@camstack/server 1.2.480 → 1.2.482

package/dist/api/trpc/trpc.router.js

@@ -269,7 +269,7 @@ function buildCapabilityRouters(services) {
         // clusterNodes — fixed core API. Write-side purge for the durable
         // offline-node history (Track A "Forget node"); read side is push-only.
         clusterNodes: (0, cluster_nodes_router_js_1.createClusterNodesRouter)(services.agentRegistry),
-        auth: (0, auth_router_js_1.createAuthRouter)(services.authService, services.capabilityRegistry, services.moleculer, services.shareTokenService, services.handoffCodeService),
+        auth: (0, auth_router_js_1.createAuthRouter)(services.authService, services.capabilityRegistry, services.moleculer, services.shareTokenService, services.handoffCodeService, services.externalLinkIntents),
         // NOT MOUNTED — `mount: { kind: 'skip' }` legacy provider shapes
         // (positional args / sync returns) that don't match the codegen
         // routers' {input}-object + Promise<T> contract. The runtime builder

package/dist/auth/auth-provider-gate.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_GOVERNING_CAPS = void 0;
+exports.isAuthAddonDisabled = isAuthAddonDisabled;
+exports.bridgeProviderAddonId = bridgeProviderAddonId;
+/** Capabilities whose per-provider toggle is an auth addon's enable. */
+exports.AUTH_GOVERNING_CAPS = ['auth-provider', 'user-passkeys'];
+/** Whether the operator disabled `addonId` on Identity → Authentication. */
+function isAuthAddonDisabled(registry, addonId) {
+    return exports.AUTH_GOVERNING_CAPS.some((cap) => registry.isProviderDisabled(cap, addonId));
+}
+/**
+ * The addon behind an SSO bridge's `provider` claim: `auth-oidc/<instance>`
+ * is signed by `auth-oidc`, anything else names its addon directly.
+ */
+function bridgeProviderAddonId(provider) {
+    const slash = provider.indexOf('/');
+    return slash === -1 ? provider : provider.slice(0, slash);
+}

package/dist/auth/external-link-intents.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExternalLinkIntents = void 0;
+/**
+ * Pending "link this sign-in account" requests (D782).
+ *
+ * A signed-in user presses "Link Authentik": `auth.beginExternalLink` mints
+ * an intent for THAT session's user and returns the provider's start URL with
+ * the intent's opaque handle as `?link=`. The handle rides the IdP round trip
+ * (the OIDC addon keeps it in its server-side pending state, keyed by the
+ * OAuth `state`) and comes back inside the signed bridge. The SSO finish
+ * resolves it here — once — to the user it was minted for. The user id never
+ * travels through the browser.
+ *
+ * Hub-local and in memory on purpose: an intent lives minutes, and a hub
+ * restart mid-link costs the user one more click.
+ */
+const node_crypto_1 = require("node:crypto");
+/** Long enough for an IdP login with a password manager; short enough to be useless later. */
+const DEFAULT_TTL_MS = 10 * 60_000;
+/** Bounded: a session minting intents in a loop cannot grow this without limit. */
+const DEFAULT_MAX_ENTRIES = 1_000;
+class ExternalLinkIntents {
+    intents = new Map();
+    now;
+    ttlMs;
+    maxEntries;
+    constructor(opts = {}) {
+        this.now = opts.now ?? Date.now;
+        this.ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+        this.maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    }
+    create(userId, provider) {
+        this.prune();
+        while (this.intents.size >= this.maxEntries) {
+            const oldest = this.intents.keys().next();
+            if (oldest.done)
+                break;
+            this.intents.delete(oldest.value);
+        }
+        const handle = `li_${(0, node_crypto_1.randomBytes)(24).toString('base64url')}`;
+        this.intents.set(handle, { userId, provider, expiresAt: this.now() + this.ttlMs });
+        return handle;
+    }
+    /** The intent behind `handle`, removing it — or `null` (unknown, used, expired). */
+    consume(handle) {
+        const stored = this.intents.get(handle);
+        if (stored === undefined)
+            return null;
+        this.intents.delete(handle);
+        if (stored.expiresAt < this.now())
+            return null;
+        return { userId: stored.userId, provider: stored.provider };
+    }
+    prune() {
+        const now = this.now();
+        for (const [handle, intent] of this.intents) {
+            if (intent.expiresAt < now)
+                this.intents.delete(handle);
+        }
+    }
+}
+exports.ExternalLinkIntents = ExternalLinkIntents;

package/dist/auth/passkey-provider.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SetSecondFactorPreferenceSchema = exports.SecondFactorPreferenceSchema = exports.RemovePasskeySchema = exports.FinishDiscoverableAuthenticationSchema = exports.FinishAuthenticationSchema = exports.FinishRegistrationSchema = exports.OptionsJsonSchema = void 0;
+exports.resolvePasskeyProvider = resolvePasskeyProvider;
+exports.userHasPasskey = userHasPasskey;
+exports.passkeySecondFactorOptedIn = passkeySecondFactorOptedIn;
+const types_1 = require("@camstack/types");
+const zod_1 = require("zod");
+// ── Passkey (user-passkeys cap) resolution ───────────────────────────
+//
+// Cap-agnostic: the passkey provider is resolved through the
+// `user-passkeys` CAPABILITY, never by addon id. Any addon registering
+// the cap works. Resolution mirrors `hwaccel.router`:
+//   1. hub-in-process collection provider (a future hub-resident impl),
+//   2. else the hub-local forked child over UDS via the Moleculer cap
+//      proxy (`createCapabilityProxy(cap, 'hub')`) — the same routing the
+//      generated cap routers use.
+// The proxy is loosely typed (`Record<method, (params)=>Promise<unknown>>`);
+// its outputs are narrowed through the cap's own Zod schemas rather than
+// cast to the provider type (repo rule: no `as` on cross-boundary values).
+exports.OptionsJsonSchema = zod_1.z.object({ optionsJSON: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) });
+exports.FinishRegistrationSchema = zod_1.z.object({
+    success: zod_1.z.literal(true),
+    credentialId: zod_1.z.string(),
+});
+exports.FinishAuthenticationSchema = zod_1.z.object({ verified: zod_1.z.boolean() });
+exports.FinishDiscoverableAuthenticationSchema = zod_1.z.object({
+    verified: zod_1.z.boolean(),
+    userId: zod_1.z.string().nullable(),
+});
+exports.RemovePasskeySchema = zod_1.z.object({ success: zod_1.z.literal(true) });
+exports.SecondFactorPreferenceSchema = zod_1.z.object({ enabled: zod_1.z.boolean() });
+exports.SetSecondFactorPreferenceSchema = zod_1.z.object({ success: zod_1.z.literal(true) });
+function proxyPasskeyProvider(proxy) {
+    const call = async (method, params) => {
+        const fn = proxy[method];
+        if (typeof fn !== 'function')
+            throw new Error(`user-passkeys proxy missing method '${method}'`);
+        return fn(params);
+    };
+    return {
+        beginRegistration: async (input) => exports.OptionsJsonSchema.parse(await call('beginRegistration', input)),
+        finishRegistration: async (input) => exports.FinishRegistrationSchema.parse(await call('finishRegistration', input)),
+        beginAuthentication: async (input) => exports.OptionsJsonSchema.parse(await call('beginAuthentication', input)),
+        finishAuthentication: async (input) => exports.FinishAuthenticationSchema.parse(await call('finishAuthentication', input)),
+        beginDiscoverableAuthentication: async (input) => exports.OptionsJsonSchema.parse(await call('beginDiscoverableAuthentication', input)),
+        finishDiscoverableAuthentication: async (input) => exports.FinishDiscoverableAuthenticationSchema.parse(await call('finishDiscoverableAuthentication', input)),
+        listPasskeys: async (input) => zod_1.z.array(types_1.PasskeySummarySchema).parse(await call('listPasskeys', input)),
+        removePasskey: async (input) => exports.RemovePasskeySchema.parse(await call('removePasskey', input)),
+        getSecondFactorPreference: async (input) => exports.SecondFactorPreferenceSchema.parse(await call('getSecondFactorPreference', input)),
+        setSecondFactorPreference: async (input) => exports.SetSecondFactorPreferenceSchema.parse(await call('setSecondFactorPreference', input)),
+    };
+}
+function resolvePasskeyProvider(registry, moleculer) {
+    const local = registry?.getCollection('user-passkeys')?.[0] ?? null;
+    if (local)
+        return local;
+    const proxy = moleculer?.createCapabilityProxy('user-passkeys', 'hub') ?? null;
+    return proxy ? proxyPasskeyProvider(proxy) : null;
+}
+/**
+ * Whether the user has at least one enrolled passkey. Never throws — a
+ * missing provider or a transport hiccup degrades to `false` so the
+ * login flow is never blocked by passkey introspection.
+ */
+async function userHasPasskey(userId, provider) {
+    if (!provider)
+        return false;
+    try {
+        const list = await provider.listPasskeys({ userId });
+        return list.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether the user OPTED IN to their passkey doubling as a mandatory
+ * second factor after a password login. Enrolling a passkey alone only
+ * enables passkey-FIRST sign-in — this flag (default OFF, stored by the
+ * `user-passkeys` provider) is what re-arms the 2FA gate. Never throws:
+ * a missing provider, a provider predating the method, or a transport
+ * hiccup all read as `false` so the preference lookup can never lock a
+ * user out of the password flow.
+ */
+async function passkeySecondFactorOptedIn(userId, provider) {
+    if (!provider || typeof provider.getSecondFactorPreference !== 'function')
+        return false;
+    try {
+        const pref = await provider.getSecondFactorPreference({ userId });
+        return pref.enabled;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/auth/second-factors.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecondFactorSchema = void 0;
+exports.collectSecondFactors = collectSecondFactors;
+const zod_1 = require("zod");
+const passkey_provider_js_1 = require("./passkey-provider.js");
+exports.SecondFactorSchema = zod_1.z.enum(['totp', 'passkey']);
+async function collectSecondFactors(deps, userId, primary) {
+    const totpStatus = deps.getTotpStatus ? await deps.getTotpStatus({ userId }) : { enabled: false };
+    const factors = [];
+    if (totpStatus.enabled)
+        factors.push('totp');
+    if (primary !== 'passkey') {
+        const provider = deps.passkeyProvider();
+        const enrolled = await (0, passkey_provider_js_1.userHasPasskey)(userId, provider);
+        if (enrolled && (await (0, passkey_provider_js_1.passkeySecondFactorOptedIn)(userId, provider))) {
+            factors.push('passkey');
+        }
+    }
+    return factors;
+}

package/dist/auth/session-mint.js

@@ -52,13 +52,5 @@ function createSessionMinter(deps) {
         findUserOrNull,
         mintForRecord,
         mintForUserId: async (userId) => mintForRecord(await findUser(userId)),
-        mintForFederatedIdentity: (identity) => mintForRecord({
-            id: identity.userId,
-            username: identity.username,
-            isAdmin: identity.isAdmin,
-            allowedProviders: '*',
-            allowedDevices: {},
-            scopes: [],
-        }),
     };
 }

package/dist/auth/sso-finish-deps.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionUserIdFromCookie = sessionUserIdFromCookie;
+exports.createSsoFinishDeps = createSsoFinishDeps;
+const auth_provider_gate_js_1 = require("./auth-provider-gate.js");
+const passkey_provider_js_1 = require("./passkey-provider.js");
+const second_factors_js_1 = require("./second-factors.js");
+const session_cookie_js_1 = require("./session-cookie.js");
+/**
+ * The user a REAL session cookie names, or `null`. Same rule as
+ * `auth.exchangeSession`: a bridge or challenge token verifies under the same
+ * secret but carries a `kind`, and a session always has a boolean `isAdmin`
+ * and a string `userId`.
+ */
+function sessionUserIdFromCookie(auth, cookieHeader) {
+    const token = (0, session_cookie_js_1.readSessionCookieFromHeader)(cookieHeader);
+    if (token === null)
+        return null;
+    try {
+        const payload = auth.verifyToken(token);
+        if (Reflect.get(payload, 'kind') !== undefined)
+            return null;
+        if (typeof payload.isAdmin !== 'boolean' || typeof payload.userId !== 'string')
+            return null;
+        return payload.userId;
+    }
+    catch {
+        return null;
+    }
+}
+function createSsoFinishDeps(wiring, cookieHeader) {
+    const { auth, registry, moleculer } = wiring;
+    const userManagement = () => {
+        const um = registry.getSingleton('user-management');
+        if (!um)
+            throw new Error('Login unavailable — `user-management` capability not registered');
+        return um;
+    };
+    return {
+        verifyBridge: (token) => auth.verifySsoBridgeToken(token),
+        minter: wiring.minter,
+        isProviderDisabled: (addonId) => (0, auth_provider_gate_js_1.isAuthAddonDisabled)(registry, addonId),
+        identities: {
+            findUser: async (provider, subject) => userManagement().findUserByExternalIdentity({ provider, subject }),
+            link: async (input) => {
+                const um = userManagement();
+                const holder = await um.findUserByExternalIdentity({
+                    provider: input.provider,
+                    subject: input.subject,
+                });
+                if (holder !== null && holder.userId !== input.userId)
+                    return 'conflict';
+                await um.linkExternalIdentity(input);
+                return 'linked';
+            },
+        },
+        consumeLinkIntent: (handle) => wiring.linkIntents.consume(handle),
+        sessionUserId: () => sessionUserIdFromCookie(auth, cookieHeader),
+        secondFactors: (userId) => {
+            const um = registry.getSingleton('user-management');
+            return (0, second_factors_js_1.collectSecondFactors)({
+                ...(um && typeof um.getTotpStatus === 'function'
+                    ? { getTotpStatus: (input) => um.getTotpStatus(input) }
+                    : {}),
+                passkeyProvider: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer),
+            }, userId, 'sso');
+        },
+        signChallenge: (user) => auth.signTotpChallengeToken(user),
+        ...(wiring.logFailure !== undefined ? { logFailure: wiring.logFailure } : {}),
+    };
+}

package/dist/auth/sso-finish.js

@@ -1,40 +1,175 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OIDC_FEDERATED_USER_PREFIX = exports.OIDC_BRIDGE_PROVIDER_PREFIX = exports.MAGIC_LINK_BRIDGE_PROVIDER = void 0;
+exports.SSO_POPUP_COMPLETE_PATH = exports.SSO_LOGIN_PATH = exports.SSO_PROFILE_PATH = exports.OIDC_IDENTITY_PREFIX = exports.OIDC_BRIDGE_PROVIDER_PREFIX = exports.MAGIC_LINK_BRIDGE_PROVIDER = void 0;
+exports.popupCompletionLocation = popupCompletionLocation;
 exports.isLoginBridge = isLoginBridge;
 exports.finishSsoLogin = finishSsoLogin;
+const auth_provider_gate_js_1 = require("./auth-provider-gate.js");
 const session_mint_js_1 = require("./session-mint.js");
 /** The magic-link addon's bridge `provider`. */
 exports.MAGIC_LINK_BRIDGE_PROVIDER = 'auth-magic-link';
-/** `auth-oidc` signs `auth-oidc/<instance>`. */
+/**
+ * `auth-oidc` signs `auth-oidc/<instance>`.
+ *
+ * Here the prefix is the READING of a bridge, not the choice of what is
+ * linkable (that is the `linkable` flag on a login method, which gates the
+ * intent a link needs). It stays because it is load-bearing: it is the
+ * allowlist that keeps the `oauth-*` tokens of the same signer from being
+ * swapped for a session, and it tells an identity-named bridge
+ * (`oidc:<instance>:<sub>`, linked users only) from a magic-link bridge that
+ * names a user record. A bridge with any other provider is refused, so a
+ * non-OIDC linkable provider fails closed until it has its own bridge format.
+ */
 exports.OIDC_BRIDGE_PROVIDER_PREFIX = 'auth-oidc/';
-/** `auth-oidc` names a federated identity `oidc:<instance>:<sub>`. */
-exports.OIDC_FEDERATED_USER_PREFIX = 'oidc:';
-function isOidcBridge(claims) {
-    return (claims.provider.startsWith(exports.OIDC_BRIDGE_PROVIDER_PREFIX) &&
-        claims.userId.startsWith(exports.OIDC_FEDERATED_USER_PREFIX));
+/** `auth-oidc` names an identity `oidc:<instance>:<sub>`. */
+exports.OIDC_IDENTITY_PREFIX = 'oidc:';
+/**
+ * Where a completed (or refused) link lands — the signed-in user's profile —
+ * and where a login returns. Admin-ui routes, relative to its mount: the
+ * route in `main.ts` prepends the hub's mount prefix. (These read `/admin/…`
+ * once, a path admin-ui has no route for, so both returns drew a blank page.)
+ */
+exports.SSO_PROFILE_PATH = '/system/my-access';
+exports.SSO_LOGIN_PATH = '/login';
+const PROFILE_PATH = exports.SSO_PROFILE_PATH;
+const LOGIN_PATH = exports.SSO_LOGIN_PATH;
+/**
+ * The admin-ui page a POPUP sign-in lands on (D791): it hands the outcome to
+ * the window that opened it and closes, or — opener gone — continues to the
+ * page the outcome names, like a full-page return.
+ */
+exports.SSO_POPUP_COMPLETE_PATH = '/sso-complete';
+/**
+ * The popup form of a return `location`: the completion page, with what the
+ * page return carried — the login FRAGMENT (session / challenge / error) or
+ * the profile QUERY (link outcome) — moved into the completion page's
+ * fragment, after `return=login|profile`. Fragment only: a session still
+ * never reaches a server log, and the completion page never posts it to
+ * another origin.
+ */
+function popupCompletionLocation(location) {
+    const hashAt = location.indexOf('#');
+    const pathAndQuery = hashAt === -1 ? location : location.slice(0, hashAt);
+    const fragment = hashAt === -1 ? '' : location.slice(hashAt + 1);
+    const queryAt = pathAndQuery.indexOf('?');
+    const path = queryAt === -1 ? pathAndQuery : pathAndQuery.slice(0, queryAt);
+    const query = queryAt === -1 ? '' : pathAndQuery.slice(queryAt + 1);
+    const target = path === exports.SSO_PROFILE_PATH ? 'profile' : 'login';
+    const carried = [query, fragment].filter((part) => part.length > 0).join('&');
+    return `${exports.SSO_POPUP_COMPLETE_PATH}#return=${target}${carried.length > 0 ? `&${carried}` : ''}`;
+}
+/**
+ * `(provider, subject, issuer)` of an OIDC bridge, or `null` when it is not a
+ * well-formed one. A subject is unique only per issuer, so a bridge without
+ * the verified `iss` names no identity.
+ */
+function oidcIdentityOf(claims) {
+    if (!claims.provider.startsWith(exports.OIDC_BRIDGE_PROVIDER_PREFIX))
+        return null;
+    if (claims.issuer === undefined || claims.issuer.length === 0)
+        return null;
+    const instance = claims.provider.slice(exports.OIDC_BRIDGE_PROVIDER_PREFIX.length);
+    if (instance.length === 0)
+        return null;
+    const prefix = `${exports.OIDC_IDENTITY_PREFIX}${instance}:`;
+    if (!claims.userId.startsWith(prefix))
+        return null;
+    const subject = claims.userId.slice(prefix.length);
+    return subject.length === 0 ? null : { provider: claims.provider, subject, issuer: claims.issuer };
 }
 /** Whether `claims` is a LOGIN bridge — the only kind this endpoint swaps. */
 function isLoginBridge(claims) {
-    return claims.provider === exports.MAGIC_LINK_BRIDGE_PROVIDER || isOidcBridge(claims);
-}
-/** A record wins; only an OIDC identity may stand without one. */
-async function mintForBridge(claims, minter) {
-    const record = await minter.findUserOrNull(claims.userId);
-    if (record !== null)
-        return minter.mintForRecord(record);
-    if (!isOidcBridge(claims))
-        throw new session_mint_js_1.SessionUserGoneError(claims.userId);
-    return minter.mintForFederatedIdentity({
-        userId: claims.userId,
-        username: claims.username,
-        isAdmin: claims.isAdmin,
-    });
+    return (claims.provider === exports.MAGIC_LINK_BRIDGE_PROVIDER ||
+        claims.provider.startsWith(exports.OIDC_BRIDGE_PROVIDER_PREFIX));
 }
 function unauthorized(error) {
     return { kind: 'error', status: 401, body: { error } };
 }
-async function finishSsoLogin(bridge, deps) {
+function redirect(location) {
+    return { kind: 'redirect', location };
+}
+function linkRefused(reason) {
+    return redirect(`${PROFILE_PATH}?linkError=${reason}`);
+}
+function failed(error, deps) {
+    if (error instanceof session_mint_js_1.SessionUserGoneError)
+        return unauthorized('User no longer exists');
+    // The detail stays in the server log: a store error can name user ids.
+    deps.logFailure?.(error);
+    return { kind: 'error', status: 500, body: { error: 'SSO finish failed' } };
+}
+/** A session for `record` — or the second-factor challenge it still owes. */
+async function signIn(record, provider, deps) {
+    const factors = await deps.secondFactors(record.id);
+    if (factors.length > 0) {
+        const challenge = deps.signChallenge({
+            userId: record.id,
+            username: record.username,
+            isAdmin: record.isAdmin,
+        });
+        // The challenge rides the URL FRAGMENT, like the session token below: it
+        // never reaches a server log. The login page resumes at the factor step.
+        const fragment = new URLSearchParams({
+            challenge,
+            factors: factors.join(','),
+            provider,
+        });
+        return redirect(`${LOGIN_PATH}#${fragment.toString()}`);
+    }
+    const session = deps.minter.mintForRecord(record);
+    return redirect(`${LOGIN_PATH}#token=${encodeURIComponent(session.token)}&provider=${encodeURIComponent(provider)}`);
+}
+async function completeLink(claims, handle, deps) {
+    const identity = oidcIdentityOf(claims);
+    if (identity === null) {
+        return { kind: 'error', status: 400, body: { error: 'Only an OIDC sign-in can be linked' } };
+    }
+    const intent = deps.consumeLinkIntent(handle);
+    if (intent === null)
+        return linkRefused('expired');
+    if (intent.provider !== identity.provider)
+        return linkRefused('provider');
+    // Bound to the session that asked: the browser finishing the IdP round trip
+    // must be signed in as the user the intent was minted for. Without this a
+    // link started in one account could be completed with someone else's IdP
+    // login (or vice versa) and plant an identity on the wrong user.
+    if (deps.sessionUserId() !== intent.userId)
+        return linkRefused('session');
+    const result = await deps.identities.link({
+        userId: intent.userId,
+        provider: identity.provider,
+        subject: identity.subject,
+        issuer: identity.issuer,
+        label: claims.email ?? claims.username,
+    });
+    if (result === 'conflict')
+        return linkRefused('conflict');
+    return redirect(`${PROFILE_PATH}?linked=${encodeURIComponent(identity.provider)}`);
+}
+async function completeLogin(claims, deps) {
+    if (claims.provider === exports.MAGIC_LINK_BRIDGE_PROVIDER) {
+        if (claims.userId.startsWith(exports.OIDC_IDENTITY_PREFIX))
+            return unauthorized('Not a user record');
+        return signIn(await deps.minter.findUser(claims.userId), claims.provider, deps);
+    }
+    const identity = oidcIdentityOf(claims);
+    if (identity === null)
+        return unauthorized('Malformed OIDC identity');
+    const link = await deps.identities.findUser(identity.provider, identity.subject);
+    // A link made under another issuer is not this identity: the instance was
+    // repointed at a different IdP, where the same `sub` names someone else.
+    if (link === null || link.issuer !== identity.issuer) {
+        return redirect(`${LOGIN_PATH}#error=sso-not-linked&provider=${encodeURIComponent(identity.provider)}`);
+    }
+    return signIn(await deps.minter.findUser(link.userId), claims.provider, deps);
+}
+async function finishSsoLogin(bridge, deps, options = {}) {
+    const outcome = await finishSsoReturn(bridge, deps);
+    if (options.popup !== true || outcome.kind !== 'redirect')
+        return outcome;
+    return redirect(popupCompletionLocation(outcome.location));
+}
+async function finishSsoReturn(bridge, deps) {
     if (!bridge)
         return { kind: 'error', status: 400, body: { error: 'Missing bridge token' } };
     const claims = deps.verifyBridge(bridge);
@@ -42,25 +177,15 @@ async function finishSsoLogin(bridge, deps) {
         return unauthorized('Invalid or expired bridge token');
     if (!isLoginBridge(claims))
         return unauthorized('Not a login bridge token');
+    if (deps.isProviderDisabled((0, auth_provider_gate_js_1.bridgeProviderAddonId)(claims.provider))) {
+        return unauthorized('Login provider is disabled');
+    }
     try {
-        const session = await mintForBridge(claims, deps.minter);
-        // The token rides in the URL FRAGMENT: it never reaches a server log and
-        // is not resent on later requests; the SPA's auth-context reads it on mount.
-        return {
-            kind: 'redirect',
-            location: `/admin/login#token=${encodeURIComponent(session.token)}&provider=${encodeURIComponent(claims.provider)}`,
-        };
+        return claims.linkIntent !== undefined
+            ? await completeLink(claims, claims.linkIntent, deps)
+            : await completeLogin(claims, deps);
     }
     catch (error) {
-        if (error instanceof session_mint_js_1.SessionUserGoneError)
-            return unauthorized('User no longer exists');
-        return {
-            kind: 'error',
-            status: 500,
-            body: {
-                error: 'SSO finish failed',
-                message: error instanceof Error ? error.message : String(error),
-            },
-        };
+        return failed(error, deps);
     }
 }

package/dist/boot/platform-keychain-key.js

@@ -0,0 +1,94 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keychainKeyFdFromArgv = keychainKeyFdFromArgv;
+exports.loadPlatformKeychainKey = loadPlatformKeychainKey;
+/**
+ * Read the keychain master key a DESKTOP app handed this hub over an inherited
+ * pipe (D788): `--keychain-key-fd=<n>` names the descriptor, the parent wrote
+ * the key (base64) and closed it. Read once, at boot, before anything else
+ * can — then the descriptor is closed and the key lives only in memory, in
+ * the platform-key slot the keychain builtin reads.
+ *
+ * An env var was rejected: a child's environment is readable by every process
+ * of the same user and is inherited by every addon runner the hub forks.
+ */
+const fs = __importStar(require("node:fs"));
+const system_1 = require("@camstack/system");
+const FD_ARG = '--keychain-key-fd=';
+const KEY_BYTES = 32;
+/** The OS keychain's name, for the Secrets page. */
+function platformLabel(platform) {
+    switch (platform) {
+        case 'darwin':
+            return 'macOS Keychain';
+        case 'win32':
+            return 'Windows DPAPI';
+        default:
+            return 'OS secret service';
+    }
+}
+/** Parse the descriptor number out of argv; `null` when not passed. */
+function keychainKeyFdFromArgv(argv) {
+    const arg = argv.find((a) => a.startsWith(FD_ARG));
+    if (arg === undefined)
+        return null;
+    const n = Number(arg.slice(FD_ARG.length));
+    return Number.isInteger(n) && n > 2 ? n : null;
+}
+function loadPlatformKeychainKey(argv = process.argv, readFd = (fd) => fs.readFileSync(fd, 'utf8'), closeFd = (fd) => fs.closeSync(fd)) {
+    const fd = keychainKeyFdFromArgv(argv);
+    if (fd === null)
+        return { kind: 'none' };
+    try {
+        const key = Buffer.from(readFd(fd).trim(), 'base64');
+        if (key.length !== KEY_BYTES)
+            return { kind: 'failed', error: 'not 32 bytes of key material' };
+        const label = platformLabel(process.platform);
+        (0, system_1.setPlatformKeychainKey)({ label, key });
+        return { kind: 'loaded', label };
+    }
+    catch (err) {
+        return { kind: 'failed', error: err instanceof Error ? err.message : String(err) };
+    }
+    finally {
+        try {
+            closeFd(fd);
+        }
+        catch {
+            /* already closed */
+        }
+    }
+}