@structured-id/ui-core 1.2.0 → 1.3.0

package/src/profile/composables/useLoginSuccess.ts

@@ -1,22 +1,14 @@
 /**
  * Shared post-login success handler.
  *
- * After BFF migration (#536i-3): tokens are set server-side via BFF session cookie.
- * The SPA no longer stores tokens — it only calls checkBffSession() to populate
- * the auth store from the BFF /auth/userinfo endpoint.
+ * A sign-in that an authorization request sent the user to (`rd`, the
+ * continuation of that request at the issuer) returns the browser there: the
+ * ceremony has set the issuer's IdP session cookie, and the authorization
+ * endpoint completes the request with it. Any other `rd` is ignored, so the
+ * sign-in page never redirects to an address it did not validate.
  *
- * The BFF login flow:
- *   1. App redirects to /auth/login (PKCE initiation)
- *   2. User authenticates on the IdP
- *   3. BFF callback sets httpOnly session cookie
- *   4. BFF redirects back to SPA
- *   5. SPA calls checkBffSession() → setBffSession() → navigates to dashboard
- *
- * For apps where the SPA IS the auth UI (personal-ui OPAQUE flow):
- *   The OPAQUE login completes, sid-auth sets the server-side session,
- *   and this handler fetches userinfo from BFF to restore session state.
- *
- * Used by all apps (personal-ui, admin-ui, frontend) for consistent behavior.
+ * Otherwise the app's own session comes from its BFF: the handler reads it
+ * from the BFF's /auth/userinfo and navigates within the app.
  */
 import { useRouter } from "vue-router";
 import { useAuthStore } from "../../index";
@@ -26,29 +18,95 @@ export interface LoginSuccessResult {
   sessionId?: string;
 }
 
+/** Options of {@link useLoginSuccess}. */
+export interface LoginSuccessOptions {
+  /**
+   * Origin of the SID installation whose issuers may send users to this
+   * sign-in page (e.g. `https://sid.example.com`). Without it, `rd` is never
+   * followed.
+   */
+  issuerOrigin?: string;
+  /** Leave the app for an absolute URL; defaults to `window.location.assign`. */
+  leaveTo?: (url: string) => void;
+}
+
+/** Path of an issuer's authorization endpoint: `/i/<32 hex>/oauth2/authorize`. */
+const AUTHORIZE_PATH = /^\/i\/[0-9a-f]{32}\/oauth2\/authorize$/;
+
+/** Prefix of the reference a kept authorization request is continued by. */
+const REQUEST_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
+
 /**
- * Create a login success handler that restores BFF session state and navigates.
- *
- * @param redirectTo - Route to navigate after successful login (e.g., "/account", "/admin")
+ * `rd` when it is exactly the continuation of an authorization request at an
+ * issuer of `issuerOrigin`: that origin, an issuer's authorization endpoint,
+ * and no parameter but `client_id` and `request_uri`. Anything else is null.
+ */
+export function authorizationContinuation(
+  rd: unknown,
+  issuerOrigin: string,
+): string | null {
+  if (typeof rd !== "string") return null;
+  let url: URL;
+  let expected: string;
+  try {
+    url = new URL(rd);
+    expected = new URL(issuerOrigin).origin;
+  } catch {
+    return null;
+  }
+  if (url.origin !== expected || url.username || url.password || url.hash) {
+    return null;
+  }
+  if (!AUTHORIZE_PATH.test(url.pathname)) return null;
+  const names = [...url.searchParams.keys()].sort();
+  if (
+    names.length !== 2 ||
+    names[0] !== "client_id" ||
+    names[1] !== "request_uri"
+  ) {
+    return null;
+  }
+  if (!url.searchParams.get("request_uri")?.startsWith(REQUEST_URI_PREFIX)) {
+    return null;
+  }
+  if (!url.searchParams.get("client_id")) return null;
+  return url.toString();
+}
+
+/**
+ * Create a login success handler: back to the authorization request the
+ * user signs in for, or into the app at `redirectTo`.
  *
  * @example
  * ```vue
  * <script setup>
  * import { useLoginSuccess } from "@structured-id/ui-core/profile";
- * const { onLoginSuccess } = useLoginSuccess("/account");
+ * const { onLoginSuccess } = useLoginSuccess("/account", { issuerOrigin });
  * </script>
  * <template>
  *   <SidLoginForm :login-fn="login" @success="onLoginSuccess" />
  * </template>
  * ```
  */
-export function useLoginSuccess(redirectTo: string) {
+export function useLoginSuccess(
+  redirectTo: string,
+  options: LoginSuccessOptions = {},
+) {
   const auth = useAuthStore();
   const router = useRouter();
 
   async function onLoginSuccess(_result?: LoginSuccessResult) {
-    // Restore BFF session from /auth/userinfo — the BFF set the httpOnly cookie
-    // during the login flow. We fetch userinfo to populate the auth store.
+    const back = options.issuerOrigin
+      ? authorizationContinuation(
+          router.currentRoute.value.query.rd,
+          options.issuerOrigin,
+        )
+      : null;
+    if (back) {
+      (options.leaveTo ?? ((url: string) => window.location.assign(url)))(back);
+      return;
+    }
+
     try {
       const userInfo = await checkBffSession();
       if (userInfo) {

package/src/profile/composables/useSecurityLevel.test.ts

@@ -12,7 +12,6 @@ import {
   type Credential,
   type Principal,
 } from "../../index";
-import { PrincipalSubjectType } from "../../generated/sid/v1/identity/identity";
 
 // ── Helpers ──
 
@@ -50,8 +49,7 @@ function makePrincipal(type: PrincipalType, verified: boolean): Principal {
     value: "test",
     verified,
     isPrimary: false,
-    subjectType: PrincipalSubjectType.PROFILE,
-    subjectId: "",
+    needsAddressConfirmation: false,
   };
 }
 
@@ -162,6 +160,15 @@ describe("recoverability", () => {
     const { recoveryMethods } = useSecurityLevel(ref([]), principals);
     expect(recoveryMethods.value).not.toContain("recovery_email");
   });
+
+  // An email whose address awaits confirmation receives no reset, so it is
+  // no recovery channel even when it was once marked verified.
+  it("email awaiting address confirmation not counted", () => {
+    const pending = makePrincipal(PrincipalType.EMAIL, true);
+    pending.needsAddressConfirmation = true;
+    const { recoveryMethods } = useSecurityLevel(ref([]), ref([pending]));
+    expect(recoveryMethods.value).not.toContain("recovery_email");
+  });
 });
 
 // ── Nudges ──

package/src/profile/composables/useSecurityLevel.ts

@@ -180,8 +180,12 @@ export function useSecurityLevel(
       methods.push("synced_passkey");
     }
 
+    // An email awaiting address confirmation receives no reset.
     const emails = identifiers.value.filter(
-      (i) => i.type === PrincipalType.EMAIL && i.verified,
+      (i) =>
+        i.type === PrincipalType.EMAIL &&
+        i.verified &&
+        !i.needsAddressConfirmation,
     );
     if (emails.length > 0) {
       methods.push("recovery_email");
@@ -235,10 +239,15 @@ export function useSecurityLevel(
       (c) => c.type === CredentialType.RECOVERY,
     );
     const verifiedEmails = identifiers.value.filter(
-      (i) => i.type === PrincipalType.EMAIL && i.verified,
+      (i) =>
+        i.type === PrincipalType.EMAIL &&
+        i.verified &&
+        !i.needsAddressConfirmation,
     );
     const unverifiedEmails = identifiers.value.filter(
-      (i) => i.type === PrincipalType.EMAIL && !i.verified,
+      (i) =>
+        i.type === PrincipalType.EMAIL &&
+        (!i.verified || i.needsAddressConfirmation),
     );
 
     if (!hasRecovery) {

package/src/quasar/SidPrincipalInput.vue

@@ -33,6 +33,7 @@
 <script setup lang="ts">
 import { ref, computed, watch } from "vue";
 import { isValidPhoneNumber } from "libphonenumber-js";
+import { isValidEmail } from "../utils/validators";
 
 export type PrincipalType = "email" | "phone" | "username" | "unknown";
 
@@ -47,8 +48,7 @@ interface Props {
 
 const props = withDefaults(defineProps<Props>(), {
   modelValue: "",
-  // Per arch/identity/identity-model.md §Principal: username regex is
-  // ^[a-z0-9_]{3,32}$ (display form ^[a-zA-Z0-9_]{3,32}$).
+  // Username rule: ^[a-z0-9_]{3,32}$ (display form ^[a-zA-Z0-9_]{3,32}$).
   minUsernameLength: 3,
   required: true,
   label: "Email, phone, or username",
@@ -80,8 +80,7 @@ function detectType(value: string): PrincipalType {
   // Email: contains @ (checked after phone to exclude edge cases)
   if (trimmed.includes("@")) return "email";
 
-  // Username per arch/identity/identity-model.md:
-  // ^[a-z0-9_]{3,32}$, no leading/trailing _, no __
+  // Username: ^[a-z0-9_]{3,32}$, no leading/trailing _, no __
   // Detection is relaxed: accepts uppercase (will normalize), checks min length
   const re = new RegExp(
     `^[a-zA-Z0-9_]{${props.minUsernameLength},${USERNAME_MAX_LENGTH}}$`,
@@ -110,15 +109,13 @@ function onInput(value: string | number | null) {
 const requiredRule = (val: string) =>
   !props.required || !!val || "This field is required";
 
-const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-
 const typeRule = (val: string): string | true => {
   if (!val) return true; // required rule handles empty
   const type = detectType(val);
 
   switch (type) {
     case "email":
-      return emailRegex.test(val) || "Invalid email address";
+      return isValidEmail(val.trim()) || "Invalid email address";
     case "phone":
       return isValidPhoneNumber(val) || "Invalid phone number";
     case "username": {

package/src/utils/normalizePrincipal.test.ts

@@ -99,11 +99,24 @@ describe("detectLoginInputType", () => {
 });
 
 describe("normalizePrincipal", () => {
-  it("normalizes email: lowercase + strip dots + strip alias", () => {
-    const result = normalizePrincipal("Alice.Bob+tag@Example.COM");
+  // Regression: the client folded the address (case, dots, +tag) before
+  // sending it, so the server never saw the mailbox the user typed and
+  // stored the folded key as the address to mail. The server derives the
+  // lookup key and keeps the spelling; the client sends it as typed.
+  it("sends an email as typed, only trimmed", () => {
+    const result = normalizePrincipal("  Alice.Bob+tag@Example.COM ");
     expect(result.type).toBe("email");
-    expect(result.value).toBe("alicebob@example.com");
-    expect(result.display).toBe("alicebob@example.com");
+    expect(result.value).toBe("Alice.Bob+tag@Example.COM");
+    expect(result.display).toBe("Alice.Bob+tag@Example.COM");
+  });
+
+  // Admission is the server's policy: an installation's internal mail
+  // domain and a quoted local part are not refused by the client.
+  it("leaves email admission to the server", () => {
+    expect(normalizePrincipal("admin@printer").value).toBe("admin@printer");
+    expect(normalizePrincipal('"a b"@example.com').value).toBe(
+      '"a b"@example.com',
+    );
   });
 
   it("normalizes phone to E.164", () => {
@@ -137,8 +150,9 @@ describe("normalizePrincipal", () => {
     expect(() => normalizePrincipal("alice", 6)).toThrow("Cannot determine");
   });
 
-  it("throws on invalid email", () => {
+  it("throws on an email with no local part or domain", () => {
     expect(() => normalizePrincipal("alice@")).toThrow("Invalid email");
+    expect(() => normalizePrincipal("@example.com")).toThrow("Invalid email");
   });
 
   it("throws on invalid phone", () => {

package/src/utils/normalizePrincipal.ts

@@ -1,6 +1,7 @@
 import parsePhoneNumberFromString, {
   isValidPhoneNumber,
 } from "libphonenumber-js";
+import { isValidEmail } from "./validators";
 
 export type LoginInputType = "email" | "phone" | "username" | "unknown";
 
@@ -13,7 +14,7 @@ export interface NormalizedPrincipal {
 }
 
 /**
- * Global username rules per arch/identity/identity-model.md:
+ * Global username rules:
  *   Display:    ^[a-zA-Z0-9_]{3,32}$ — user's original input, mixed case preserved
  *   Normalized: ^[a-z0-9_]{3,32}$    — lowercase, for storage + uniqueness + login
  *   - cannot start or end with underscore
@@ -76,7 +77,7 @@ export function detectLoginInputType(
 /**
  * Normalize principal value for server submission.
  *
- * - Email: lowercase, strip dots before @, strip +aliases
+ * - Email: as typed (trimmed); the server applies the email policy
  * - Phone: E.164 format via libphonenumber-js
  * - Username: lowercase, validate per arch rules
  *
@@ -92,15 +93,12 @@ export function normalizePrincipal(
 
   switch (type) {
     case "email": {
-      const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-      if (!emailRegex.test(trimmed)) {
+      // Sent as typed: the server validates it, derives the lookup key and
+      // keeps this spelling as the address to mail.
+      if (!isValidEmail(trimmed)) {
         throw new Error("Invalid email address");
       }
-      // Remove dots before @, strip +alias, lowercase
-      const [localRaw, domain] = trimmed.split("@");
-      const local = localRaw.replace(/\./g, "").replace(/\+.*$/, "");
-      const normalized = `${local}@${domain}`.toLowerCase();
-      return { value: normalized, display: normalized, type: "email" };
+      return { value: trimmed, display: trimmed, type: "email" };
     }
 
     case "phone": {

package/src/utils/rpcRefusal.test.ts

@@ -0,0 +1,151 @@
+import { describe, it, expect } from "vitest";
+import { RpcError } from "@protobuf-ts/runtime-rpc";
+import { base64encode } from "@protobuf-ts/runtime";
+import { Any } from "../generated/google/protobuf/any";
+import { Status } from "../generated/google/rpc/status";
+import {
+  ErrorInfo,
+  LocalizedMessage,
+} from "../generated/google/rpc/error_details";
+import { ErrorReason } from "../generated/sid/v1/common/errors";
+import {
+  REFUSAL_TEXTS,
+  refusalMessage,
+  rpcReason,
+  rpcRefusal,
+} from "./rpcRefusal";
+
+/** A refused call as the gRPC-Web transport raises it: the status in the trailer. */
+function refused(
+  details: Any[],
+  message = "this%20password%20was%20used%20before",
+): RpcError {
+  const status = Status.create({ code: 9, message, details });
+  return new RpcError(message, "FAILED_PRECONDITION", {
+    "grpc-status-details-bin": base64encode(Status.toBinary(status)),
+  });
+}
+
+const info = Any.pack(
+  ErrorInfo.create({
+    reason: "PASSWORD_REUSED",
+    domain: "structured.id",
+    metadata: {},
+  }),
+  ErrorInfo,
+);
+
+describe("rpcRefusal", () => {
+  // The contract a page branches on is the (domain, reason) pair of ErrorInfo.
+  it("reads the domain and reason from the status details", () => {
+    expect(rpcRefusal(refused([info]))).toMatchObject({
+      code: "FAILED_PRECONDITION",
+      domain: "structured.id",
+      reason: "PASSWORD_REUSED",
+    });
+    expect(rpcReason(refused([info]))).toBe("PASSWORD_REUSED");
+  });
+
+  // A reason is defined only within its domain: the same name from another
+  // service (a proxied upstream, another edition) is not SID's reason, so a
+  // page must not branch on it as if it were.
+  it("reports a reason only for the domain asked about", () => {
+    const foreign = Any.pack(
+      ErrorInfo.create({
+        reason: "PASSWORD_REUSED",
+        domain: "upstream.example.com",
+        metadata: {},
+      }),
+      ErrorInfo,
+    );
+    expect(rpcReason(refused([foreign]))).toBeNull();
+    expect(rpcReason(refused([foreign]), "upstream.example.com")).toBe(
+      "PASSWORD_REUSED",
+    );
+  });
+
+  // gRPC percent-encodes the status message on the wire; people read it decoded.
+  it("decodes the percent-encoded status message", () => {
+    expect(rpcRefusal(refused([]))?.message).toBe(
+      "this password was used before",
+    );
+  });
+
+  it("prefers the server's text for people", () => {
+    const localized = Any.pack(
+      LocalizedMessage.create({ locale: "en", message: "Choose another." }),
+      LocalizedMessage,
+    );
+    expect(refusalMessage(refused([info, localized]))).toBe("Choose another.");
+  });
+
+  // The status message is written for developers: people see the client's
+  // text for the reason, never the message.
+  it("shows the client's text for the reason", () => {
+    expect(refusalMessage(refused([info]))).toBe(
+      REFUSAL_TEXTS[ErrorReason.PASSWORD_REUSED],
+    );
+    expect(rpcRefusal(refused([info]))?.reasonCode).toBe(
+      ErrorReason.PASSWORD_REUSED,
+    );
+  });
+
+  // A refusal without SID's reason (a transport failure, another domain, a
+  // reason this client does not know) has nothing for people but the
+  // caller's own context.
+  it("falls back to the caller's text without a known SID reason", () => {
+    expect(refusalMessage(refused([]), "Failed to load")).toBe(
+      "Failed to load",
+    );
+    const foreign = Any.pack(
+      ErrorInfo.create({
+        reason: "PASSWORD_REUSED",
+        domain: "upstream.example.com",
+        metadata: {},
+      }),
+      ErrorInfo,
+    );
+    expect(refusalMessage(refused([foreign]), "Failed to load")).toBe(
+      "Failed to load",
+    );
+    const unknown = Any.pack(
+      ErrorInfo.create({
+        reason: "NOT_YET_DEFINED",
+        domain: "structured.id",
+        metadata: {},
+      }),
+      ErrorInfo,
+    );
+    expect(rpcRefusal(refused([unknown]))?.reasonCode).toBeNull();
+    expect(refusalMessage(refused([unknown]), "Failed to load")).toBe(
+      "Failed to load",
+    );
+  });
+
+  // Every reason of the proto has a text: a reason added without one would
+  // reach people as the bare fallback.
+  it("has a text for every reason", () => {
+    const texts: Partial<Record<ErrorReason, string>> = REFUSAL_TEXTS;
+    for (const value of Object.values(ErrorReason)) {
+      if (typeof value !== "number") continue;
+      if (value === ErrorReason.ERROR_REASON_UNSPECIFIED) continue;
+      expect(texts[value]).toBeTruthy();
+    }
+  });
+
+  it("leaves any other error alone", () => {
+    expect(rpcRefusal(new Error("boom"))).toBeNull();
+    expect(rpcReason(new Error("boom"))).toBeNull();
+    expect(refusalMessage(new Error("boom"))).toBe("boom");
+    expect(refusalMessage("not an error", "Request failed")).toBe(
+      "Request failed",
+    );
+  });
+
+  it("survives an unreadable trailer", () => {
+    const err = new RpcError("m", "INTERNAL", {
+      "grpc-status-details-bin": "!!!",
+    });
+    expect(rpcRefusal(err)).toMatchObject({ reason: null, message: "m" });
+  });
+});