@ibgib/space-gib 0.0.7 → 0.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ibgib/space-gib",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "type": "module",
   "description": "ibgib storage and provider service — SaaS at ibgib.space",
   "scripts": {
@@ -12,11 +12,11 @@
     "build:test": "tsc -p tsconfig.test.json"
   },
   "dependencies": {
-    "@ibgib/core-gib": "^0.1.64",
+    "@ibgib/core-gib": "^0.1.65",
     "@ibgib/helper-gib": "^0.0.36",
     "@ibgib/ts-gib": "^0.5.33",
-    "@ibgib/web-gib": "^0.0.50",
-    "@ibgib/node-gib": "^0.0.8"
+    "@ibgib/web-gib": "^0.0.51",
+    "@ibgib/node-gib": "^0.0.9"
   },
   "engines": {
     "node": ">=20.0.0"

package/src/client/AUTO-GENERATED-version.mts

@@ -8,4 +8,4 @@
 /**
  * Version of space-gib, auto-updated by the build process.
  */
-export const AUTO_GENERATED_VERSION = '0.0.7';
+export const AUTO_GENERATED_VERSION = '0.0.8';

package/src/client/api/space-gib-api-bridge.mts

@@ -53,7 +53,12 @@ export class SpaceGibApiBridge {
     /**
      * PUTs an evolved domain keystone and any related ibgibs (e.g. S^Stjp) to the server.
      */
-    public async putEvolveKeystone(domainAddr: string, keystoneIbGib: IbGib_V1, relatedIbGibs: IbGib_V1[] = []): Promise<{ success: boolean; message?: string }> {
+    public async putEvolveKeystone(
+        domainAddr: string,
+        keystoneIbGib: IbGib_V1,
+        relatedIbGibs: IbGib_V1[] = [],
+        revokeTokens?: Record<string, string>
+    ): Promise<{ success: boolean; message?: string }> {
         const lc = `${this.lc}[${this.putEvolveKeystone.name}]`;
         try {
             console.log(`${lc} posting evolved keystone...`);
@@ -65,7 +70,7 @@ export class SpaceGibApiBridge {
                 headers: {
                     'Content-Type': 'application/json',
                 },
-                body: JSON.stringify({ keystoneIbGib, relatedIbGibs }),
+                body: JSON.stringify({ keystoneIbGib, relatedIbGibs, revokeTokens }),
             });
 
             const data = await response.json();

package/src/client/components/keystone-details/keystone-details.css

@@ -433,40 +433,137 @@
     }
 }
 
-.sso-actions {
+/* Grouped Toggle Switch for Identity Providers */
+.sso-toggle-group {
     display: flex;
-    gap: 1rem;
+    gap: 1.5rem;
     margin-top: 1rem;
     flex-wrap: wrap;
 }
 
-.sso-btn {
+.sso-toggle-card {
     flex: 1;
-    min-width: 200px;
-    display: inline-flex;
-    justify-content: center;
+    min-width: 180px;
+    max-width: 240px;
+    height: 180px;
+    background: rgba(255, 255, 255, 0.02);
+    border: 1px solid rgba(255, 255, 255, 0.06);
+    border-radius: var(--radius-md, 8px);
+    display: flex;
+    flex-direction: column;
+    justify-content: space-between;
     align-items: center;
-    gap: 0.5rem;
-    padding: 0.75rem 1.25rem;
+    cursor: pointer;
+    overflow: hidden;
+    position: relative;
+    user-select: none;
+    transition: all 0.25s cubic-bezier(0.4, 0, 0.2, 1);
+}
+
+.sso-toggle-card:hover {
+    background: rgba(255, 255, 255, 0.04);
+    border-color: rgba(255, 255, 255, 0.12);
+    transform: translateY(-2px);
+    box-shadow: 0 8px 24px rgba(0, 0, 0, 0.2);
+}
+
+.sso-toggle-card:focus-visible {
+    outline: 2px solid var(--clr-accent, #50fa7b);
+    outline-offset: 2px;
+}
+
+/* Status Indicator bars: Top (Green/Active) and Bottom (Red/Faded) */
+.toggle-status-indicator {
+    width: 100%;
+    height: 6px;
+    transition: all 0.25s ease-in-out;
+}
+
+.toggle-status-indicator.top {
+    background: transparent;
+}
+
+.toggle-status-indicator.bottom {
+    background: transparent;
+}
+
+/* Middle Content Wrapper */
+.toggle-content {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    gap: 0.6rem;
+    padding: 1rem;
+    text-align: center;
+}
+
+.sso-icon {
+    width: 2.25rem;
+    height: 2.25rem;
+    transition: transform 0.25s cubic-bezier(0.4, 0, 0.2, 1);
+}
+
+.sso-toggle-card:hover .sso-icon {
+    transform: scale(1.1);
+}
+
+.provider-label {
+    font-size: 0.95rem;
     font-weight: 600;
+    color: var(--clr-text-primary, #ffffff);
 }
 
-.sso-btn.google {
-    background: #4285F4;
-    border-color: #4285F4;
-    color: #ffffff;
+.toggle-state-text {
+    font-size: 0.75rem;
+    font-weight: 500;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    color: var(--clr-text-secondary, #8fa08f);
+    transition: color 0.25s ease-in-out;
 }
 
-.sso-btn.google:hover {
-    background: #357ae8;
+/* Linked (Active State) styles */
+.sso-toggle-card.linked {
+    background: rgba(80, 250, 123, 0.02);
+    border-color: rgba(80, 250, 123, 0.2);
+    box-shadow: 0 4px 16px rgba(80, 250, 123, 0.04);
 }
 
-.sso-btn.github {
-    background: #333333;
-    border-color: #444444;
-    color: #ffffff;
+.sso-toggle-card.linked:hover {
+    background: rgba(80, 250, 123, 0.04);
+    border-color: rgba(80, 250, 123, 0.35);
+}
+
+.sso-toggle-card.linked .toggle-status-indicator.top {
+    background: var(--clr-accent, #50fa7b);
+    box-shadow: 0 2px 10px rgba(80, 250, 123, 0.5);
+}
+
+.sso-toggle-card.linked .toggle-state-text {
+    color: var(--clr-accent, #50fa7b);
+    font-weight: bold;
+}
+
+/* Unlinked (Inactive/Faded State) styles */
+.sso-toggle-card.unlinked {
+    opacity: 0.75;
+}
+
+.sso-toggle-card.unlinked:hover {
+    opacity: 1.0;
+}
+
+.sso-toggle-card.unlinked .toggle-status-indicator.bottom {
+    background: rgba(255, 85, 85, 0.4);
+}
+
+.sso-toggle-card.unlinked .toggle-state-text {
+    color: var(--clr-text-secondary, #8fa08f);
 }
 
-.sso-btn.github:hover {
-    background: #444444;
+/* Historical/Disabled state */
+.sso-toggle-card.disabled {
+    pointer-events: none;
+    opacity: 0.4;
 }

package/src/client/components/keystone-details/keystone-details.html

@@ -76,11 +76,39 @@
 
         <!-- SSO Identity Linking Card -->
         <div id="sso-link-card" class="card hidden">
-            <h3>Link Identity Provider</h3>
-            <p class="description">Evolve this Domain Identity by linking a Web2 provider (Google, GitHub) to delegate sync access.</p>
-            <div class="sso-actions">
-                <button id="btn-link-google" class="action-btn sso-btn google">Link Google Account</button>
-                <button id="btn-link-github" class="action-btn sso-btn github">Link GitHub Account</button>
+            <h3>Identity Providers</h3>
+            <p class="description">Securely link or unlink external OAuth2 providers to delegate sync access to this identity.</p>
+            <div class="sso-toggle-group">
+                <!-- Google Card Toggle -->
+                <div id="btn-link-google" class="sso-toggle-card google" role="button" tabindex="0">
+                    <div class="toggle-status-indicator top"></div>
+                    <div class="toggle-content">
+                        <!-- Custom Google SVG Icon -->
+                        <svg class="sso-icon" viewBox="0 0 24 24">
+                            <path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/>
+                            <path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/>
+                            <path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.06H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.94l2.85-2.22.81-.63z"/>
+                            <path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.06l3.66 2.84c.87-2.6 3.3-4.52 6.16-4.52z"/>
+                        </svg>
+                        <span class="provider-label">Google</span>
+                        <span class="toggle-state-text">Unlinked</span>
+                    </div>
+                    <div class="toggle-status-indicator bottom"></div>
+                </div>
+
+                <!-- GitHub Card Toggle -->
+                <div id="btn-link-github" class="sso-toggle-card github" role="button" tabindex="0">
+                    <div class="toggle-status-indicator top"></div>
+                    <div class="toggle-content">
+                        <!-- Custom GitHub SVG Icon -->
+                        <svg class="sso-icon" viewBox="0 0 24 24" fill="currentColor">
+                            <path d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"/>
+                        </svg>
+                        <span class="provider-label">GitHub</span>
+                        <span class="toggle-state-text">Unlinked</span>
+                    </div>
+                    <div class="toggle-status-indicator bottom"></div>
+                </div>
             </div>
             <div id="sso-status-msg" class="status-msg hidden"></div>
         </div>

package/src/client/components/keystone-details/keystone-details.mts

@@ -24,6 +24,8 @@ import { toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
 import { GLOBAL_LOG_A_LOT, APP_CONFIG, } from "../../constants.mjs";
 import { getComponentCtorArg, getIbGibGlobalThis_SpaceGib } from "../../helpers.web.mjs";
 import { devLog } from "../../dev-tools.mjs";
+import { promptForSecret } from "@ibgib/web-gib/dist/helpers.web.mjs";
+import { isSsoProviderLinked } from "@ibgib/web-gib/dist/identity/sso/sso-helpers.mjs";
 
 const logalot = GLOBAL_LOG_A_LOT || true;
 
@@ -84,8 +86,8 @@ interface KeystoneDetailsElements extends ElementsBase {
     historicalWarningBannerEl: HTMLDivElement;
     containerEl: HTMLDivElement;
     ssoLinkCardEl: HTMLDivElement;
-    btnLinkGoogleEl: HTMLButtonElement;
-    btnLinkGithubEl: HTMLButtonElement;
+    btnLinkGoogleEl: HTMLDivElement;
+    btnLinkGithubEl: HTMLDivElement;
     ssoStatusMsgEl: HTMLDivElement;
 }
 
@@ -190,8 +192,8 @@ export class KeystoneDetailsComponentInstance
             this.elements.containerEl = shadow.getElementById('container') as HTMLDivElement;
             this.elements.historicalWarningBannerEl = shadow.getElementById('historical-warning-banner') as HTMLDivElement;
             this.elements.ssoLinkCardEl = shadow.getElementById('sso-link-card') as HTMLDivElement;
-            this.elements.btnLinkGoogleEl = shadow.getElementById('btn-link-google') as HTMLButtonElement;
-            this.elements.btnLinkGithubEl = shadow.getElementById('btn-link-github') as HTMLButtonElement;
+            this.elements.btnLinkGoogleEl = shadow.getElementById('btn-link-google') as HTMLDivElement;
+            this.elements.btnLinkGithubEl = shadow.getElementById('btn-link-github') as HTMLDivElement;
             this.elements.ssoStatusMsgEl = shadow.getElementById('sso-status-msg') as HTMLDivElement;
 
             // ElementBase requires contentEl
@@ -229,8 +231,8 @@ export class KeystoneDetailsComponentInstance
         // Buttons
         this.elements!.btnVerifyChainEl.addEventListener('click', () => this.handleVerifyIdentityChain());
         this.elements!.btnSetActiveEl.addEventListener('click', () => this.handleSetActiveIdentity());
-        this.elements!.btnLinkGoogleEl.addEventListener('click', () => this.handleSSOLink('google'));
-        this.elements!.btnLinkGithubEl.addEventListener('click', () => this.handleSSOLink('github'));
+        this.elements!.btnLinkGoogleEl.addEventListener('click', () => this.handleSSOClick('google'));
+        this.elements!.btnLinkGithubEl.addEventListener('click', () => this.handleSSOClick('github'));
     }
 
     private toggleAccordion() {
@@ -348,9 +350,43 @@ export class KeystoneDetailsComponentInstance
         if (this.isHistoricalFrame) {
             this.elements.btnSetActiveEl.disabled = true;
             this.elements.btnVerifyChainEl.disabled = true;
+            this.elements.btnLinkGoogleEl.classList.add('disabled');
+            this.elements.btnLinkGithubEl.classList.add('disabled');
         } else {
             this.elements.btnVerifyChainEl.disabled = false;
             this.elements.btnSetActiveEl.disabled = isTimelineActive;
+            this.elements.btnLinkGoogleEl.classList.remove('disabled');
+            this.elements.btnLinkGithubEl.classList.remove('disabled');
+
+            // Check if already linked
+            const isGoogleLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId: 'google' });
+            const isGithubLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId: 'github' });
+
+            // Google Card States
+            const googleCard = this.elements.btnLinkGoogleEl;
+            const googleLabel = googleCard.querySelector('.toggle-state-text')!;
+            if (isGoogleLinked) {
+                googleCard.classList.remove('unlinked');
+                googleCard.classList.add('linked');
+                googleLabel.textContent = "Google Linked ✅";
+            } else {
+                googleCard.classList.remove('linked');
+                googleCard.classList.add('unlinked');
+                googleLabel.textContent = "Unlinked";
+            }
+
+            // GitHub Card States
+            const githubCard = this.elements.btnLinkGithubEl;
+            const githubLabel = githubCard.querySelector('.toggle-state-text')!;
+            if (isGithubLinked) {
+                githubCard.classList.remove('unlinked');
+                githubCard.classList.add('linked');
+                githubLabel.textContent = "GitHub Linked ✅";
+            } else {
+                githubCard.classList.remove('linked');
+                githubCard.classList.add('unlinked');
+                githubLabel.textContent = "Unlinked";
+            }
         }
     }
 
@@ -687,7 +723,7 @@ export class KeystoneDetailsComponentInstance
 
             // 2. Generate a secure, high-entropy user nonce
             const userNonce = (Math.random().toString(36).substring(2) + Math.random().toString(36).substring(2)).substring(0, 32);
-            
+
             // 3. Construct state payload
             const stateObj = {
                 providerId,
@@ -710,16 +746,30 @@ export class KeystoneDetailsComponentInstance
             }
 
             // 6. Listen for callback from pop-up
+            let checkClosedInterval: any;
             const messageListener = async (event: MessageEvent) => {
                 if (event.origin !== window.location.origin) return;
                 const callbackData = event.data;
                 if (callbackData && callbackData.type === 'sso-oauth-callback') {
                     window.removeEventListener('message', messageListener);
+                    clearInterval(checkClosedInterval);
                     await this.handleSSOLinkCallback(callbackData.code, stateObj, providerConfig.redirectUri);
                 }
             };
             window.addEventListener('message', messageListener);
 
+            // 7. Poll for manual closure of the popup window
+            checkClosedInterval = setInterval(() => {
+                if (popup.closed) {
+                    clearInterval(checkClosedInterval);
+                    window.removeEventListener('message', messageListener);
+                    const statusEl = this.elements!.ssoStatusMsgEl;
+                    if (statusEl.textContent && statusEl.textContent.startsWith('Linking')) {
+                        this.setSSOStatus('Linking cancelled (window closed).', 'error');
+                    }
+                }
+            }, 500);
+
         } catch (error) {
             console.error(`${lc} SSO link initiation failed: ${extractErrorMsg(error)}`);
             this.setSSOStatus(`Link failed: ${extractErrorMsg(error)}`, "error");
@@ -762,10 +812,47 @@ export class KeystoneDetailsComponentInstance
 
             const custodianPool = linkData.custodianPool;
 
-            // 2. Prompt user for master secret to evolve locally
-            const masterSecret = prompt("Link successful! Enter your local Master Secret (Passphrase) to sign and register the custodian pool:");
-            if (!masterSecret) {
-                this.setSSOStatus("Link cancelled by user.", "info");
+            // 2. Prompt user for master secret and verify it
+            const keystoneService = new KeystoneService_V1();
+            let masterSecret: string | undefined;
+            let isCorrect = false;
+            let tries = 0;
+            const maxTries = 8;
+
+            while (tries < maxTries && !isCorrect) {
+                try {
+                    const promptMsg = tries === 0
+                        ? "Link successful! Enter your local Master Secret (Passphrase) to sign and register the custodian pool"
+                        : `Incorrect passphrase. Please try again (${maxTries - tries} tries remaining):`;
+                    masterSecret = await promptForSecret({
+                        msg: promptMsg,
+                        confirm: false
+                    });
+                } catch (error) {
+                    // cancelled
+                    if (logalot) { console.log(`${lc}[promptForSecret] user cancelled (I: 911ff1fb0234949228481968e9087626)`); }
+                    masterSecret = undefined;
+                    break;
+                }
+
+                if (!masterSecret) {
+                    break;
+                }
+
+                // Verify secret using verifySigningSecret (requires manage poolId)
+                isCorrect = await keystoneService.verifySigningSecret({
+                    keystoneIbGib: this.ibGib!,
+                    signingSecret: masterSecret,
+                    poolId: 'manage'
+                });
+
+                if (!isCorrect) {
+                    tries++;
+                }
+            }
+
+            if (!isCorrect) {
+                this.setSSOStatus("Link cancelled or failed (incorrect passphrase).", "error");
                 return;
             }
 
@@ -774,13 +861,12 @@ export class KeystoneDetailsComponentInstance
             const metaspace = getIbGibGlobalThis_SpaceGib(APP_CONFIG).metaspace;
             if (!metaspace) throw new Error("Metaspace not found");
             const space = await metaspace.getLocalUserSpace({ lock: false });
-            if (!space) throw new Error("Local space not found");
+            if (!space) { throw new Error("Local space not found"); }
 
             // 3. Evolve parent keystone to include the custodian pool
-            const keystoneService = new KeystoneService_V1();
             const evolvedParent = await keystoneService.addPools({
                 latestKeystone: this.ibGib!,
-                masterSecret,
+                masterSecret: masterSecret!,
                 newPools: [custodianPool],
                 metaspace,
                 space
@@ -818,4 +904,110 @@ export class KeystoneDetailsComponentInstance
             this.setSSOStatus(`Link failed: ${extractErrorMsg(error)}`, "error");
         }
     }
+
+    protected async handleSSOClick(providerId: 'google' | 'github') {
+        const isLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId });
+        if (isLinked) {
+            await this.handleSSOUnlink(providerId);
+        } else {
+            await this.handleSSOLink(providerId);
+        }
+    }
+
+    protected async handleSSOUnlink(providerId: 'google' | 'github') {
+        const lc = `${this.lc}[${this.handleSSOUnlink.name}]`;
+        this.setSSOStatus(`Unlinking ${providerId}...`, "info");
+
+        try {
+            // 1. Prompt user for passphrase
+            const keystoneService = new KeystoneService_V1();
+            let masterSecret: string | undefined;
+            let isCorrect = false;
+            let tries = 0;
+            const maxTries = 8;
+
+            while (tries < maxTries && !isCorrect) {
+                try {
+                    const promptMsg = tries === 0
+                        ? `Are you sure you want to unlink your ${providerId} account? If so, enter your local Master Secret (Passphrase) to authorize. Otherwise, click Cancel.`
+                        : `Incorrect passphrase. Please try again (${maxTries - tries} tries remaining):`;
+                    masterSecret = await promptForSecret({
+                        msg: promptMsg,
+                        confirm: false
+                    });
+                } catch (error) {
+                    masterSecret = undefined;
+                    break;
+                }
+
+                if (!masterSecret) {
+                    break;
+                }
+
+                // Verify secret using verifySigningSecret (requires manage poolId)
+                isCorrect = await keystoneService.verifySigningSecret({
+                    keystoneIbGib: this.ibGib!,
+                    signingSecret: masterSecret,
+                    poolId: 'manage'
+                });
+
+                if (!isCorrect) {
+                    tries++;
+                }
+            }
+
+            if (!isCorrect) {
+                this.setSSOStatus("Unlink cancelled or failed (incorrect passphrase).", "error");
+                return;
+            }
+
+            this.setSSOStatus("Evolving identity locally and removing custodian pool...", "info");
+
+            const metaspace = getIbGibGlobalThis_SpaceGib(APP_CONFIG).metaspace;
+            if (!metaspace) throw new Error("Metaspace not found");
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) { throw new Error("Local space not found"); }
+
+            // 2. Evolve parent keystone to remove the custodian pool
+            const targetPoolId = `custodian-manage-${providerId}`;
+            const evolvedParent = await keystoneService.removePools({
+                latestKeystone: this.ibGib!,
+                masterSecret: masterSecret!,
+                poolIds: [targetPoolId],
+                metaspace,
+                space
+            });
+
+            // 3. Sync evolved parent keystone back to server
+            this.setSSOStatus("Publishing evolved identity keystone to server...", "info");
+            const syncRes = await spaceGibApiBridge.putEvolveKeystone(
+                getIbGibAddr({ ibGib: this.ibGib! }),
+                evolvedParent,
+                [] // No outward delegate timelines
+            );
+            if (!syncRes.success) {
+                throw new Error(`Server synchronization rejected: ${syncRes.message}`);
+            }
+
+            // 4. Update index locally
+            await updateSpecialIndex({
+                type: "keystones",
+                rel8nInfos: [
+                    {
+                        rel8nName: "keystone",
+                        ibGibs: [toDto({ ibGib: evolvedParent })]
+                    }
+                ],
+                metaspace,
+                space
+            });
+
+            this.setSSOStatus(`Successfully unlinked ${providerId}!`, "success");
+            await this.loadIbGib({ getLatest: false });
+
+        } catch (error) {
+            console.error(`${lc} SSO unlink failed: ${extractErrorMsg(error)}`);
+            this.setSSOStatus(`Unlink failed: ${extractErrorMsg(error)}`, "error");
+        }
+    }
 }

package/src/server/serve-gib/handlers/api/keystone/keystone-evolve.handler.mts

@@ -15,6 +15,8 @@ import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
 import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
 import { validateAndRegisterEvolveKeystone } from '@ibgib/core-gib/dist/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mjs';
 import { KeystoneIbGib_V1 } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+import { loadSsoServerConfig } from '@ibgib/web-gib/dist/identity/sso/sso-config-helper.mjs';
+import { SsoCustodianService } from '@ibgib/web-gib/dist/identity/sso/sso-custodian-service.mjs';
 
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
 import { ServeGibHandlerWithMetaspaceBase } from '../../handler-base.mjs';
@@ -30,6 +32,7 @@ interface EvolveParams extends ParamsWithDomain {
 interface EvolveBody {
     keystoneIbGib: KeystoneIbGib_V1;
     relatedIbGibs?: IbGib_V1[];
+    revokeTokens?: Record<string, string>;
 }
 
 export class KeystoneEvolveHandler extends ServeGibHandlerWithMetaspaceBase<EvolveParams, EvolveBody> {
@@ -94,6 +97,36 @@ export class KeystoneEvolveHandler extends ServeGibHandlerWithMetaspaceBase<Evol
                 space
             });
 
+            // Post-Evolution Hook: Handle SSO provider unlinking
+            const claim = keystoneIbGib.data?.proofs?.[0]?.claim;
+            if (claim?.details?.type === 'remove-pool') {
+                const removeInfo = claim.details.info;
+                if (removeInfo && Array.isArray(removeInfo.remove)) {
+                    // Lazy-load custodian service config
+                    const config = loadSsoServerConfig();
+                    const custodian = new SsoCustodianService(config);
+
+                    for (const poolId of removeInfo.remove) {
+                        if (poolId.startsWith('custodian-manage-')) {
+                            const providerId = poolId.replace('custodian-manage-', '');
+                            console.log(`${lc} Evolved keystone removed custodian pool: ${poolId}. Performing unlink cleanup for provider: ${providerId}`);
+
+                            // Revoke token if supplied by the client
+                            const token = parsed.revokeTokens?.[providerId];
+                            if (token) {
+                                try {
+                                    await custodian.revokeToken(providerId as any, token);
+                                } catch (e) {
+                                    console.warn(`${lc} Failed to revoke token for provider ${providerId}: ${extractErrorMsg(e)}`);
+                                }
+                            } else {
+                                console.log(`${lc} No OAuth token supplied by client for revocation of provider: ${providerId}`);
+                            }
+                        }
+                    }
+                }
+            }
+
             return this.ok({
                 message: `Successfully evolved domain keystone with session keystone`,
             });

package/src/server/serve-gib/handlers/api/keystone/sso-link.handler.mts

@@ -3,6 +3,8 @@ import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
 import { loadSsoServerConfig } from '@ibgib/web-gib/dist/identity/sso/sso-config-helper.mjs';
 import { SsoCustodianService } from '@ibgib/web-gib/dist/identity/sso/sso-custodian-service.mjs';
 import { SsoProviderId } from '@ibgib/web-gib/dist/identity/sso/sso-types.mjs';
+import { isSsoProviderLinked } from '@ibgib/web-gib/dist/identity/sso/sso-helpers.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
 
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
 import { ServeGibHandlerWithMetaspaceBase } from '../../handler-base.mjs';
@@ -91,15 +93,34 @@ export class SsoLinkHandler extends ServeGibHandlerWithMetaspaceBase<LinkParams,
                 return this.error(500, 'No local user space found in domain metaspace');
             }
 
+            // 0. Fetch target keystone and verify if already linked
+            const keystoneService = new KeystoneService_V1();
+            const targetKeystone = await keystoneService.getLatestKeystone({
+                addr: parentTjpAddr,
+                metaspace: reqCtx.metaspace,
+                space
+            });
+            if (!targetKeystone) {
+                return this.error(400, `Keystone not found for address: ${parentTjpAddr}`);
+            }
+
+            if (isSsoProviderLinked({ keystone: targetKeystone, providerId })) {
+                return this.error(400, `SSO provider "${providerId}" is already linked to this keystone.`);
+            }
+
             // 1. Authenticate with provider and retrieve user info
             const service = getCustodian();
             const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
 
             // 2. Generate the custodian foreign challenge pool
-            const custodianPool = await service.createCustodianChallengePool(
-                userInfo.providerKey,
-                userNonce
-            );
+            const custodianPool = await service.createCustodianChallengePool({
+                providerId,
+                providerKey: userInfo.providerKey,
+                userNonce,
+                keystoneAddr: parentTjpAddr,
+                metaspace: reqCtx.metaspace,
+                space
+            });
 
             console.log(`${lc} created custodian pool for: ${userInfo.providerKey}`);