@edynamix/mf-isolation 0.0.36 → 0.0.37

package/dist/vite-development.js

@@ -3,6 +3,7 @@ import { Readable } from 'node:stream';
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 const SESSION_COOKIE = '__Host-edyn_dev_session';
 const REFRESH_COOKIE = '__Host-edyn_dev_refresh';
+const MODULE_REFRESH_COOKIE = '__Host-edyn_dev_module_refresh';
 const FLOW_COOKIE = '__Host-edyn_oidc_flow';
 const LOGOUT_COOKIE = '__Host-edyn_oidc_logout';
 const CALLBACK_PATH = '/callback';
@@ -20,6 +21,7 @@ const REFRESH_COOKIE_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
 const FLOW_MAX_AGE_SECONDS = 10 * 60;
 const TOKEN_REFRESH_SKEW_MS = 30_000;
 const SPENT_REFRESH_TOKEN_REUSE_MS = 30_000;
+const DEFAULT_MODULE_SIGN_IN_SCOPE = 'openid profile email offline_access';
 const NAVIGATION_GROUP_HEADER = 'X-Edyn-Navigation-Group-Id';
 const NAVIGATION_DEALER_HEADER = 'X-Edyn-Navigation-Dealer-Id';
 const NAVIGATION_DEALERS_HEADER = 'X-Edyn-Navigation-Dealer-Ids';
@@ -82,6 +84,87 @@ const moduleApiPrefix = (candidate) => {
     }
     return candidate;
 };
+// Read from the module's client/.env (MODULE_SSO_ISSUER, MODULE_SSO_CLIENT_ID): there is no default, because a wrong
+// guess only shows later as the module server refusing every call.
+const moduleSignInConfiguration = (options) => {
+    if (!isRecord(options)) {
+        throw new Error('moduleSignIn is required: the issuer and client id the module server accepts (MODULE_SSO_ISSUER, MODULE_SSO_CLIENT_ID).');
+    }
+    const { clientId, issuer, scope } = options;
+    if (typeof issuer !== 'string' || issuer.trim() === '') {
+        throw new Error('moduleSignIn.issuer is required (MODULE_SSO_ISSUER).');
+    }
+    const issuerUrl = absoluteHttpsUrl(issuer.trim(), 'moduleSignIn.issuer', true);
+    if (issuerUrl.search) {
+        throw new Error('moduleSignIn.issuer must not contain a query.');
+    }
+    if (typeof clientId !== 'string' || clientId.trim() === '') {
+        throw new Error('moduleSignIn.clientId is required (MODULE_SSO_CLIENT_ID).');
+    }
+    if (scope !== undefined && (typeof scope !== 'string' || scope.trim() === '')) {
+        throw new Error('moduleSignIn.scope must be a non-empty string when it is set.');
+    }
+    return { clientId: clientId.trim(), issuer: issuerUrl.href.replace(/\/$/, ''), scope: scope?.trim() ?? DEFAULT_MODULE_SIGN_IN_SCOPE };
+};
+// One sign-in service and client: its configuration and discovery, each loaded once and loaded again after a failure.
+class OidcClient {
+    #label;
+    #load;
+    #configurationPromise = null;
+    #discoveryPromise = null;
+    constructor(label, load) {
+        this.#label = label;
+        this.#load = load;
+    }
+    configuration() {
+        this.#configurationPromise ??= this.#load().catch((error) => {
+            this.#configurationPromise = null;
+            throw error;
+        });
+        return this.#configurationPromise;
+    }
+    discovery() {
+        this.#discoveryPromise ??= this.configuration()
+            .then(async (configuration) => {
+            const response = await fetch(`${configuration.issuer}/.well-known/openid-configuration`, {
+                headers: { Accept: 'application/json' },
+                redirect: 'error',
+            });
+            if (!response.ok) {
+                throw new Error(`OIDC discovery failed (${response.status}).`);
+            }
+            const value = await response.json();
+            if (!isRecord(value)) {
+                throw new Error('OIDC discovery returned an invalid response.');
+            }
+            const issuer = absoluteHttpsUrl(requiredString(value, 'issuer'), 'OIDC discovery issuer', true).href.replace(/\/$/, '');
+            if (issuer !== configuration.issuer) {
+                throw new Error(`OIDC discovery issuer does not match the ${this.#label} configuration.`);
+            }
+            const endpoint = (key) => {
+                const url = absoluteHttpsUrl(requiredString(value, key), `OIDC ${key}`, true);
+                if (url.origin !== new URL(issuer).origin) {
+                    throw new Error(`OIDC ${key} must use the configured issuer origin.`);
+                }
+                return url.href;
+            };
+            const revocation = optionalString(value, 'revocation_endpoint');
+            return {
+                authorizationEndpoint: endpoint('authorization_endpoint'),
+                endSessionEndpoint: endpoint('end_session_endpoint'),
+                issuer,
+                jwksUri: endpoint('jwks_uri'),
+                revocationEndpoint: revocation ? endpoint('revocation_endpoint') : null,
+                tokenEndpoint: endpoint('token_endpoint'),
+            };
+        })
+            .catch((error) => {
+            this.#discoveryPromise = null;
+            throw error;
+        });
+        return this.#discoveryPromise;
+    }
+}
 const base64Url = (size = 32) => randomBytes(size).toString('base64url');
 const codeChallengeOf = (verifier) => createHash('sha256').update(verifier).digest('base64url');
 const cookiesOf = (request) => {
@@ -103,9 +186,25 @@ const cookie = (name, value, maxAge) => `${name}=${value}; Path=/; HttpOnly; Sec
 const clearCookie = (name) => cookie(name, '', 0);
 // The refresh token stays in an HttpOnly cookie for this origin, which every module's development server shares, so
 // one sign-in survives restarts and module switches until the token expires; page scripts can never read it.
-const refreshCookieOf = (session) => session.refreshToken
-    ? cookie(REFRESH_COOKIE, encodeURIComponent(session.refreshToken), REFRESH_COOKIE_MAX_AGE_SECONDS)
-    : clearCookie(REFRESH_COOKIE);
+const refreshCookieOf = (name, tokens) => tokens.refreshToken ? cookie(name, encodeURIComponent(tokens.refreshToken), REFRESH_COOKIE_MAX_AGE_SECONDS) : clearCookie(name);
+// The host's refresh token keeps its original cookie, so developers signed in before the module had its own sign-in
+// stay signed in to the host.
+const refreshCookiesOf = (session) => [
+    refreshCookieOf(REFRESH_COOKIE, session.host),
+    ...(session.module ? [refreshCookieOf(MODULE_REFRESH_COOKIE, session.module)] : []),
+];
+const tokenSetsOf = (session) => [
+    ['host', REFRESH_COOKIE, session.host],
+    ...(session.module ? [['module', MODULE_REFRESH_COOKIE, session.module]] : []),
+];
+const newSession = (host, module) => ({
+    host,
+    module,
+    moduleBootstrapTail: Promise.resolve(),
+    moduleCookies: new Map(),
+    moduleNavigationContext: null,
+});
+const refreshableTokens = (refreshToken) => ({ accessToken: '', expiresAt: 0, idToken: null, refreshToken });
 const decodedCookieValue = (value) => {
     if (!value) {
         return null;
@@ -359,9 +458,9 @@ const readResponseBody = async (response, maximumBytes, label) => {
     return Buffer.concat(chunks, totalBytes);
 };
 class MfDevelopmentBff {
-    #configurationUrl;
     #developmentOrigin;
     #flows = new Map();
+    #hostClient;
     #hostOrigin;
     #hostNavigationUrl;
     #jwks = new Map();
@@ -369,15 +468,28 @@ class MfDevelopmentBff {
     #moduleApiOrigin;
     #moduleApiPath;
     #moduleApiUnreachable = false;
+    #moduleClient;
     #sessions = new Map();
     #restores = new Map();
-    #configurationPromise = null;
-    #discoveryPromise = null;
     constructor(options) {
         const hostNavigation = absoluteHttpsUrl(options.hostNavigationUrl, 'hostNavigationUrl', true);
         this.#hostNavigationUrl = hostNavigation;
         this.#hostOrigin = new URL(hostNavigation.origin);
-        this.#configurationUrl = new URL('/api/auth/oidc-configuration', this.#hostOrigin);
+        const configurationUrl = new URL('/api/auth/oidc-configuration', this.#hostOrigin);
+        this.#hostClient = new OidcClient('host', async () => {
+            const response = await fetch(configurationUrl, { headers: { Accept: 'application/json' }, redirect: 'error' });
+            if (!response.ok) {
+                throw new Error(`Host OIDC configuration failed (${response.status}).`);
+            }
+            const value = await response.json();
+            if (!isRecord(value)) {
+                throw new Error('Host OIDC configuration returned an invalid response.');
+            }
+            const issuer = absoluteHttpsUrl(requiredString(value, 'issuer'), 'OIDC issuer', true).href.replace(/\/$/, '');
+            return { clientId: requiredString(value, 'clientId'), issuer, scope: requiredString(value, 'scope') };
+        });
+        const moduleConfiguration = moduleSignInConfiguration(options.moduleSignIn);
+        this.#moduleClient = new OidcClient('module sign-in', async () => moduleConfiguration);
         this.#developmentOrigin = absoluteHttpsUrl(options.developmentOrigin ?? 'https://localhost:4200', 'developmentOrigin');
         if (this.#developmentOrigin.pathname !== '/' || this.#developmentOrigin.search || this.#developmentOrigin.hash) {
             throw new Error('developmentOrigin must be an origin without a path, query, or fragment.');
@@ -388,6 +500,14 @@ class MfDevelopmentBff {
         }
         this.#moduleApiPath = moduleApiPrefix(options.moduleApiPath);
     }
+    #clientOf(step) {
+        return step === 'host' ? this.#hostClient : this.#moduleClient;
+    }
+    // A module whose server accepts the host's issuer and client needs no second sign-in.
+    async #moduleSignsInSeparately() {
+        const [host, module] = await Promise.all([this.#hostClient.configuration(), this.#moduleClient.configuration()]);
+        return host.issuer !== module.issuer || host.clientId !== module.clientId;
+    }
     async handle(request, response, next) {
         if (!request.url || !request.method) {
             next();
@@ -417,8 +537,9 @@ class MfDevelopmentBff {
                 return;
             }
             if (request.method === 'GET' && url.pathname === LOGGED_OUT_PATH) {
+                // The sign-in page signs out of the next sign-in service first while the logout cookie names one.
                 const returnTo = safeReturnTo(url.searchParams.get('state'));
-                redirect(response, `${LOGIN_PATH}?returnTo=${encodeURIComponent(returnTo)}`, [clearCookie(LOGOUT_COOKIE)]);
+                redirect(response, `${LOGIN_PATH}?returnTo=${encodeURIComponent(returnTo)}`);
                 return;
             }
             if (request.method === 'GET' && url.pathname === '/frontchannel-logout') {
@@ -427,7 +548,7 @@ class MfDevelopmentBff {
                     this.#sessions.delete(sessionId);
                 }
                 response.statusCode = 204;
-                response.setHeader('Set-Cookie', [clearCookie(SESSION_COOKIE), clearCookie(REFRESH_COOKIE)]);
+                response.setHeader('Set-Cookie', [clearCookie(SESSION_COOKIE), clearCookie(REFRESH_COOKIE), clearCookie(MODULE_REFRESH_COOKIE)]);
                 response.end();
                 return;
             }
@@ -467,88 +588,51 @@ class MfDevelopmentBff {
         response.setHeader('X-Content-Type-Options', 'nosniff');
         response.end(body);
     }
-    async #configuration() {
-        this.#configurationPromise ??= fetch(this.#configurationUrl, { headers: { Accept: 'application/json' }, redirect: 'error' })
-            .then(async (response) => {
-            if (!response.ok) {
-                throw new Error(`Host OIDC configuration failed (${response.status}).`);
-            }
-            const value = await response.json();
-            if (!isRecord(value)) {
-                throw new Error('Host OIDC configuration returned an invalid response.');
-            }
-            const issuer = absoluteHttpsUrl(requiredString(value, 'issuer'), 'OIDC issuer', true).href.replace(/\/$/, '');
-            return { clientId: requiredString(value, 'clientId'), issuer, scope: requiredString(value, 'scope') };
-        })
-            .catch((error) => {
-            this.#configurationPromise = null;
-            throw error;
-        });
-        return this.#configurationPromise;
-    }
-    async #discovery() {
-        this.#discoveryPromise ??= this.#configuration()
-            .then(async (configuration) => {
-            const response = await fetch(`${configuration.issuer}/.well-known/openid-configuration`, {
-                headers: { Accept: 'application/json' },
-                redirect: 'error',
-            });
-            if (!response.ok) {
-                throw new Error(`OIDC discovery failed (${response.status}).`);
-            }
-            const value = await response.json();
-            if (!isRecord(value)) {
-                throw new Error('OIDC discovery returned an invalid response.');
-            }
-            const issuer = absoluteHttpsUrl(requiredString(value, 'issuer'), 'OIDC discovery issuer', true).href.replace(/\/$/, '');
-            if (issuer !== configuration.issuer) {
-                throw new Error('OIDC discovery issuer does not match the host configuration.');
-            }
-            const endpoint = (key) => {
-                const url = absoluteHttpsUrl(requiredString(value, key), `OIDC ${key}`, true);
-                if (url.origin !== new URL(issuer).origin) {
-                    throw new Error(`OIDC ${key} must use the configured issuer origin.`);
-                }
-                return url.href;
-            };
-            const revocation = optionalString(value, 'revocation_endpoint');
-            return {
-                authorizationEndpoint: endpoint('authorization_endpoint'),
-                endSessionEndpoint: endpoint('end_session_endpoint'),
-                issuer,
-                jwksUri: endpoint('jwks_uri'),
-                revocationEndpoint: revocation ? endpoint('revocation_endpoint') : null,
-                tokenEndpoint: endpoint('token_endpoint'),
-            };
-        })
-            .catch((error) => {
-            this.#discoveryPromise = null;
-            throw error;
-        });
-        return this.#discoveryPromise;
-    }
     async #login(request, response, returnTo) {
         const logoutId = cookiesOf(request).get(LOGOUT_COOKIE);
         if (logoutId) {
+            // Signing out ends the session at each sign-in service in turn: each one returns to /logged-out, which comes back
+            // here, until none is left and the logout cookie goes.
             const logout = this.#logoutFlows.get(logoutId);
-            this.#logoutFlows.delete(logoutId);
-            if (logout) {
-                const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);
+            const next = logout?.pending.shift();
+            if (logout && next) {
+                const last = logout.pending.length === 0;
+                if (last) {
+                    this.#logoutFlows.delete(logoutId);
+                }
+                const client = this.#clientOf(next.step);
+                const [configuration, discovery] = await Promise.all([client.configuration(), client.discovery()]);
                 const endpoint = new URL(discovery.endSessionEndpoint);
                 endpoint.searchParams.set('client_id', configuration.clientId);
                 endpoint.searchParams.set('post_logout_redirect_uri', new URL(LOGGED_OUT_PATH, this.#developmentOrigin).href);
                 endpoint.searchParams.set('state', returnTo);
-                if (logout.idToken) {
-                    endpoint.searchParams.set('id_token_hint', logout.idToken);
+                if (next.idToken) {
+                    endpoint.searchParams.set('id_token_hint', next.idToken);
                 }
-                redirect(response, endpoint.href, [clearCookie(LOGOUT_COOKIE)]);
+                redirect(response, endpoint.href, last ? [clearCookie(LOGOUT_COOKIE)] : []);
                 return;
             }
+            this.#logoutFlows.delete(logoutId);
+            await this.#startSignIn(response, 'host', returnTo, null, [clearCookie(LOGOUT_COOKIE)]);
+            return;
         }
-        const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);
+        await this.#startSignIn(response, 'host', returnTo, null);
+    }
+    // The state names the step, so a callback can only finish the sign-in it was sent for.
+    async #startSignIn(response, step, returnTo, hostTokens, extraCookies = []) {
+        const client = this.#clientOf(step);
+        const [configuration, discovery] = await Promise.all([client.configuration(), client.discovery()]);
         const flowId = base64Url();
         const codeVerifier = base64Url(48);
-        const flow = { codeVerifier, createdAt: Date.now(), nonce: base64Url(), returnTo, state: base64Url() };
+        const flow = {
+            codeVerifier,
+            createdAt: Date.now(),
+            hostTokens,
+            nonce: base64Url(),
+            returnTo,
+            state: `${step}.${base64Url()}`,
+            step,
+        };
         this.#flows.set(flowId, flow);
         const endpoint = new URL(discovery.authorizationEndpoint);
         endpoint.searchParams.set('response_type', 'code');
@@ -559,7 +643,7 @@ class MfDevelopmentBff {
         endpoint.searchParams.set('nonce', flow.nonce);
         endpoint.searchParams.set('code_challenge', codeChallengeOf(codeVerifier));
         endpoint.searchParams.set('code_challenge_method', 'S256');
-        redirect(response, endpoint.href, [cookie(FLOW_COOKIE, flowId, FLOW_MAX_AGE_SECONDS)]);
+        redirect(response, endpoint.href, [cookie(FLOW_COOKIE, flowId, FLOW_MAX_AGE_SECONDS), ...extraCookies]);
     }
     async #callback(request, response, url) {
         const flowId = cookiesOf(request).get(FLOW_COOKIE);
@@ -581,7 +665,28 @@ class MfDevelopmentBff {
             writeJson(response, 400, { code: 'missing_authorization_code', error: 'The OIDC callback did not include an authorization code.' });
             return;
         }
-        const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);
+        const tokens = await this.#exchange(flow, code);
+        if (flow.step === 'host' && (await this.#moduleSignsInSeparately())) {
+            // The host's tokens wait in the module step's flow until the module's sign-in service signs the developer in too.
+            await this.#startSignIn(response, 'module', flow.returnTo, tokens);
+            return;
+        }
+        const hostTokens = flow.step === 'host' ? tokens : flow.hostTokens;
+        if (!hostTokens) {
+            throw new Error('The module sign-in has no host sign-in to complete.');
+        }
+        const session = newSession(hostTokens, flow.step === 'module' ? tokens : null);
+        const sessionId = base64Url();
+        this.#sessions.set(sessionId, session);
+        redirect(response, flow.returnTo, [
+            cookie(SESSION_COOKIE, sessionId, SESSION_MAX_AGE_SECONDS),
+            ...refreshCookiesOf(session),
+            clearCookie(FLOW_COOKIE),
+        ]);
+    }
+    async #exchange(flow, code) {
+        const client = this.#clientOf(flow.step);
+        const [configuration, discovery] = await Promise.all([client.configuration(), client.discovery()]);
         const fields = new URLSearchParams({
             client_id: configuration.clientId,
             code,
@@ -613,22 +718,12 @@ class MfDevelopmentBff {
         if (verified.payload.nonce !== flow.nonce) {
             throw new Error('OIDC ID token nonce does not match the authorization request.');
         }
-        const sessionId = base64Url();
-        const session = {
+        return {
             accessToken: tokens.accessToken,
             expiresAt: Date.now() + tokens.expiresIn * 1000,
             idToken,
-            moduleBootstrapTail: Promise.resolve(),
-            moduleCookies: new Map(),
-            moduleNavigationContext: null,
             refreshToken: tokens.refreshToken,
         };
-        this.#sessions.set(sessionId, session);
-        redirect(response, flow.returnTo, [
-            cookie(SESSION_COOKIE, sessionId, SESSION_MAX_AGE_SECONDS),
-            refreshCookieOf(session),
-            clearCookie(FLOW_COOKIE),
-        ]);
     }
     async #logout(request, response) {
         const sessionId = cookiesOf(request).get(SESSION_COOKIE);
@@ -637,19 +732,27 @@ class MfDevelopmentBff {
             this.#sessions.delete(sessionId);
         }
         if (session) {
-            void this.#revoke(session).catch(() => undefined);
+            for (const [step, , tokens] of tokenSetsOf(session)) {
+                void this.#revoke(step, tokens).catch(() => undefined);
+            }
+        }
+        const pending = [{ idToken: session?.host.idToken ?? null, step: 'host' }];
+        if (await this.#moduleSignsInSeparately().catch(() => false)) {
+            pending.push({ idToken: session?.module?.idToken ?? null, step: 'module' });
         }
         const logoutId = base64Url();
-        this.#logoutFlows.set(logoutId, { createdAt: Date.now(), idToken: session?.idToken ?? null });
+        this.#logoutFlows.set(logoutId, { createdAt: Date.now(), pending });
         response.setHeader('Set-Cookie', [
             clearCookie(SESSION_COOKIE),
             clearCookie(REFRESH_COOKIE),
+            clearCookie(MODULE_REFRESH_COOKIE),
             cookie(LOGOUT_COOKIE, logoutId, FLOW_MAX_AGE_SECONDS),
         ]);
         writeJson(response, 200, { loggedOut: true });
     }
-    async #revoke(session) {
-        const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);
+    async #revoke(step, tokens) {
+        const client = this.#clientOf(step);
+        const [configuration, discovery] = await Promise.all([client.configuration(), client.discovery()]);
         const revocationEndpoint = discovery.revocationEndpoint;
         if (!revocationEndpoint) {
             return;
@@ -663,8 +766,8 @@ class MfDevelopmentBff {
             });
         };
         await Promise.all([
-            revoke(session.accessToken, 'access_token'),
-            session.refreshToken ? revoke(session.refreshToken, 'refresh_token') : Promise.resolve(),
+            revoke(tokens.accessToken, 'access_token'),
+            tokens.refreshToken ? revoke(tokens.refreshToken, 'refresh_token') : Promise.resolve(),
         ]);
     }
     // Standalone modules send the browser to their legacy /login page when an API call answers 401, and locally no such
@@ -686,78 +789,83 @@ class MfDevelopmentBff {
             `<p><a href="${LOGIN_PATH}?returnTo=%2F">Sign in again</a> &middot; <a href="/">Back to the module</a></p>` +
             '</body></html>');
     }
+    // A session is whole only with every sign-in it needs: when one of them can no longer refresh, the developer signs in
+    // again, which passes through each sign-in service in turn.
     async #authenticatedSession(request, response) {
         const cookies = cookiesOf(request);
         const sessionId = cookies.get(SESSION_COOKIE);
         const session = sessionId ? this.#sessions.get(sessionId) : undefined;
         if (!session) {
-            return this.#restoredSession(decodedCookieValue(cookies.get(REFRESH_COOKIE)), response);
-        }
-        if (session.expiresAt > Date.now() + TOKEN_REFRESH_SKEW_MS) {
-            return session;
+            return this.#restoredSession(decodedCookieValue(cookies.get(REFRESH_COOKIE)), decodedCookieValue(cookies.get(MODULE_REFRESH_COOKIE)), response);
         }
-        if (!session.refreshToken) {
-            if (sessionId) {
-                this.#sessions.delete(sessionId);
+        const refreshedCookies = [];
+        for (const [step, cookieName, tokens] of tokenSetsOf(session)) {
+            if (tokens.expiresAt > Date.now() + TOKEN_REFRESH_SKEW_MS) {
+                continue;
             }
-            return null;
-        }
-        session.refreshPromise ??= this.#refresh(session).finally(() => {
-            session.refreshPromise = undefined;
-        });
-        try {
-            await session.refreshPromise;
-            response.setHeader('Set-Cookie', refreshCookieOf(session));
-            return session;
-        }
-        catch {
-            if (sessionId) {
-                this.#sessions.delete(sessionId);
+            if (!tokens.refreshToken) {
+                if (sessionId) {
+                    this.#sessions.delete(sessionId);
+                }
+                return null;
+            }
+            tokens.refreshPromise ??= this.#refresh(step, tokens).finally(() => {
+                tokens.refreshPromise = undefined;
+            });
+            try {
+                await tokens.refreshPromise;
+                refreshedCookies.push(refreshCookieOf(cookieName, tokens));
+            }
+            catch {
+                if (sessionId) {
+                    this.#sessions.delete(sessionId);
+                }
+                response.setHeader('Set-Cookie', clearCookie(cookieName));
+                return null;
             }
-            response.setHeader('Set-Cookie', clearCookie(REFRESH_COOKIE));
-            return null;
         }
+        if (refreshedCookies.length > 0) {
+            response.setHeader('Set-Cookie', refreshedCookies);
+        }
+        return session;
     }
-    // Starts a session from the browser's refresh cookie after this server restarted or another module's server signed
-    // the developer in. Parallel requests carrying the same token share one refresh, and so, for a short while, do
-    // requests the browser sent before the rotated cookie reached it: the sign-in service accepts a refresh token once,
+    // Starts a session from the browser's refresh cookies after this server restarted or another module's server signed
+    // the developer in. Parallel requests carrying the same tokens share one refresh, and so, for a short while, do
+    // requests the browser sent before the rotated cookies reached it: the sign-in service accepts a refresh token once,
     // so spending it again would fail and clear the cookie that replaced it.
-    async #restoredSession(refreshToken, response) {
-        if (!refreshToken) {
+    async #restoredSession(hostRefreshToken, moduleRefreshToken, response) {
+        if (!hostRefreshToken) {
             return null;
         }
-        let restore = this.#restores.get(refreshToken);
+        const separate = await this.#moduleSignsInSeparately();
+        if (separate && !moduleRefreshToken) {
+            return null;
+        }
+        const restoreKey = separate ? `${hostRefreshToken}\n${moduleRefreshToken}` : hostRefreshToken;
+        let restore = this.#restores.get(restoreKey);
         if (!restore) {
-            restore = this.#restore(refreshToken);
-            this.#restores.set(refreshToken, restore);
+            restore = this.#restore(hostRefreshToken, separate ? moduleRefreshToken : null);
+            this.#restores.set(restoreKey, restore);
             void restore.then((restoredSession) => {
                 if (!restoredSession) {
-                    this.#restores.delete(refreshToken);
+                    this.#restores.delete(restoreKey);
                     return;
                 }
-                setTimeout(() => this.#restores.delete(refreshToken), SPENT_REFRESH_TOKEN_REUSE_MS).unref();
+                setTimeout(() => this.#restores.delete(restoreKey), SPENT_REFRESH_TOKEN_REUSE_MS).unref();
             });
         }
         const restored = await restore;
         if (!restored || this.#sessions.get(restored.sessionId) !== restored.session) {
-            response.setHeader('Set-Cookie', clearCookie(REFRESH_COOKIE));
+            response.setHeader('Set-Cookie', separate ? [clearCookie(REFRESH_COOKIE), clearCookie(MODULE_REFRESH_COOKIE)] : clearCookie(REFRESH_COOKIE));
             return null;
         }
-        response.setHeader('Set-Cookie', [cookie(SESSION_COOKIE, restored.sessionId, SESSION_MAX_AGE_SECONDS), refreshCookieOf(restored.session)]);
+        response.setHeader('Set-Cookie', [cookie(SESSION_COOKIE, restored.sessionId, SESSION_MAX_AGE_SECONDS), ...refreshCookiesOf(restored.session)]);
         return restored.session;
     }
-    async #restore(refreshToken) {
-        const session = {
-            accessToken: '',
-            expiresAt: 0,
-            idToken: null,
-            moduleBootstrapTail: Promise.resolve(),
-            moduleCookies: new Map(),
-            moduleNavigationContext: null,
-            refreshToken,
-        };
+    async #restore(hostRefreshToken, moduleRefreshToken) {
+        const session = newSession(refreshableTokens(hostRefreshToken), moduleRefreshToken ? refreshableTokens(moduleRefreshToken) : null);
         try {
-            await this.#refresh(session);
+            await Promise.all(tokenSetsOf(session).map(([step, , tokens]) => this.#refresh(step, tokens)));
         }
         catch {
             return null;
@@ -766,12 +874,13 @@ class MfDevelopmentBff {
         this.#sessions.set(sessionId, session);
         return { session, sessionId };
     }
-    async #refresh(session) {
-        const refreshToken = session.refreshToken;
+    async #refresh(step, tokenSet) {
+        const refreshToken = tokenSet.refreshToken;
         if (!refreshToken) {
             throw new Error('OIDC refresh token is unavailable.');
         }
-        const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);
+        const client = this.#clientOf(step);
+        const [configuration, discovery] = await Promise.all([client.configuration(), client.discovery()]);
         const response = await fetch(discovery.tokenEndpoint, {
             body: new URLSearchParams({
                 client_id: configuration.clientId,
@@ -786,10 +895,10 @@ class MfDevelopmentBff {
             throw new Error(`OIDC refresh failed (${response.status}).`);
         }
         const tokens = parseTokenResponse(await response.json(), false);
-        session.accessToken = tokens.accessToken;
-        session.expiresAt = Date.now() + tokens.expiresIn * 1000;
-        session.refreshToken = tokens.refreshToken ?? session.refreshToken;
-        session.idToken = tokens.idToken ?? session.idToken;
+        tokenSet.accessToken = tokens.accessToken;
+        tokenSet.expiresAt = Date.now() + tokens.expiresIn * 1000;
+        tokenSet.refreshToken = tokens.refreshToken ?? tokenSet.refreshToken;
+        tokenSet.idToken = tokens.idToken ?? tokenSet.idToken;
     }
     async #proxy(request, response, localUrl) {
         const session = await this.#authenticatedSession(request, response);
@@ -829,7 +938,7 @@ class MfDevelopmentBff {
     }
     async #loadNavigationContext(session) {
         const upstream = await fetch(new URL('/api/navigation', this.#hostOrigin), {
-            headers: { Accept: 'application/json', Authorization: `Bearer ${session.accessToken}` },
+            headers: { Accept: 'application/json', Authorization: `Bearer ${session.host.accessToken}` },
             redirect: 'manual',
         }).catch(() => null);
         if (!upstream?.ok || session.moduleNavigationContext) {
@@ -848,8 +957,10 @@ class MfDevelopmentBff {
             : portalApiPath
                 ? { cookies: new Map(), navigationContext: session.moduleNavigationContext }
                 : undefined;
+        // The module's server accepts the module's sign-in; the host and the portal it serves accept the host's.
+        const accessToken = isModuleApi ? (session.module ?? session.host).accessToken : session.host.accessToken;
         const init = {
-            headers: proxyHeaders(request, session.accessToken, moduleContext),
+            headers: proxyHeaders(request, accessToken, moduleContext),
             method,
             redirect: 'manual',
         };
@@ -918,7 +1029,7 @@ class MfDevelopmentBff {
             }
         }
         for (const [id, session] of this.#sessions) {
-            if (!session.refreshToken && session.expiresAt + TOKEN_REFRESH_SKEW_MS < now) {
+            if (tokenSetsOf(session).some(([, , tokens]) => !tokens.refreshToken && tokens.expiresAt + TOKEN_REFRESH_SKEW_MS < now)) {
                 this.#sessions.delete(id);
             }
         }