@camstack/server 1.2.480 → 1.2.481

package/dist/api/core/auth.router.js

@@ -21,6 +21,10 @@ const types_1 = require("@camstack/types");
 const server_1 = require("@trpc/server");
 const zod_1 = require("zod");
 const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
+const auth_provider_gate_js_1 = require("../../auth/auth-provider-gate.js");
+const external_link_intents_js_1 = require("../../auth/external-link-intents.js");
+const passkey_provider_js_1 = require("../../auth/passkey-provider.js");
+const second_factors_js_1 = require("../../auth/second-factors.js");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const session_mint_js_1 = require("../../auth/session-mint.js");
 const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
@@ -63,7 +67,7 @@ const ceremonyProcedure = makeRateLimitedProcedure(CEREMONY_LIMITER);
  * the `user-passkeys` cap. The client renders a chooser from this list
  * so a future alternate 2FA cap works with zero login-flow changes.
  */
-const SecondFactorSchema = zod_1.z.enum(['totp', 'passkey']);
+// `SecondFactorSchema` lives in `auth/second-factors.ts` (shared with the SSO finish).
 /**
  * Login response.
  *
@@ -87,93 +91,8 @@ const LoginResultSchema = zod_1.z.object({
         isAdmin: zod_1.z.boolean(),
     }),
     requiresTotp: zod_1.z.boolean().optional(),
-    secondFactors: zod_1.z.array(SecondFactorSchema).optional(),
+    secondFactors: zod_1.z.array(second_factors_js_1.SecondFactorSchema).optional(),
 });
-// ── Passkey (user-passkeys cap) resolution ───────────────────────────
-//
-// Cap-agnostic: the passkey provider is resolved through the
-// `user-passkeys` CAPABILITY, never by addon id. Any addon registering
-// the cap works. Resolution mirrors `hwaccel.router`:
-//   1. hub-in-process collection provider (a future hub-resident impl),
-//   2. else the hub-local forked child over UDS via the Moleculer cap
-//      proxy (`createCapabilityProxy(cap, 'hub')`) — the same routing the
-//      generated cap routers use.
-// The proxy is loosely typed (`Record<method, (params)=>Promise<unknown>>`);
-// its outputs are narrowed through the cap's own Zod schemas rather than
-// cast to the provider type (repo rule: no `as` on cross-boundary values).
-const OptionsJsonSchema = zod_1.z.object({ optionsJSON: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) });
-const FinishRegistrationSchema = zod_1.z.object({ success: zod_1.z.literal(true), credentialId: zod_1.z.string() });
-const FinishAuthenticationSchema = zod_1.z.object({ verified: zod_1.z.boolean() });
-const FinishDiscoverableAuthenticationSchema = zod_1.z.object({
-    verified: zod_1.z.boolean(),
-    userId: zod_1.z.string().nullable(),
-});
-const RemovePasskeySchema = zod_1.z.object({ success: zod_1.z.literal(true) });
-const SecondFactorPreferenceSchema = zod_1.z.object({ enabled: zod_1.z.boolean() });
-const SetSecondFactorPreferenceSchema = zod_1.z.object({ success: zod_1.z.literal(true) });
-function proxyPasskeyProvider(proxy) {
-    const call = async (method, params) => {
-        const fn = proxy[method];
-        if (typeof fn !== 'function')
-            throw new Error(`user-passkeys proxy missing method '${method}'`);
-        return fn(params);
-    };
-    return {
-        beginRegistration: async (input) => OptionsJsonSchema.parse(await call('beginRegistration', input)),
-        finishRegistration: async (input) => FinishRegistrationSchema.parse(await call('finishRegistration', input)),
-        beginAuthentication: async (input) => OptionsJsonSchema.parse(await call('beginAuthentication', input)),
-        finishAuthentication: async (input) => FinishAuthenticationSchema.parse(await call('finishAuthentication', input)),
-        beginDiscoverableAuthentication: async (input) => OptionsJsonSchema.parse(await call('beginDiscoverableAuthentication', input)),
-        finishDiscoverableAuthentication: async (input) => FinishDiscoverableAuthenticationSchema.parse(await call('finishDiscoverableAuthentication', input)),
-        listPasskeys: async (input) => zod_1.z.array(types_1.PasskeySummarySchema).parse(await call('listPasskeys', input)),
-        removePasskey: async (input) => RemovePasskeySchema.parse(await call('removePasskey', input)),
-        getSecondFactorPreference: async (input) => SecondFactorPreferenceSchema.parse(await call('getSecondFactorPreference', input)),
-        setSecondFactorPreference: async (input) => SetSecondFactorPreferenceSchema.parse(await call('setSecondFactorPreference', input)),
-    };
-}
-function resolvePasskeyProvider(registry, moleculer) {
-    const local = registry?.getCollection('user-passkeys')?.[0] ?? null;
-    if (local)
-        return local;
-    const proxy = moleculer?.createCapabilityProxy('user-passkeys', 'hub') ?? null;
-    return proxy ? proxyPasskeyProvider(proxy) : null;
-}
-/**
- * Whether the user has at least one enrolled passkey. Never throws — a
- * missing provider or a transport hiccup degrades to `false` so the
- * login flow is never blocked by passkey introspection.
- */
-async function userHasPasskey(userId, provider) {
-    if (!provider)
-        return false;
-    try {
-        const list = await provider.listPasskeys({ userId });
-        return list.length > 0;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Whether the user OPTED IN to their passkey doubling as a mandatory
- * second factor after a password login. Enrolling a passkey alone only
- * enables passkey-FIRST sign-in — this flag (default OFF, stored by the
- * `user-passkeys` provider) is what re-arms the 2FA gate. Never throws:
- * a missing provider, a provider predating the method, or a transport
- * hiccup all read as `false` so the preference lookup can never lock a
- * user out of the password flow.
- */
-async function passkeySecondFactorOptedIn(userId, provider) {
-    if (!provider || typeof provider.getSecondFactorPreference !== 'function')
-        return false;
-    try {
-        const pref = await provider.getSecondFactorPreference({ userId });
-        return pref.enabled;
-    }
-    catch {
-        return false;
-    }
-}
 // ── Login-method aggregation (login-method cap) ──────────────────────
 //
 // The PUBLIC `listLoginMethods` procedure walks the `login-method`
@@ -197,6 +116,17 @@ const PublicLoginMethodSchema = zod_1.z.discriminatedUnion('kind', [
     PublicWidgetLoginMethodSchema,
     types_1.PasskeyLoginMethodSchema,
 ]);
+/** One of the caller's linked sign-in identities, as the profile shows it (D782). */
+const OwnExternalIdentitySchema = zod_1.z.object({
+    provider: zod_1.z.string(),
+    subject: zod_1.z.string(),
+    label: zod_1.z.string().optional(),
+    linkedAt: zod_1.z.number(),
+    /** The provider instance's button label, or `null` when it is gone / disabled. */
+    providerLabel: zod_1.z.string().nullable(),
+    /** Whether the provider instance is configured and enabled right now. */
+    available: zod_1.z.boolean(),
+});
 // ── Share tokens (grid-view standalone share links) ──────────────────
 //
 // Wire schemas for the `csv_*` share-token surface. The summary shape
@@ -324,7 +254,7 @@ const MeSchema = zod_1.z
     scope: EffectiveScopeSchema.optional(),
 })
     .nullable();
-function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService()) {
+function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService(), linkIntents = new external_link_intents_js_1.ExternalLinkIntents()) {
     const requireShareTokens = () => {
         if (!shareTokens) {
             throw new Error('Share tokens unavailable — service not wired on this node');
@@ -362,39 +292,91 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             throw error;
         }
     };
+    /** The second factors a primary login still owes (`auth/second-factors.ts`). */
+    const collectSecondFactorsFor = async (userId, primary) => {
+        const userMgmt = registry?.getSingleton('user-management');
+        return (0, second_factors_js_1.collectSecondFactors)({
+            ...(userMgmt && typeof userMgmt.getTotpStatus === 'function'
+                ? { getTotpStatus: (input) => userMgmt.getTotpStatus(input) }
+                : {}),
+            passkeyProvider: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer),
+        }, userId, primary);
+    };
     /**
-     * The second factors `userId` must still satisfy after a successful
-     * PRIMARY factor. 2FA applies uniformly to every primary method:
-     *
-     *   • `totp` — whenever enrolled, regardless of how the user signed in.
-     *   • `passkey` — ONLY when the user both has an enrolled passkey AND
-     *     explicitly opted in (`getSecondFactorPreference`, default OFF —
-     *     enrolling a passkey alone just enables passkey-first sign-in),
-     *     and NEVER when the primary factor already WAS the passkey
-     *     (re-proving the factor that just signed in adds nothing).
-     *
-     * Passkey introspection is resilient (missing provider / transport
-     * error ⇒ no passkey factor) so it can never block a login; a TOTP
-     * status failure still propagates — fail-open there would silently
-     * skip an enrolled factor.
+     * The login page's methods: every enabled auth addon's `login-method`
+     * contributions (D777), validated and deduplicated. Shared by
+     * `listLoginMethods` and the D782 linking procedures.
      */
-    const collectSecondFactors = async (userId, primary) => {
-        const userMgmt = registry?.getSingleton('user-management');
-        const totpStatus = userMgmt && typeof userMgmt.getTotpStatus === 'function'
-            ? await userMgmt.getTotpStatus({ userId })
-            : { enabled: false };
-        const factors = [];
-        if (totpStatus.enabled)
-            factors.push('totp');
-        if (primary !== 'passkey') {
-            const provider = resolvePasskeyProvider(registry, moleculer);
-            const enrolled = await userHasPasskey(userId, provider);
-            if (enrolled && (await passkeySecondFactorOptedIn(userId, provider))) {
-                factors.push('passkey');
+    const aggregateLoginMethods = async () => {
+        if (!registry)
+            return [];
+        const out = [];
+        // Defense-in-depth dedupe: a routing bug in a grouped runner once
+        // resolved every provider to the same addon (3× identical magic-link
+        // buttons) — a duplicated contribution id must never render twice.
+        const seenIds = new Set();
+        for (const [addonId, provider] of registry.getCollectionEntries('login-method')) {
+            // The operator's Enable/Disable on Identity → Authentication is the
+            // addon's ONE enable (D777). It toggles `auth-provider` /
+            // `user-passkeys`, never `login-method` — so ask the governing caps.
+            if ((0, auth_provider_gate_js_1.isAuthAddonDisabled)(registry, addonId))
+                continue;
+            let contributions;
+            try {
+                contributions = await provider.getLoginMethods();
+            }
+            catch {
+                continue;
+            }
+            for (const raw of contributions) {
+                if (seenIds.has(raw.id))
+                    continue;
+                if (raw.kind === 'redirect') {
+                    const parsed = types_1.RedirectLoginMethodSchema.safeParse(raw);
+                    if (parsed.success) {
+                        out.push(parsed.data);
+                        seenIds.add(parsed.data.id);
+                    }
+                    continue;
+                }
+                if (raw.kind === 'passkey') {
+                    // Native ceremony — passes through untouched, no server-side
+                    // enrichment (rpId/origin are already stamped by the addon).
+                    const parsed = types_1.PasskeyLoginMethodSchema.safeParse(raw);
+                    if (parsed.success) {
+                        out.push(parsed.data);
+                        seenIds.add(parsed.data.id);
+                    }
+                    continue;
+                }
+                // Widget arm — stamp a public bundleUrl with the version in the
+                // PATH, not a `?v=` query. Module-Federation bundles import their
+                // fixed-name siblings (`./_stub.js`) by RELATIVE url, which never
+                // inherit a query — so a `?v=` busts only the entry and a CDN edge
+                // keeps serving a stale `_stub.js` (missing the newest widget). A
+                // path prefix makes every relative import inherit it → one atomic
+                // whole-bundle cache miss per deploy, on any CDN. `AUTH_BUNDLE_VERSION`
+                // is stable per hub process (busts on restart/deploy, caches within
+                // uptime). The `/api/addon-widgets` route strips the `v<…>/` segment.
+                const parsed = PublicWidgetLoginMethodSchema.safeParse({
+                    ...raw,
+                    bundleUrl: `/api/addon-widgets/${raw.addonId}/v${AUTH_BUNDLE_VERSION}/${raw.bundle}`,
+                });
+                if (parsed.success) {
+                    out.push(parsed.data);
+                    seenIds.add(parsed.data.id);
+                }
             }
         }
-        return factors;
+        return out;
     };
+    /**
+     * Sign-in providers a signed-in user may link (D782): an enabled provider's
+     * redirect method that declares `linkable: true` — the contract, not its id.
+     */
+    const linkableProviders = async () => (await aggregateLoginMethods()).flatMap((m) => m.kind === 'redirect' && m.linkable === true
+        ? [{ provider: m.id, label: m.label, startUrl: m.startUrl }]
+        : []);
     return (0, trpc_middleware_js_1.trpcRouter)({
         login: credentialProcedure
             .input(zod_1.z.object({ username: zod_1.z.string(), password: zod_1.z.string() }))
@@ -428,7 +410,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             // protected endpoints (the auth middleware rejects anything
             // without the standard session shape); the same token binds
             // both the TOTP and the passkey second legs (same userId).
-            const secondFactors = await collectSecondFactors(user.id, 'password');
+            const secondFactors = await collectSecondFactorsFor(user.id, 'password');
             if (secondFactors.length > 0) {
                 const challengeToken = auth.signTotpChallengeToken({
                     userId: user.id,
@@ -487,13 +469,13 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          */
         loginBeginPasskey: ceremonyProcedure
             .input(zod_1.z.object({ challengeToken: zod_1.z.string() }))
-            .output(OptionsJsonSchema)
+            .output(passkey_provider_js_1.OptionsJsonSchema)
             .mutation(async ({ input }) => {
             const claims = auth.verifyTotpChallengeToken(input.challengeToken);
             if (!claims) {
                 throw new Error('Invalid or expired login challenge — please re-enter your password');
             }
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
             return provider.beginAuthentication({ userId: claims.userId });
@@ -513,7 +495,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             if (!claims) {
                 throw new Error('Invalid or expired login challenge — please re-enter your password');
             }
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
             const result = await provider.finishAuthentication({
@@ -539,9 +521,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          */
         passkeyLoginBegin: ceremonyProcedure
             .input(zod_1.z.void())
-            .output(OptionsJsonSchema)
+            .output(passkey_provider_js_1.OptionsJsonSchema)
             .mutation(async () => {
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
             return provider.beginDiscoverableAuthentication({});
@@ -565,7 +547,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             .input(zod_1.z.object({ response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }))
             .output(LoginResultSchema)
             .mutation(async ({ input }) => {
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
             const result = await provider.finishDiscoverableAuthentication({
@@ -574,7 +556,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             if (!result.verified || !result.userId) {
                 throw new server_1.TRPCError({ code: 'UNAUTHORIZED', message: 'Passkey verification failed' });
             }
-            const secondFactors = await collectSecondFactors(result.userId, 'passkey');
+            const secondFactors = await collectSecondFactorsFor(result.userId, 'passkey');
             if (secondFactors.length > 0) {
                 const challenged = await findUserById(result.userId);
                 const challengeToken = auth.signTotpChallengeToken({
@@ -808,22 +790,22 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         // the `user-passkeys` cap, never an addon id.
         beginOwnPasskeyRegistration: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.void())
-            .output(OptionsJsonSchema)
+            .output(passkey_provider_js_1.OptionsJsonSchema)
             .mutation(async ({ ctx }) => {
             if (!ctx.user)
                 throw new Error('Not authenticated');
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey enrollment is not available');
             return provider.beginRegistration({ userId: ctx.user.id, username: ctx.user.username });
         }),
         finishOwnPasskeyRegistration: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.object({ response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()), label: zod_1.z.string() }))
-            .output(FinishRegistrationSchema)
+            .output(passkey_provider_js_1.FinishRegistrationSchema)
             .mutation(async ({ input, ctx }) => {
             if (!ctx.user)
                 throw new Error('Not authenticated');
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey enrollment is not available');
             return provider.finishRegistration({
@@ -838,7 +820,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             .query(async ({ ctx }) => {
             if (!ctx.user)
                 return [];
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 return [];
             try {
@@ -854,7 +836,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             .mutation(async ({ input, ctx }) => {
             if (!ctx.user)
                 throw new Error('Not authenticated');
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey management is not available');
             return provider.removePasskey({ userId: ctx.user.id, credentialId: input.credentialId });
@@ -869,11 +851,11 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          */
         getOwnPasskeySecondFactorPreference: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.void())
-            .output(SecondFactorPreferenceSchema)
+            .output(passkey_provider_js_1.SecondFactorPreferenceSchema)
             .query(async ({ ctx }) => {
             if (!ctx.user)
                 return { enabled: false };
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 return { enabled: false };
             try {
@@ -885,11 +867,11 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         }),
         setOwnPasskeySecondFactorPreference: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.object({ enabled: zod_1.z.boolean() }))
-            .output(SetSecondFactorPreferenceSchema)
+            .output(passkey_provider_js_1.SetSecondFactorPreferenceSchema)
             .mutation(async ({ input, ctx }) => {
             if (!ctx.user)
                 throw new Error('Not authenticated');
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey management is not available');
             return provider.setSecondFactorPreference({
@@ -973,6 +955,74 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             .input(zod_1.z.void())
             .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
             .mutation(() => ({ success: true })),
+        // ── External sign-in identities (D782) ────────────────────────
+        //
+        // A signed-in user links an OIDC identity to THEIR OWN account. The
+        // intent is minted for `ctx.user` here and resolved by the SSO finish,
+        // which also requires the same user's session cookie — the user id never
+        // travels through the browser.
+        /** Sign-in providers the caller can link (redirect methods declaring `linkable`). */
+        listLinkableProviders: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(zod_1.z.object({ provider: zod_1.z.string(), label: zod_1.z.string() })))
+            .query(async () => (await linkableProviders()).map(({ provider, label }) => ({ provider, label }))),
+        /** Start linking `provider` to the caller; the client navigates to `url`. */
+        beginExternalLink: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ provider: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ url: zod_1.z.string() }))
+            .mutation(async ({ ctx, input }) => {
+            if (!ctx.user)
+                throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
+            assertRealUserSession(ctx.user, 'Linking a sign-in account');
+            const target = (await linkableProviders()).find((p) => p.provider === input.provider);
+            if (target === undefined) {
+                throw new server_1.TRPCError({
+                    code: 'BAD_REQUEST',
+                    message: `Sign-in provider "${input.provider}" is not available for linking`,
+                });
+            }
+            const handle = linkIntents.create(ctx.user.id, target.provider);
+            const separator = target.startUrl.includes('?') ? '&' : '?';
+            return { url: `${target.startUrl}${separator}link=${encodeURIComponent(handle)}` };
+        }),
+        /** The caller's linked identities; `available: false` when the provider instance is gone or off. */
+        listOwnExternalIdentities: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(OwnExternalIdentitySchema))
+            .query(async ({ ctx }) => {
+            if (!ctx.user)
+                return [];
+            const userMgmt = registry?.getSingleton('user-management');
+            if (!userMgmt || typeof userMgmt.listExternalIdentities !== 'function')
+                return [];
+            const labels = new Map((await linkableProviders()).map((p) => [p.provider, p.label]));
+            const links = await userMgmt.listExternalIdentities({ userId: ctx.user.id });
+            return links.map((link) => ({
+                provider: link.provider,
+                subject: link.subject,
+                ...(link.label !== undefined ? { label: link.label } : {}),
+                linkedAt: link.linkedAt,
+                providerLabel: labels.get(link.provider) ?? null,
+                available: labels.has(link.provider),
+            }));
+        }),
+        /** Remove one of the caller's own links. */
+        unlinkOwnExternalIdentity: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ provider: zod_1.z.string().min(1), subject: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
+            .mutation(async ({ ctx, input }) => {
+            if (!ctx.user)
+                throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
+            assertRealUserSession(ctx.user, 'Unlinking a sign-in account');
+            const userMgmt = registry?.getSingleton('user-management');
+            if (!userMgmt)
+                throw new Error('user-management capability not available');
+            return userMgmt.unlinkExternalIdentity({
+                userId: ctx.user.id,
+                provider: input.provider,
+                subject: input.subject,
+            });
+        }),
         /**
          * PUBLIC — the login page's single source of pre-auth login surfaces.
          * Aggregates the `login-method` collection: every auth addon (OIDC,
@@ -982,6 +1032,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * `widget` methods via `loadRemoteBundle` — a future SSO addon plugs
          * in with ZERO shell change.
          *
+         * A provider disabled on Identity → Authentication contributes nothing
+         * (D777: that toggle is an auth addon's only enable).
+         *
          * A failing / slow provider is skipped independently (mirrors
          * `listProviders`' old resilience) so one bad addon can't lock every
          * login method out of the UI.
@@ -989,63 +1042,6 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         listLoginMethods: trpc_middleware_js_1.publicProcedure
             .input(zod_1.z.void())
             .output(zod_1.z.array(PublicLoginMethodSchema).readonly())
-            .query(async () => {
-            if (!registry)
-                return [];
-            const out = [];
-            // Defense-in-depth dedupe: a routing bug in a grouped runner once
-            // resolved every provider to the same addon (3× identical magic-link
-            // buttons) — a duplicated contribution id must never render twice.
-            const seenIds = new Set();
-            for (const provider of registry.getCollection('login-method')) {
-                let contributions;
-                try {
-                    contributions = await provider.getLoginMethods();
-                }
-                catch {
-                    continue;
-                }
-                for (const raw of contributions) {
-                    if (seenIds.has(raw.id))
-                        continue;
-                    if (raw.kind === 'redirect') {
-                        const parsed = types_1.RedirectLoginMethodSchema.safeParse(raw);
-                        if (parsed.success) {
-                            out.push(parsed.data);
-                            seenIds.add(parsed.data.id);
-                        }
-                        continue;
-                    }
-                    if (raw.kind === 'passkey') {
-                        // Native ceremony — passes through untouched, no server-side
-                        // enrichment (rpId/origin are already stamped by the addon).
-                        const parsed = types_1.PasskeyLoginMethodSchema.safeParse(raw);
-                        if (parsed.success) {
-                            out.push(parsed.data);
-                            seenIds.add(parsed.data.id);
-                        }
-                        continue;
-                    }
-                    // Widget arm — stamp a public bundleUrl with the version in the
-                    // PATH, not a `?v=` query. Module-Federation bundles import their
-                    // fixed-name siblings (`./_stub.js`) by RELATIVE url, which never
-                    // inherit a query — so a `?v=` busts only the entry and a CDN edge
-                    // keeps serving a stale `_stub.js` (missing the newest widget). A
-                    // path prefix makes every relative import inherit it → one atomic
-                    // whole-bundle cache miss per deploy, on any CDN. `AUTH_BUNDLE_VERSION`
-                    // is stable per hub process (busts on restart/deploy, caches within
-                    // uptime). The `/api/addon-widgets` route strips the `v<…>/` segment.
-                    const parsed = PublicWidgetLoginMethodSchema.safeParse({
-                        ...raw,
-                        bundleUrl: `/api/addon-widgets/${raw.addonId}/v${AUTH_BUNDLE_VERSION}/${raw.bundle}`,
-                    });
-                    if (parsed.success) {
-                        out.push(parsed.data);
-                        seenIds.add(parsed.data.id);
-                    }
-                }
-            }
-            return out;
-        }),
+            .query(async () => aggregateLoginMethods()),
     });
 }