Link" button carries the hub's opaque `?link=` handle through the
+* pending state into the bridge (`linkIntent`); the hub resolves it.
+*
 * TODO (next session):
 *   - RP-initiated logout (`end_session_endpoint` 302 with id_token_hint).
-*   - Groups → scope mapping via id_token `groups` claim.
 *   - Refresh token rotation (offline_access).
 *   - Persist state + nonce + PKCE across restart (multi-replica).
 */
@@ -748,11 +753,24 @@ var DEFAULT_PROVIDER = {
 	clientSecret: "",
 	redirectUri: "",
 	scopes: "openid profile email",
-	usernameClaim: "preferred_username",
-	defaultRole: "viewer"
+	usernameClaim: "preferred_username"
 };
 var DEFAULT_CONFIG = { providers: [] };
 var STATE_TTL_MS = 5 * 6e4;
+/**
+* Shape of a hub link-intent handle (`?link=` on /start). Opaque to this
+* addon — the hub resolves it, single-use, at the SSO finish. Validated only
+* so a junk value is refused here rather than carried into a signed bridge.
+*/
+var LINK_INTENT_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
+/**
+* An instance id appears in URLs and in the identity `oidc:<id>:<sub>`; a `:`
+* would make two identities read the same, so ids are slugs. A configured row
+* whose id is not one is skipped.
+*/
+var INSTANCE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+/** Bound on in-flight logins: `/start` is public, so a flood must not grow the map. */
+var MAX_PENDING_STATES = 1e3;
 var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 	/** Per-provider runtime state, keyed by `provider.id`. */
 	instances = /* @__PURE__ */ new Map();
@@ -822,9 +840,10 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 				kind: "redirect",
 				id: `auth-oidc/${id}`,
 				label: inst.config.displayName || DEFAULT_PROVIDER.displayName,
-				icon: inst.config.icon || DEFAULT_PROVIDER.icon,
+				icon: require_hub_browser_origin.isDisplayIconKey(inst.config.icon) ? inst.config.icon : DEFAULT_PROVIDER.icon,
 				startUrl: `/addon/auth-oidc/${id}/start`,
-				stage: "primary"
+				stage: "primary",
+				linkable: true
 			});
 		}
 		return out;
@@ -857,11 +876,11 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 						default: "OpenID Connect"
 					},
 					{
-						type: "text",
+						type: "icon",
 						key: "icon",
 						label: "Icon",
-						description: "lucide-react icon name (default: shield-check).",
-						default: "shield-check"
+						description: "Shown on the login button.",
+						default: DEFAULT_PROVIDER.icon
 					},
 					{
 						type: "text",
@@ -877,7 +896,7 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 						default: ""
 					},
 					{
-						type: "text",
+						type: "password",
 						key: "clientSecret",
 						label: "Client Secret",
 						default: ""
@@ -915,20 +934,6 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 								label: "sub (user id)"
 							}
 						]
-					},
-					{
-						type: "select",
-						key: "defaultRole",
-						label: "Default role",
-						description: "Role assigned to first-time SSO users.",
-						default: "viewer",
-						options: [{
-							value: "viewer",
-							label: "Viewer"
-						}, {
-							value: "admin",
-							label: "Admin"
-						}]
 					}
 				]
 			})]
@@ -942,7 +947,10 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 				...DEFAULT_PROVIDER,
 				...raw
 			};
-			if (!merged.id || !merged.id.trim()) continue;
+			if (!merged.id || !INSTANCE_ID_PATTERN.test(merged.id)) {
+				if (merged.id) this.ctx.logger.warn("OIDC: provider instance skipped — id must be a lowercase slug", { meta: { id: merged.id } });
+				continue;
+			}
 			this.instances.set(merged.id, {
 				config: merged,
 				discovery: null,
@@ -982,7 +990,7 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 		if (configured) return configured;
 		return `${await require_hub_browser_origin.hubBrowserOrigin(this.ctx.api.localNetwork, this.ctx.logger) ?? "https://localhost:4443"}/addon/auth-oidc/${providerId}/callback`;
 	}
-	async buildLoginUrl(providerId, state) {
+	async buildLoginUrl(providerId, state, linkIntent) {
 		const inst = this.instances.get(providerId);
 		if (!inst) throw new Error(`OIDC: no provider configured with id "${providerId}"`);
 		const doc = await this.getDiscovery(providerId);
@@ -991,12 +999,18 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 		const nonce = node_crypto.randomBytes(16).toString("base64url");
 		const redirectUri = await this.buildRedirectUri(providerId);
 		this.pruneExpiredStates();
+		while (this.pendingStates.size >= MAX_PENDING_STATES) {
+			const oldest = this.pendingStates.keys().next();
+			if (oldest.done) break;
+			this.pendingStates.delete(oldest.value);
+		}
 		this.pendingStates.set(state, {
 			codeVerifier,
 			nonce,
 			providerId,
 			redirectUri,
-			createdAt: Date.now()
+			createdAt: Date.now(),
+			...linkIntent !== void 0 ? { linkIntent } : {}
 		});
 		const params = new URLSearchParams({
 			response_type: "code",
@@ -1066,7 +1080,10 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 			username: String(username),
 			...emailClaim ? { email: emailClaim } : {},
 			...nameClaim ? { displayName: nameClaim } : {},
-			isAdmin: inst.config.defaultRole === "admin"
+			isAdmin: false,
+			...pending.linkIntent !== void 0 ? { linkIntent: pending.linkIntent } : {},
+			issuer: doc.issuer,
+			providerId
 		};
 	}
 	validateLocalSessionToken(_token) {
@@ -1079,9 +1096,15 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 			reply.send({ error: `Unknown OIDC provider: ${providerId}` });
 			return;
 		}
+		const linkParam = req.query["link"];
+		if (linkParam !== void 0 && !LINK_INTENT_PATTERN.test(linkParam)) {
+			reply.code(400);
+			reply.send({ error: "Malformed link request" });
+			return;
+		}
 		const state = node_crypto.randomBytes(16).toString("base64url");
 		try {
-			const url = await this.buildLoginUrl(providerId, state);
+			const url = await this.buildLoginUrl(providerId, state, linkParam);
 			reply.code(302);
 			reply.header("Location", url);
 			reply.send("");
@@ -1120,13 +1143,20 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 		}
 		try {
 			const result = await this.handleCallback(code, state);
+			if (result.providerId !== providerId) {
+				reply.code(400);
+				reply.send({ error: "OIDC callback does not match the provider the login started at" });
+				return;
+			}
 			const { token: bridgeToken } = await this.ctx.api.ssoBridge.signBridgeToken.query({ claims: {
 				userId: result.userId,
 				username: result.username,
 				isAdmin: result.isAdmin,
 				provider: `auth-oidc/${providerId}`,
 				...result.email ? { email: result.email } : {},
-				...result.displayName ? { displayName: result.displayName } : {}
+				...result.displayName ? { displayName: result.displayName } : {},
+				...result.linkIntent !== void 0 ? { linkIntent: result.linkIntent } : {},
+				issuer: result.issuer
 			} });
 			reply.code(302);
 			reply.header("Location", `/api/auth/sso/finish?bridge=${encodeURIComponent(bridgeToken)}`);