@oimlsmart/platform-server 0.2.4 → 0.2.5

package/migrations/0024_oidc_code_auth_time.sql

@@ -0,0 +1,10 @@
+-- Migration 0024 — the SSO wave-A tail (TODO.identity-sso: RP-initiated
+-- logout + prompt=login): the one-time code carries the consenting
+-- session's authentication instant (sessions.created_at, verbatim), so
+-- the token endpoint emits the ID token's auth_time — the forced
+-- re-authentication's freshness proof the RP verifies. NULL = no
+-- instant recorded (a code minted before this wave).
+-- schema.sql carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+ALTER TABLE oidc_codes ADD COLUMN auth_time TEXT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/store/d1.ts

@@ -640,6 +640,11 @@ export class D1ServerStore implements ServerStore {
       if (!codeCols.results.some(c => c.name === 'amr')) {
         await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN amr TEXT').run()
       }
+      // TODO.identity-sso (the wave-A tail): the code carries the
+      // consenting session's authentication instant (migration 0024).
+      if (!codeCols.results.some(c => c.name === 'auth_time')) {
+        await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN auth_time TEXT').run()
+      }
       const tokenCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
       if (!tokenCols.results.some(c => c.name === 'amr')) {
         await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN amr TEXT').run()
@@ -862,11 +867,11 @@ export class D1ServerStore implements ServerStore {
     // reassignment takes effect on the next request; deactivation ends
     // the session at once.
     const session = await this.stmt(
-      `SELECT s.user_id, s.active_org, s.amr, u.email, u.name, u.role, u.roles, u.org_id, u.avatar_url, u.provider, u.email_verified_at
+      `SELECT s.user_id, s.active_org, s.amr, s.created_at, u.email, u.name, u.role, u.roles, u.org_id, u.avatar_url, u.provider, u.email_verified_at
        FROM sessions s JOIN users u ON s.user_id = u.id
        WHERE s.token = ? AND s.expires_at > datetime('now') AND u.active = 1`,
       token,
-    ).first<{ user_id: string; active_org: string | null; amr: string | null; email: string; name: string; role: string; roles: string | null; org_id: string | null; avatar_url: string | null; provider: string; email_verified_at: string | null }>()
+    ).first<{ user_id: string; active_org: string | null; amr: string | null; created_at: string; email: string; name: string; role: string; roles: string | null; org_id: string | null; avatar_url: string | null; provider: string; email_verified_at: string | null }>()
     if (!session) return null
     const amr = parseRoles(session.amr)
     const payload: AuthUserPayload = {
@@ -880,6 +885,9 @@ export class D1ServerStore implements ServerStore {
       provider: session.provider,
       emailVerifiedAt: session.email_verified_at ?? null,
       ...(amr?.length ? { amr } : {}),
+      // TODO.identity-sso (the wave-A tail): the authentication instant —
+      // the ID token's auth_time derives from it (the consumer converts).
+      sessionCreatedAt: session.created_at,
     }
     // TODO.identity/11: the active-org context (the membership model) —
     // the payload's org/roles follow the session's stamped context. The
@@ -1295,16 +1303,20 @@ export class D1ServerStore implements ServerStore {
      *  (stored as JSON; the token endpoint emits it as the ID token's
      *  amr). Absent = no provenance recorded. */
     amr?: string[] | null
+    /** TODO.identity-sso (the wave-A tail): the consenting session's
+     *  authentication instant (verbatim; absent = none recorded) — the
+     *  token endpoint emits it as the ID token's auth_time. */
+    authTime?: string | null
     ttlMs: number
   }): Promise<void> {
     await this.ensureMembershipSupport()
     const expiresAt = new Date(Date.now() + input.ttlMs).toISOString()
     await this.ensureOidcColumns()
     await this.stmt(
-      `INSERT INTO oidc_codes (code, client_id, redirect_uri, scope, nonce, code_challenge, user_id, context_org, amr, expires_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      `INSERT INTO oidc_codes (code, client_id, redirect_uri, scope, nonce, code_challenge, user_id, context_org, amr, auth_time, expires_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       input.code, input.clientId, input.redirectUri, input.scope, input.nonce, input.codeChallenge, input.userId, input.contextOrg ?? null,
-      input.amr?.length ? JSON.stringify(input.amr) : null, expiresAt,
+      input.amr?.length ? JSON.stringify(input.amr) : null, input.authTime ?? null, expiresAt,
     ).run()
   }
 
@@ -1330,6 +1342,7 @@ export class D1ServerStore implements ServerStore {
       userId: row.user_id as string,
       contextOrg: (row.context_org as string | null) ?? null,
       amr: parseRoles((row.amr as string | null) ?? null) ?? null,
+      authTime: (row.auth_time as string | null) ?? null,
       expiresAt: row.expires_at as string,
     }
   }

package/src/store/sqlite/op-store.ts

@@ -174,14 +174,18 @@ export function createOidcCode(input: {
    *  (stored as JSON; the token endpoint emits it as the ID token's
    *  amr). Absent = no provenance recorded. */
   amr?: string[] | null
+  /** TODO.identity-sso (the wave-A tail): the consenting session's
+   *  authentication instant (verbatim; absent = none recorded) — the
+   *  token endpoint emits it as the ID token's auth_time. */
+  authTime?: string | null
   ttlMs: number
 }): void {
   const expiresAt = new Date(Date.now() + input.ttlMs).toISOString()
   getDb().prepare(`
-    INSERT INTO oidc_codes (code, client_id, redirect_uri, scope, nonce, code_challenge, user_id, context_org, amr, expires_at)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO oidc_codes (code, client_id, redirect_uri, scope, nonce, code_challenge, user_id, context_org, amr, auth_time, expires_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(input.code, input.clientId, input.redirectUri, input.scope, input.nonce, input.codeChallenge, input.userId,
-    input.contextOrg ?? null, input.amr?.length ? JSON.stringify(input.amr) : null, expiresAt)
+    input.contextOrg ?? null, input.amr?.length ? JSON.stringify(input.amr) : null, input.authTime ?? null, expiresAt)
 }
 
 /** Atomically consume the code: the UPDATE flips consumed_at exactly
@@ -204,6 +208,7 @@ export function consumeOidcCode(code: string): OidcCode | null {
     userId: row.user_id as string,
     contextOrg: (row.context_org as string | null) ?? null,
     amr: parseJsonStringList(row.amr),
+    authTime: (row.auth_time as string | null) ?? null,
     expiresAt: row.expires_at as string,
   }
 }

package/src/store/sqlite/schema.sql

@@ -339,6 +339,10 @@ CREATE TABLE IF NOT EXISTS oidc_codes (
   -- TODO.identity-sso/02+03: the consenting session's amr provenance (a
   -- JSON array; NULL = none recorded), carried into the ID token.
   amr TEXT,
+  -- TODO.identity-sso (the wave-A tail): the consenting session's
+  -- authentication instant (sessions.created_at, verbatim; NULL = none
+  -- recorded), carried into the ID token's auth_time.
+  auth_time TEXT,
   created_at TEXT NOT NULL DEFAULT (datetime('now')),
   expires_at TEXT NOT NULL,
   consumed_at TEXT

package/src/store/sqlite/store.ts

@@ -323,6 +323,10 @@ export function getSessionUser(token: string): AuthUserPayload | null {
   ).run(token)
   // s.* carries the SESSION's id — the payload's id is the USER's.
   const payload = toAuthPayload({ ...session, id: session.user_id })
+  // TODO.identity-sso (the wave-A tail): the session's authentication
+  // instant (sessions.created_at, verbatim) — the ID token's auth_time
+  // derives from it (the consumer converts to the OIDC NumericDate).
+  payload.sessionCreatedAt = session.created_at as string
   // TODO.identity/11: the active-org context (the membership model) —
   // the payload's org/roles follow the session's stamped context.
   return applySessionOrgContext(session.active_org ?? null, payload)

package/src/store.ts

@@ -65,6 +65,13 @@ export interface AuthUserPayload {
    *  read (getSessionUser) only; ABSENT = no OP-side credential event
    *  recorded (an upstream-provider sign-in, a legacy row). */
   amr?: string[]
+  /** TODO.identity-sso (the wave-A tail): the SESSION's authentication
+   *  instant (sessions.created_at, the column verbatim — the sign-in's
+   *  wall-clock stamp). Projected by the session-backed read
+   *  (getSessionUser) only. The ID token's auth_time derives from it (the
+   *  OIDC NumericDate conversion is the consumer's — the column's storage
+   *  format is the store's own). */
+  sessionCreatedAt?: string
 }
 
 // ── identity federation (TODO.federation/10) ─────────────────────────
@@ -425,6 +432,10 @@ export interface OidcCode {
   /** TODO.identity-sso/02+03: the consenting session's amr provenance
    *  (parsed from the row's JSON; null = none recorded). */
   amr: string[] | null
+  /** TODO.identity-sso (the wave-A tail): the consenting session's
+   *  authentication instant (sessions.created_at, verbatim; null = none
+   *  recorded) — the token endpoint emits it as the ID token's auth_time. */
+  authTime: string | null
   expiresAt: string
 }
 
@@ -1580,6 +1591,11 @@ export interface ServerStore {
      *  (stored as JSON; the token endpoint emits it as the ID token's
      *  amr). Absent = no provenance recorded. */
     amr?: string[] | null
+    /** TODO.identity-sso (the wave-A tail): the consenting session's
+     *  authentication instant (sessions.created_at, verbatim; absent =
+     *  none recorded) — the token endpoint emits it as the ID token's
+     *  auth_time. */
+    authTime?: string | null
     ttlMs: number
   }): Promise<void>
   /** Atomically consume the code: answers the row exactly once (a