@structured-id/ui-core 1.2.0 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@structured-id/ui-core",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -19,7 +19,7 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
+      "import": "./src/index.ts",
       "require": "./dist/index.cjs"
     },
     "./proto": {
@@ -94,6 +94,6 @@
       "optional": true
     }
   },
-  "packageManager": "yarn@4.12.0",
+  "packageManager": "yarn@4.14.1",
   "license": "AGPL-3.0-only"
 }

package/src/browser-vp/crypto.ts

@@ -2,7 +2,6 @@
  * Cryptographic primitives for Browser VP.
  *
  * All operations use Web Crypto API. Keys are non-extractable.
- * See arch/auth/browser-vp.md § Key derivation.
  */
 
 import type { DerivedKeys } from "./types";

package/src/browser-vp/index.ts

@@ -10,8 +10,6 @@
  * - **Strategy B (device-key):** Random WebCrypto key, wrapped for sync.
  *   Each browser = separate device. Fallback for non-PRF browsers.
  *
- * See arch/auth/browser-vp.md for full specification.
- *
  * Reference: Prudnikov, D. (2026). "Client-Side Verifiable Presentation System
  * with Passkey-Derived Persistent Keys and Pairwise Service Bindings."
  * doi:10.5281/zenodo.19387768 — https://doi.org/10.5281/zenodo.19387768

package/src/browser-vp/prf.ts

@@ -4,8 +4,6 @@
  * PRF (Pseudo-Random Function) extension allows deriving
  * deterministic secrets from a passkey. Same passkey on any
  * synced device produces the same PRF output → same keys.
- *
- * See arch/auth/browser-vp.md § Strategy A: Passkey-Derived PPK.
  */
 
 const PRF_EVAL_LABEL = "sid-ppk-v1";

package/src/browser-vp/storage.ts

@@ -4,8 +4,6 @@
  * Database: sid-browser-vp
  *   ├── bindings       — per-service binding entries (key: service_sector)
  *   └── profile-state  — profile state + encrypted blob (key: profile_id)
- *
- * See arch/auth/browser-vp.md § IndexedDB Storage Schema.
  */
 
 import type { ProfileState, BindingEntry } from "./types";

package/src/browser-vp/types.ts

@@ -1,7 +1,5 @@
 /**
  * Browser VP types.
- *
- * See arch/auth/browser-vp.md for full specification.
  */
 
 /** VP strategy — automatically selected based on browser capabilities. */

package/src/browser-vp/vp.ts

@@ -3,8 +3,6 @@
  *
  * Builds and signs VPs using cached keys and profile blob.
  * VP creation is fully offline (~50ms with biometric cache).
- *
- * See arch/auth/browser-vp.md § VP Creation.
  */
 
 import type { VpRequest, VerifiablePresentation, BindingEntry } from "./types";

package/src/composables/index.ts

@@ -1,4 +1,3 @@
-export { useAuth } from "./useAuth";
 export {
   useGrpc,
   initGrpc,
@@ -7,4 +6,10 @@ export {
   getTransportType,
   type TransportType,
 } from "./useGrpc";
+export {
+  initAccountApi,
+  getAccountTransport,
+  closeAccountTransport,
+  type AccountApiConfig,
+} from "./useAccountTransport";
 export { useSession, type SessionCallbacks } from "./useSession";

package/src/composables/useAccountTransport.test.ts

@@ -0,0 +1,121 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import type {
+  MethodInfo,
+  RpcInterceptor,
+  RpcOptions,
+} from "@protobuf-ts/runtime-rpc";
+
+const created: Array<{
+  baseUrl: string;
+  fetchInit?: RequestInit;
+  interceptors?: RpcInterceptor[];
+}> = [];
+
+vi.mock("@protobuf-ts/grpcweb-transport", () => ({
+  GrpcWebFetchTransport: vi.fn().mockImplementation((options) => {
+    created.push(options);
+    return { type: "grpc-web-transport" };
+  }),
+}));
+
+import {
+  initAccountApi,
+  getAccountTransport,
+  closeAccountTransport,
+} from "./useAccountTransport";
+import { bffLogout, checkBffSession, initBff } from "./useBffAuth";
+
+/** Run the transport's interceptor over a call and return the options it passed on. */
+function intercepted(options: RpcOptions): RpcOptions {
+  const [interceptor] = created[created.length - 1].interceptors ?? [];
+  let passed: RpcOptions | undefined;
+  interceptor.interceptUnary!(
+    (_method, _input, opts) => {
+      passed = opts;
+      return {} as never;
+    },
+    {} as MethodInfo,
+    {},
+    options,
+  );
+  return passed!;
+}
+
+/** The BFF's answer to the page's session check: the user with the session's token. */
+function bffSession(csrfToken: string) {
+  vi.stubGlobal(
+    "fetch",
+    vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => ({ sub: "up_1", csrf_token: csrfToken }),
+    }),
+  );
+}
+
+/** The BFF's answer without a session. */
+function noBffSession() {
+  vi.stubGlobal("fetch", vi.fn().mockResolvedValue({ ok: false, status: 401 }));
+}
+
+describe("account API transport", () => {
+  beforeEach(async () => {
+    created.length = 0;
+    closeAccountTransport();
+    initBff("");
+    noBffSession();
+    await checkBffSession();
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  // The account API is reached only through the BFF on the page's own origin:
+  // its cookie rides along same-origin, and no other origin gets it.
+  it("goes to the BFF's API route with same-origin credentials", () => {
+    initAccountApi({ baseUrl: "/api" });
+    expect(created[0].baseUrl).toBe("/api");
+    expect(created[0].fetchInit).toEqual({ credentials: "same-origin" });
+  });
+
+  // Every call echoes the session's CSRF token, which the BFF hands the page
+  // with the session check: the BFF refuses a call without it, which is what
+  // stops a foreign page driving the account API.
+  it("sends the CSRF token the BFF gave with the session on every call", async () => {
+    initAccountApi({ baseUrl: "/api" });
+    bffSession("token-1");
+    await checkBffSession();
+    const options = intercepted({ meta: { other: "kept" } });
+    expect(options.meta).toEqual({ other: "kept", "x-csrf-token": "token-1" });
+  });
+
+  // No session, no header: the call goes out and the BFF answers it (401 or
+  // 403), rather than the page inventing a token.
+  it("sends no CSRF header without a session", () => {
+    initAccountApi({ baseUrl: "/api" });
+    const options = intercepted({ meta: {} });
+    expect(options.meta).toEqual({});
+  });
+
+  // Sign-out ends the session; its token goes with it.
+  it("forgets the token at sign-out", async () => {
+    initAccountApi({ baseUrl: "/api" });
+    bffSession("token-1");
+    await checkBffSession();
+    await bffLogout();
+    const options = intercepted({ meta: {} });
+    expect(options.meta).toEqual({});
+  });
+
+  it("is unusable before it is set up", () => {
+    expect(() => getAccountTransport()).toThrow(
+      "account API transport not initialized",
+    );
+  });
+
+  it("is the one set up", () => {
+    initAccountApi({ baseUrl: "/api" });
+    expect(getAccountTransport()).toEqual({ type: "grpc-web-transport" });
+  });
+});

package/src/composables/useAccountTransport.ts

@@ -0,0 +1,69 @@
+/**
+ * The account API transport: gRPC-Web through the BFF (sid-auth-proxy) on the
+ * page's own origin. The BFF holds the session's tokens and adds the Bearer
+ * token itself; the page sends only its session cookie and, on every call,
+ * the CSRF token the BFF set (double submit).
+ *
+ * Sign-in ceremonies are not account API calls: they go to SID's own sign-in
+ * surface through `getTransport()`, where the IdP's session lives.
+ */
+import { GrpcWebFetchTransport } from "@protobuf-ts/grpcweb-transport";
+import type { RpcInterceptor, RpcTransport } from "@protobuf-ts/runtime-rpc";
+import { bffCsrfToken } from "./useBffAuth";
+
+/** Where the account API is reached. */
+export interface AccountApiConfig {
+  /** The BFF's API route, usually `/api` on the page's own origin. */
+  baseUrl: string;
+}
+
+let _account: RpcTransport | null = null;
+
+/** The CSRF token of the BFF session, added to every call's metadata. */
+const csrf: RpcInterceptor = {
+  interceptUnary(next, method, input, options) {
+    const token = bffCsrfToken();
+    return next(
+      method,
+      input,
+      token
+        ? { ...options, meta: { ...options.meta, "x-csrf-token": token } }
+        : options,
+    );
+  },
+  interceptServerStreaming(next, method, input, options) {
+    const token = bffCsrfToken();
+    return next(
+      method,
+      input,
+      token
+        ? { ...options, meta: { ...options.meta, "x-csrf-token": token } }
+        : options,
+    );
+  },
+};
+
+/** Set up the account API transport. Call once at app startup. */
+export function initAccountApi(config: AccountApiConfig): void {
+  _account = new GrpcWebFetchTransport({
+    baseUrl: config.baseUrl,
+    // The BFF is on this origin; its cookie must not travel anywhere else.
+    fetchInit: { credentials: "same-origin" },
+    interceptors: [csrf],
+  });
+}
+
+/** The account API transport. Throws if it was not set up. */
+export function getAccountTransport(): RpcTransport {
+  if (!_account) {
+    throw new Error(
+      "account API transport not initialized. Call initAccountApi() at app startup.",
+    );
+  }
+  return _account;
+}
+
+/** Drop the account API transport (tests, app teardown). */
+export function closeAccountTransport(): void {
+  _account = null;
+}

package/src/composables/useBffAuth.ts

@@ -1,22 +1,22 @@
 /**
  * BFF (Backend-For-Frontend) session management composable.
  *
- * After migration from localStorage to cookie-based auth (#536i-3):
- *   - Tokens are stored server-side in sid-auth-proxy BFF sessions
- *   - SPA only holds a non-httpOnly CSRF cookie + httpOnly session cookie
- *   - gRPC calls go through BFF proxy which injects Bearer header
- *   - Client JS never sees the access token
+ * The tokens live in sid-auth-proxy's BFF session; the page holds only the
+ * BFF's httpOnly session cookie. gRPC calls go through the BFF, which adds
+ * the Bearer token itself, so the page never sees an access token. The
+ * session's CSRF token comes with the session check and every state-changing
+ * call echoes it in `X-CSRF-Token`.
  *
  * Usage:
- *   1. Call `initBff(bffBaseUrl)` at app boot (e.g., VITE_BFF_URL)
- *   2. Call `checkBffSession()` to verify session + populate auth store
- *   3. Call `startBffLogin()` to redirect user to PKCE auth flow
- *   4. Call `bffLogout()` to clear session (sends X-CSRF-Token header)
+ *   1. Call `initBff(bffBaseUrl)` at app boot
+ *   2. Call `checkBffSession()` to verify the session + populate the auth store
+ *   3. Call `startBffLogin()` to redirect the user to the PKCE auth flow
+ *   4. Call `bffLogout()` to clear the session
  */
 
 /** User info returned from BFF /auth/userinfo endpoint. */
 export interface BffUserInfo {
-  /** Subject identifier (ProfileId for CE, PersonaId for SaaS). */
+  /** Opaque subject identifier; its form depends on the issuer, so it is never parsed as a profile id. */
   sub: string;
   /** Email address (if available in session claims). */
   email?: string | null;
@@ -30,20 +30,24 @@ export interface BffUserInfo {
   acr?: string | null;
   /** Role assignments. */
   roles?: string[] | null;
+  /** The session's CSRF token, echoed in `X-CSRF-Token` by every state-changing call. */
+  csrf_token?: string | null;
 }
 
 let _bffBaseUrl: string | null = null;
-let _bffCookieName: string = "__Host-sid-bff";
+/**
+ * The CSRF token of the session the page last checked. Browser-only state:
+ * the session check runs in the browser, never during server rendering.
+ */
+let _csrfToken: string | null = null;
 
 /**
  * Initialize BFF configuration. Call once at app boot.
  *
- * @param baseUrl  BFF base URL (e.g., "https://app.structured.id" or VITE_BFF_URL)
- * @param cookieName  BFF session cookie name (default: "__Host-sid-bff")
+ * @param baseUrl  BFF base URL: "" for the page's own origin, where the BFF usually is
  */
-export function initBff(baseUrl: string, cookieName?: string): void {
+export function initBff(baseUrl: string): void {
   _bffBaseUrl = baseUrl;
-  if (cookieName) _bffCookieName = cookieName;
 }
 
 /** Get the configured BFF base URL, or null if not initialized. */
@@ -52,35 +56,37 @@ export function getBffBaseUrl(): string | null {
 }
 
 /**
- * Read the CSRF token from the non-httpOnly CSRF cookie.
- * The BFF sets a cookie `{cookieName}_csrf=<token>; SameSite=Lax` (NOT httpOnly)
- * so JS can read it for double-submit CSRF protection.
+ * The CSRF token the BFF gave with the session check, or null without a
+ * checked session. The BFF refuses a state-changing call without it.
  */
-function readCsrfToken(): string | null {
-  const name = `${_bffCookieName}_csrf=`;
-  const cookies = document.cookie.split("; ");
-  const found = cookies.find((c) => c.startsWith(name));
-  return found ? (found.split("=")[1] ?? null) : null;
+export function bffCsrfToken(): string | null {
+  return _csrfToken;
 }
 
 /**
  * Check if the BFF session is valid by calling GET /auth/userinfo.
  *
- * Returns user info if session is active, null if unauthenticated.
+ * Returns user info if session is active, null if unauthenticated, and
+ * keeps the session's CSRF token for the calls that follow.
  * The browser automatically sends the httpOnly session cookie.
+ * An empty base URL is the page's own origin, where the BFF usually is.
  */
 export async function checkBffSession(
   bffBaseUrl?: string,
 ): Promise<BffUserInfo | null> {
   const base = bffBaseUrl ?? _bffBaseUrl;
-  if (!base) return null;
+  if (base === null) return null;
   try {
     const resp = await fetch(`${base}/auth/userinfo`, {
       credentials: "include",
     });
-    if (resp.status === 401 || resp.status === 404) return null;
-    if (!resp.ok) return null;
-    return (await resp.json()) as BffUserInfo;
+    if (!resp.ok) {
+      _csrfToken = null;
+      return null;
+    }
+    const info = (await resp.json()) as BffUserInfo;
+    _csrfToken = info.csrf_token ?? null;
+    return info;
   } catch {
     return null;
   }
@@ -93,19 +99,21 @@ export async function checkBffSession(
  * back to the SPA. The SPA should call checkBffSession() on load to restore state.
  *
  * @param bffBaseUrl  Override BFF base URL (uses configured URL if not provided)
- * @param postLoginRedirect  URL to redirect to after successful auth
+ * @param postLoginRedirect  Path on the BFF's origin to return to after
+ *   sign-in (`/account/security?tab=keys`), sent as the BFF's `rd`
+ *   parameter; the BFF returns anything else to its root
  */
 export function startBffLogin(
   bffBaseUrl?: string,
   postLoginRedirect?: string,
 ): void {
   const base = bffBaseUrl ?? _bffBaseUrl;
-  if (!base) {
+  if (base === null) {
     console.warn("[BFF] Not initialized. Call initBff() at app boot.");
     return;
   }
   const url = postLoginRedirect
-    ? `${base}/auth/login?post_login_redirect=${encodeURIComponent(postLoginRedirect)}`
+    ? `${base}/auth/login?rd=${encodeURIComponent(postLoginRedirect)}`
     : `${base}/auth/login`;
   window.location.href = url;
 }
@@ -114,14 +122,16 @@ export function startBffLogin(
  * Log out by calling POST /auth/logout with X-CSRF-Token header.
  *
  * The BFF validates the CSRF header, clears server-side session,
- * and sends Set-Cookie headers to clear both cookies.
+ * and sends a Set-Cookie header to clear the session cookie. The token
+ * dies with the session either way.
  *
  * @param bffBaseUrl  Override BFF base URL
  */
 export async function bffLogout(bffBaseUrl?: string): Promise<void> {
   const base = bffBaseUrl ?? _bffBaseUrl;
-  if (!base) return;
-  const csrf = readCsrfToken();
+  if (base === null) return;
+  const csrf = _csrfToken;
+  _csrfToken = null;
   try {
     await fetch(`${base}/auth/logout`, {
       method: "POST",

package/src/generated/google/api/httpbody.ts

@@ -0,0 +1,159 @@
+// @generated by protobuf-ts 2.11.1 with parameter client_generic,generate_dependencies
+// @generated from protobuf file "google/api/httpbody.proto" (package "google.api", syntax proto3)
+// tslint:disable
+//
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+import { Any } from "../protobuf/any";
+/**
+ * Message that represents an arbitrary HTTP body. It should only be used for
+ * payload formats that can't be represented as JSON, such as raw binary or
+ * an HTML page.
+ *
+ *
+ * This message can be used both in streaming and non-streaming API methods in
+ * the request as well as the response.
+ *
+ * It can be used as a top-level request field, which is convenient if one
+ * wants to extract parameters from either the URL or HTTP template into the
+ * request fields and also want access to the raw HTTP body.
+ *
+ * Example:
+ *
+ *     message GetResourceRequest {
+ *       // A unique request id.
+ *       string request_id = 1;
+ *
+ *       // The raw HTTP body is bound to this field.
+ *       google.api.HttpBody http_body = 2;
+ *
+ *     }
+ *
+ *     service ResourceService {
+ *       rpc GetResource(GetResourceRequest)
+ *         returns (google.api.HttpBody);
+ *       rpc UpdateResource(google.api.HttpBody)
+ *         returns (google.protobuf.Empty);
+ *
+ *     }
+ *
+ * Example with streaming methods:
+ *
+ *     service CaldavService {
+ *       rpc GetCalendar(stream google.api.HttpBody)
+ *         returns (stream google.api.HttpBody);
+ *       rpc UpdateCalendar(stream google.api.HttpBody)
+ *         returns (stream google.api.HttpBody);
+ *
+ *     }
+ *
+ * Use of this type only changes how the request and response bodies are
+ * handled, all other features will continue to work unchanged.
+ *
+ * @generated from protobuf message google.api.HttpBody
+ */
+export interface HttpBody {
+    /**
+     * The HTTP Content-Type header value specifying the content type of the body.
+     *
+     * @generated from protobuf field: string content_type = 1
+     */
+    contentType: string;
+    /**
+     * The HTTP request/response body as raw binary.
+     *
+     * @generated from protobuf field: bytes data = 2
+     */
+    data: Uint8Array;
+    /**
+     * Application specific response metadata. Must be set in the first response
+     * for streaming APIs.
+     *
+     * @generated from protobuf field: repeated google.protobuf.Any extensions = 3
+     */
+    extensions: Any[];
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class HttpBody$Type extends MessageType<HttpBody> {
+    constructor() {
+        super("google.api.HttpBody", [
+            { no: 1, name: "content_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "data", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
+            { no: 3, name: "extensions", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => Any }
+        ]);
+    }
+    create(value?: PartialMessage<HttpBody>): HttpBody {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.contentType = "";
+        message.data = new Uint8Array(0);
+        message.extensions = [];
+        if (value !== undefined)
+            reflectionMergePartial<HttpBody>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: HttpBody): HttpBody {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string content_type */ 1:
+                    message.contentType = reader.string();
+                    break;
+                case /* bytes data */ 2:
+                    message.data = reader.bytes();
+                    break;
+                case /* repeated google.protobuf.Any extensions */ 3:
+                    message.extensions.push(Any.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: HttpBody, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string content_type = 1; */
+        if (message.contentType !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.contentType);
+        /* bytes data = 2; */
+        if (message.data.length)
+            writer.tag(2, WireType.LengthDelimited).bytes(message.data);
+        /* repeated google.protobuf.Any extensions = 3; */
+        for (let i = 0; i < message.extensions.length; i++)
+            Any.internalBinaryWrite(message.extensions[i], writer.tag(3, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.api.HttpBody
+ */
+export const HttpBody = new HttpBody$Type();