@structured-id/ui-core 4.14.2 → 4.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@structured-id/ui-core",
-  "version": "4.14.2",
+  "version": "4.15.1",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -42,8 +42,8 @@
     "@protobuf-ts/grpcweb-transport": "^2.11.1",
     "@protobuf-ts/runtime": "^2.11.1",
     "@protobuf-ts/runtime-rpc": "^2.11.1",
-    "@structured-id/ids": "^0.7.0",
-    "@structured-id/proto": "^0.14.0",
+    "@structured-id/ids": "^0.10.0",
+    "@structured-id/proto": "^0.18.0",
     "@structured-world/structured-email-address-ts": "^0.0.22",
     "@structured-world/structured-public-domains": "0.0.x",
     "libphonenumber-js": "^1.13.15"

package/src/index.ts

@@ -82,6 +82,7 @@ export {
   refusalMessage,
   REFUSAL_TEXTS,
   SID_ERROR_DOMAIN,
+  SignInRefusedError,
   type FieldViolation,
   type RpcRefusal,
 } from "./utils/rpcRefusal";

package/src/profile/components/SidLoginForm.vue

@@ -120,7 +120,7 @@
 
 <script setup lang="ts">
 import { computed, ref } from "vue";
-import type { SessionId } from "@structured-id/ids";
+import type { LoginSuccessResult } from "../composables/useLoginSuccess";
 import {
   ALL_PRINCIPAL_TYPES,
   DEFAULT_PRINCIPAL_INPUT_TEXTS,
@@ -175,10 +175,7 @@ const props = withDefaults(
       identifier: string,
       password: string,
       onStep?: (step: number) => void,
-    ) => Promise<{
-      expiresIn: number;
-      sessionId?: SessionId;
-    }>;
+    ) => Promise<LoginSuccessResult & { expiresIn: number }>;
   }>(),
   {
     title: "Sign in",
@@ -207,7 +204,7 @@ const props = withDefaults(
 );
 
 const emit = defineEmits<{
-  success: [result: { expiresIn: number; sessionId?: SessionId }];
+  success: [result: LoginSuccessResult & { expiresIn: number }];
   error: [error: Error];
   "forgot-password": [];
 }>();

package/src/profile/composables/useAuth.test.ts

@@ -7,6 +7,7 @@ import {
   type PasswordOperationProgress,
   WrongCurrentPasswordError,
 } from "./useAuth";
+import { SignInRefusedError } from "../../utils/rpcRefusal";
 
 // Mock the gRPC wrappers
 vi.mock("./useAuthApi", () => ({
@@ -132,6 +133,7 @@ describe("createAuth prewarm", () => {
       expiresIn: 60n,
       secondFactors: [],
       enrollableFactors: [],
+      pending: null,
     });
   });
 
@@ -693,6 +695,7 @@ describe("createAuth login", () => {
       expiresIn: BigInt(3600),
       secondFactors: [],
       enrollableFactors: [],
+      pending: null,
     });
   });
 
@@ -725,17 +728,46 @@ describe("createAuth login", () => {
     expect(result).toEqual({
       sessionId: SESSION,
       expiresIn: 3600,
+      pending: null,
     });
   });
 
-  it("propagates a wrong password (the client cannot finish)", async () => {
-    vi.mocked(client.loginFinish).mockRejectedValue(
-      new Error("login finish: InvalidLoginError"),
-    );
+  // A sign-in owing its second factor states it, for the page to continue
+  // to the factor instead of into the app.
+  it("states the second factor the sign-in owes", async () => {
+    const pending = { secondFactors: [1], enrollableFactors: [] };
+    api.loginFinish.mockResolvedValue({
+      sessionId: SESSION,
+      expiresIn: BigInt(300),
+      secondFactors: [1],
+      enrollableFactors: [],
+      pending,
+    });
     const { login } = createAuth(loader);
-    await expect(login("alice@test.com", "wrong")).rejects.toThrow(
-      "InvalidLoginError",
-    );
+    const result = await login("alice@test.com", "pw");
+    expect(result.pending).toEqual(pending);
+  });
+
+  // A wrong password showed the client's own "invalid login" to the user; it
+  // is the sign-in's refusal, and nothing more is sent.
+  it("reports a wrong password as a refused sign-in", async () => {
+    const refused = new Error("invalid login");
+    refused.name = "ZkppInvalidLoginError";
+    vi.mocked(client.loginFinish).mockRejectedValue(refused);
+    const { login } = createAuth(loader);
+    const failure = await login("alice@test.com", "wrong").catch((e) => e);
+    expect(failure).toBeInstanceOf(SignInRefusedError);
+    expect((failure as SignInRefusedError).cause).toBe(refused);
+    expect(api.loginFinish).not.toHaveBeenCalled();
+  });
+
+  // Only the client's refusal judged the password: a malformed response or
+  // another fault comes through as itself.
+  it("reports a sign-in failure other than a refusal as itself", async () => {
+    const fault = new Error("response: invalid length");
+    vi.mocked(client.loginFinish).mockRejectedValue(fault);
+    const { login } = createAuth(loader);
+    await expect(login("alice@test.com", "pw")).rejects.toBe(fault);
     expect(api.loginFinish).not.toHaveBeenCalled();
   });
 });

package/src/profile/composables/useAuth.ts

@@ -15,6 +15,8 @@
  * gRPC calls go through useAuthApi wrappers.
  */
 import type { CredentialId, SessionId } from "@structured-id/ids";
+import type { PendingSignIn } from "../pendingSignIn";
+import { SignInRefusedError } from "../../utils/rpcRefusal";
 import {
   completePasswordReset,
   evaluatePasswordHistory,
@@ -42,6 +44,8 @@ export interface LoginResult {
   sessionId: SessionId;
   /** Seconds until the delivered credential expires. */
   expiresIn: number;
+  /** The second factor the sign-in still owes; null when it is complete. */
+  pending: PendingSignIn | null;
 }
 
 /**
@@ -530,12 +534,20 @@ export function createAuth(loadClient: ZkppClientLoader) {
     const started = await opaqueLoginStart(identifier, start.request);
     onStep?.(3);
     // An ordinary sign-in runs under the empty context.
-    const finalization = await c.loginFinish(
-      password,
-      start.state,
-      started.credentialResponse,
-      new Uint8Array(),
-    );
+    let finalization: Uint8Array;
+    try {
+      finalization = await c.loginFinish(
+        password,
+        start.state,
+        started.credentialResponse,
+        new Uint8Array(),
+      );
+    } catch (e) {
+      // The client's refusal is the sign-in's answer; any other failure (a
+      // stopped client, a malformed response) is itself.
+      if (isRefusedSignIn(e)) throw new SignInRefusedError(e);
+      throw e;
+    }
     const finished = await opaqueLoginFinish(
       identifier,
       finalization,
@@ -544,6 +556,7 @@ export function createAuth(loadClient: ZkppClientLoader) {
     return {
       sessionId: finished.sessionId,
       expiresIn: Number(finished.expiresIn),
+      pending: finished.pending,
     };
   }
 

package/src/profile/composables/useAuthApi.ids.test.ts

@@ -143,6 +143,8 @@ describe("passkey sign-in", () => {
     answers("webAuthnAuthenticationFinish", {
       sessionId: SESSION.toWire(),
       expiresIn: 60n,
+      secondFactors: [],
+      enrollableFactors: [],
     });
     const credential = new Uint8Array([1, 2]);
     const result = await webAuthnAuthenticationFinish(credential, "a@b.c");

package/src/profile/composables/useAuthApi.opaque.test.ts

@@ -94,7 +94,12 @@ describe("OPAQUE gRPC wrappers", () => {
   describe("opaqueLoginFinish", () => {
     it("sends principal, finalization and the login's bytes, reads the session", async () => {
       mockOpaqueLoginFinish.mockResolvedValue({
-        response: { sessionId: SESSION.toWire(), expiresIn: BigInt(3600) },
+        response: {
+          sessionId: SESSION.toWire(),
+          expiresIn: BigInt(3600),
+          secondFactors: [],
+          enrollableFactors: [],
+        },
       });
 
       const result = await opaqueLoginFinish(
@@ -110,6 +115,7 @@ describe("OPAQUE gRPC wrappers", () => {
       });
       expect(result.sessionId.equals(SESSION)).toBe(true);
       expect(result.expiresIn).toBe(BigInt(3600));
+      expect(result.pending).toBeNull();
     });
 
     // Every completed sign-in names its session; an answer without one is

package/src/profile/composables/useAuthApi.pending.test.ts

@@ -0,0 +1,134 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { RpcError } from "@protobuf-ts/runtime-rpc";
+import { OpaqueLoginId, SessionId } from "@structured-id/ids";
+import {
+  StepUpMethod,
+  opaqueLoginFinish,
+  startTotpEnrollment,
+  verifyRecoveryCode,
+  verifyTotp,
+} from "./useAuthApi";
+import { endPendingSignIn, pendingSignIn } from "../pendingSignIn";
+
+// The AuthService methods by client method name, separately for the sign-in
+// surface and the account API.
+const rpc: Record<string, Record<string, ReturnType<typeof vi.fn>>> = {
+  signIn: {},
+  account: {},
+};
+
+vi.mock("../../index", () => ({
+  getTransport: vi.fn(() => "signIn"),
+  getAccountTransport: vi.fn(() => "account"),
+}));
+
+vi.mock("@structured-id/proto/sid/v1/authn/auth.client", () => ({
+  // Called with `new`: a constructor mock must be a `function`, not an arrow.
+  AuthServiceClient: vi.fn().mockImplementation(function (surface: string) {
+    const methods = rpc[surface];
+    return new Proxy(
+      {},
+      { get: (_target, name: string) => (methods[name] ??= vi.fn()) },
+    );
+  }),
+}));
+
+vi.mock("../auth", () => ({
+  authMeta: () => ({}),
+}));
+
+const SESSION = SessionId.parse("0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d10");
+const LOGIN = OpaqueLoginId.parse("0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d16");
+
+function call(surface: "signIn" | "account", name: string) {
+  return (rpc[surface][name] ??= vi.fn());
+}
+
+/** The options the RPC `name` was last called with. */
+function metaOf(surface: "signIn" | "account", name: string): unknown {
+  return call(surface, name).mock.calls.at(-1)?.[1]?.meta;
+}
+
+async function signInOwingTotp() {
+  call("signIn", "opaqueLoginFinish").mockResolvedValueOnce({
+    response: {
+      sessionId: SESSION.toWire(),
+      expiresIn: 300n,
+      secondFactors: [StepUpMethod.TOTP],
+      enrollableFactors: [],
+      browserCsrf: "csrf-1",
+    },
+  });
+  return opaqueLoginFinish("alice", new Uint8Array(), LOGIN);
+}
+
+beforeEach(() => {
+  endPendingSignIn();
+  sessionStorage.clear();
+  for (const surface of Object.values(rpc)) {
+    for (const fn of Object.values(surface)) fn.mockReset();
+  }
+});
+
+describe("a browser sign-in owing its second factor", () => {
+  // Regression: the answer's factors and CSRF token were dropped, so the
+  // completion went without the token and the server refused it.
+  it("is kept from the password sign-in's answer", async () => {
+    const finished = await signInOwingTotp();
+    expect(finished.pending).toEqual({
+      secondFactors: [StepUpMethod.TOTP],
+      enrollableFactors: [],
+    });
+    expect(pendingSignIn()).toEqual(finished.pending);
+  });
+
+  it("sends its CSRF token with the completion and ends with the session", async () => {
+    await signInOwingTotp();
+    call("signIn", "verifyTotp").mockResolvedValueOnce({
+      response: { verified: true, sessionId: SESSION.toWire() },
+    });
+
+    await verifyTotp("123456");
+
+    expect(metaOf("signIn", "verifyTotp")).toEqual({
+      "x-csrf-token": "csrf-1",
+    });
+    expect(pendingSignIn()).toBeNull();
+  });
+
+  // An unknown outcome may have committed: the record stays, so the same
+  // completion is repeated with the same token and receives the sign-in.
+  it("keeps the record when the completion's outcome is unknown", async () => {
+    await signInOwingTotp();
+    call("signIn", "verifyRecoveryCode").mockRejectedValueOnce(
+      new RpcError("lost", "UNAVAILABLE"),
+    );
+
+    await expect(verifyRecoveryCode("AAAA-BBBB-CCCC")).rejects.toThrow();
+
+    expect(pendingSignIn()).not.toBeNull();
+    expect(metaOf("signIn", "verifyRecoveryCode")).toEqual({
+      "x-csrf-token": "csrf-1",
+    });
+  });
+
+  // The first TOTP enrollment of a sign-in goes to the sign-in surface with
+  // the pending token; from the account pages it stays on the account API.
+  it("enrolls its first factor on the sign-in surface", async () => {
+    await signInOwingTotp();
+    call("signIn", "startTotpEnrollment").mockResolvedValueOnce({
+      response: {},
+    });
+    call("account", "startTotpEnrollment").mockResolvedValueOnce({
+      response: {},
+    });
+
+    await startTotpEnrollment("sign-in");
+    await startTotpEnrollment();
+
+    expect(metaOf("signIn", "startTotpEnrollment")).toEqual({
+      "x-csrf-token": "csrf-1",
+    });
+    expect(metaOf("account", "startTotpEnrollment")).toEqual({});
+  });
+});

package/src/profile/composables/useAuthApi.ts

@@ -17,6 +17,7 @@ import {
   CredentialId,
   MagicLinkId,
   OpaqueLoginId,
+  OrgId,
   OtpSessionId,
   ResetSessionId,
   SessionId,
@@ -75,6 +76,12 @@ import type {
 } from "@structured-id/proto/sid/v1/authn/password_history";
 import { PasswordHistoryEvaluatorServiceClient } from "@structured-id/proto/sid/v1/authn/password_history.client";
 import { authMeta } from "../auth";
+import {
+  endPendingSignIn,
+  holdPendingSignIn,
+  pendingSignInMeta,
+  type PendingSignIn,
+} from "../pendingSignIn";
 
 /** The history evaluator: in CE served beside the credential service. */
 function evaluator(): PasswordHistoryEvaluatorServiceClient {
@@ -105,11 +112,26 @@ export type WithId<T, K extends keyof T, V> = Omit<T, K> & { [P in K]: V };
 
 // ── MFA TOTP ──
 
-export async function startTotpEnrollment(): Promise<TotpEnrollmentChallenge> {
-  const { response } = await account().startTotpEnrollment(
-    {},
-    { meta: authMeta() },
-  );
+/**
+ * Who enrolls a factor: the signed-in user from the account pages, or the
+ * pending sign-in enrolling its first factor on the sign-in surface.
+ */
+export type Enrolling = "account" | "sign-in";
+
+function enrollmentClient(by: Enrolling): {
+  client: AuthServiceClient;
+  meta: Record<string, string>;
+} {
+  return by === "sign-in"
+    ? { client: client(), meta: signInMeta() }
+    : { client: account(), meta: authMeta() };
+}
+
+export async function startTotpEnrollment(
+  by: Enrolling = "account",
+): Promise<TotpEnrollmentChallenge> {
+  const { client: enroller, meta } = enrollmentClient(by);
+  const { response } = await enroller.startTotpEnrollment({}, { meta });
   return response;
 }
 
@@ -119,13 +141,16 @@ export type TotpEnrollmentResult = WithId<
   CredentialId
 >;
 
+/**
+ * Finish the TOTP enrollment with its first code. A sign-in that enrolled
+ * its first factor then completes with a fresh code ({@link verifyTotp}).
+ */
 export async function finishTotpEnrollment(
   code: string,
+  by: Enrolling = "account",
 ): Promise<TotpEnrollmentResult> {
-  const { response } = await account().finishTotpEnrollment(
-    { code },
-    { meta: authMeta() },
-  );
+  const { client: enroller, meta } = enrollmentClient(by);
+  const { response } = await enroller.finishTotpEnrollment({ code }, { meta });
   return {
     ...response,
     credentialId: required(CredentialId, response.credentialId),
@@ -139,14 +164,26 @@ export type MfaVerifyResult = WithId<
   SessionId | undefined
 >;
 
+/**
+ * A verification's answer. The session it names ends the pending sign-in
+ * the verification completed; any failure keeps it, so the same completion
+ * can be repeated.
+ */
 function mfaVerified(response: MfaVerifyResponse): MfaVerifyResult {
-  return { ...response, sessionId: optional(SessionId, response.sessionId) };
+  const sessionId = optional(SessionId, response.sessionId);
+  if (sessionId) endPendingSignIn();
+  return { ...response, sessionId };
+}
+
+/** Metadata of a call that completes the pending sign-in, if this tab has one. */
+function signInMeta(): Record<string, string> {
+  return { ...authMeta(), ...pendingSignInMeta() };
 }
 
 export async function verifyTotp(code: string): Promise<MfaVerifyResult> {
   const { response } = await client().verifyTotp(
     { code },
-    { meta: authMeta() },
+    { meta: signInMeta() },
   );
   return mfaVerified(response);
 }
@@ -156,13 +193,13 @@ export async function verifyTotp(code: string): Promise<MfaVerifyResult> {
 export async function verifySmsMfa(code: string): Promise<MfaVerifyResult> {
   const { response } = await client().verifySmsMfa(
     { code },
-    { meta: authMeta() },
+    { meta: signInMeta() },
   );
   return mfaVerified(response);
 }
 
 export async function resendSmsMfa(): Promise<ResendSmsMfaResponse> {
-  const { response } = await client().resendSmsMfa({}, { meta: authMeta() });
+  const { response } = await client().resendSmsMfa({}, { meta: signInMeta() });
   return response;
 }
 
@@ -181,7 +218,7 @@ export async function verifyRecoveryCode(
 ): Promise<MfaVerifyResult> {
   const { response } = await client().verifyRecoveryCode(
     { code },
-    { meta: authMeta() },
+    { meta: signInMeta() },
   );
   return mfaVerified(response);
 }
@@ -264,11 +301,12 @@ export type PasskeySignInResult = WithId<
   WebAuthnAuthenticationFinishResponse,
   "sessionId",
   SessionId
->;
+> & { pending: PendingSignIn | null };
 
 /**
  * Finish a passkey sign-in with the assertion; the server finds the ceremony
- * by the challenge the assertion signs.
+ * by the challenge the assertion signs. `pending` is the second factor the
+ * sign-in still owes, kept for its completion.
  */
 export async function webAuthnAuthenticationFinish(
   credential: Uint8Array,
@@ -278,7 +316,11 @@ export async function webAuthnAuthenticationFinish(
     { credential, principal: principal ?? "" },
     { meta: authMeta() },
   );
-  return { ...response, sessionId: required(SessionId, response.sessionId) };
+  return {
+    ...response,
+    sessionId: required(SessionId, response.sessionId),
+    pending: holdPendingSignIn(response),
+  };
 }
 
 export async function webAuthnRegistrationStart(
@@ -425,19 +467,26 @@ export async function confirmIdpLink(
 
 // ── Organization Selector ──
 
-export async function listUserOrganizations(): Promise<ListUserOrganizationsResponse> {
+/** An organization the sign-in may continue in, named by its typed id. */
+export type UserOrganizationRef = WithId<UserOrganization, "id", OrgId>;
+
+/** The organizations the signed-in user may continue in. */
+export async function listUserOrganizations(): Promise<UserOrganizationRef[]> {
   const { response } = await client().listUserOrganizations(
     {},
     { meta: authMeta() },
   );
-  return response;
+  return response.organizations.map((organization) => ({
+    ...organization,
+    id: required(OrgId, organization.id),
+  }));
 }
 
 export async function selectOrganization(
-  organizationId: string,
+  organizationId: OrgId,
 ): Promise<SelectOrganizationResponse> {
   const { response } = await client().selectOrganization(
-    { organizationId },
+    { organizationId: organizationId.toWire() },
     { meta: authMeta() },
   );
   return response;
@@ -848,9 +897,13 @@ export type LoginFinishResult = WithId<
   OpaqueLoginFinishResponse,
   "sessionId",
   SessionId
->;
+> & { pending: PendingSignIn | null };
 
-/** Finish the login `loginId` (from its start) with the client's KE3. */
+/**
+ * Finish the login `loginId` (from its start) with the client's KE3.
+ * `pending` is the second factor the sign-in still owes, kept for its
+ * completion.
+ */
 export async function opaqueLoginFinish(
   principal: string,
   credentialFinalization: Uint8Array,
@@ -861,7 +914,11 @@ export async function opaqueLoginFinish(
     credentialFinalization,
     loginId: loginId.toWire(),
   });
-  return { ...response, sessionId: required(SessionId, response.sessionId) };
+  return {
+    ...response,
+    sessionId: required(SessionId, response.sessionId),
+    pending: holdPendingSignIn(response),
+  };
 }
 
 // Re-export types for convenience

package/src/profile/composables/useLoginSuccess.test.ts

@@ -2,7 +2,12 @@ import { describe, it, expect, vi, beforeEach } from "vitest";
 import { setActivePinia, createPinia } from "pinia";
 import { createApp, defineComponent } from "vue";
 import { createRouter, createMemoryHistory } from "vue-router";
-import { authorizationContinuation, useLoginSuccess } from "./useLoginSuccess";
+import { StepUpMethod } from "@structured-id/proto/sid/v1/authn/auth";
+import {
+  SECOND_FACTOR_PATH,
+  authorizationContinuation,
+  useLoginSuccess,
+} from "./useLoginSuccess";
 import { useAuthStore } from "../../stores/auth";
 
 // Mock checkBffSession from BFF composable
@@ -26,6 +31,7 @@ async function withApp<T>(
       { path: "/login", component: { template: "<div />" } },
       { path: "/account", component: { template: "<div />" } },
       { path: "/admin", component: { template: "<div />" } },
+      { path: SECOND_FACTOR_PATH, component: { template: "<div />" } },
     ],
   });
   await router.push(at);
@@ -190,6 +196,27 @@ describe("useLoginSuccess (BFF cookie mode)", () => {
     expect(router.currentRoute.value.path).toBe("/account");
   });
 
+  // Regression: a sign-in that still owes its second factor went into the
+  // app (or back to the authorization request) as if signed in. It goes to
+  // the second-factor page instead, carrying the request it waits for, and
+  // reads no app session.
+  it("continues a sign-in owing its second factor to the factor's page", async () => {
+    const leaveTo = vi.fn();
+    const { result, router } = await withApp(
+      () => useLoginSuccess("/account", { issuerOrigin: ISSUER, leaveTo }),
+      `/login?rd=${encodeURIComponent(CONTINUATION)}`,
+    );
+
+    await result.onLoginSuccess({
+      pending: { secondFactors: [StepUpMethod.TOTP], enrollableFactors: [] },
+    });
+
+    expect(router.currentRoute.value.path).toBe(SECOND_FACTOR_PATH);
+    expect(router.currentRoute.value.query.rd).toBe(CONTINUATION);
+    expect(leaveTo).not.toHaveBeenCalled();
+    expect(mockCheckBffSession).not.toHaveBeenCalled();
+  });
+
   it("navigates when BFF session returns null (cookie not yet set)", async () => {
     mockCheckBffSession.mockResolvedValue(null);
 

package/src/profile/composables/useLoginSuccess.ts

@@ -14,13 +14,24 @@ import type { SessionId } from "@structured-id/ids";
 import { useRouter } from "vue-router";
 import { useAuthStore } from "../../index";
 import { checkBffSession } from "../../index";
+import type { PendingSignIn } from "../pendingSignIn";
 
 export interface LoginSuccessResult {
   sessionId?: SessionId;
+  /** The second factor the sign-in still owes; absent or null when complete. */
+  pending?: PendingSignIn | null;
 }
 
+/**
+ * The app's page that completes a sign-in owing its second factor, reading
+ * what it owes from `pendingSignIn()`.
+ */
+export const SECOND_FACTOR_PATH = "/account/login/mfa";
+
 /** Options of {@link useLoginSuccess}. */
 export interface LoginSuccessOptions {
+  /** The app's second-factor page; {@link SECOND_FACTOR_PATH} by default. */
+  secondFactorPath?: string;
   /**
    * Origin of the SID installation whose issuers may send users to this
    * sign-in page (e.g. `https://sid.example.com`). Without it, `rd` is never
@@ -96,7 +107,17 @@ export function useLoginSuccess(
   const auth = useAuthStore();
   const router = useRouter();
 
-  async function onLoginSuccess(_result?: LoginSuccessResult) {
+  async function onLoginSuccess(result?: LoginSuccessResult) {
+    if (result?.pending) {
+      // Not signed in yet: the second factor completes the sign-in, and the
+      // authorization request it waits for goes along.
+      const rd = router.currentRoute.value.query.rd;
+      await router.push({
+        path: options.secondFactorPath ?? SECOND_FACTOR_PATH,
+        query: typeof rd === "string" ? { rd } : {},
+      });
+      return;
+    }
     const back = options.issuerOrigin
       ? authorizationContinuation(
           router.currentRoute.value.query.rd,