@structured-id/ui-core 4.3.1 → 4.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@structured-id/ui-core",
-  "version": "4.3.1",
+  "version": "4.5.0",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -42,7 +42,7 @@
     "@protobuf-ts/grpcweb-transport": "^2.11.1",
     "@protobuf-ts/runtime": "^2.11.1",
     "@protobuf-ts/runtime-rpc": "^2.11.1",
-    "@structured-id/proto": "^0.3.0",
+    "@structured-id/proto": "^0.5.0",
     "@structured-world/structured-email-address-ts": "^0.0.22",
     "@structured-world/structured-public-domains": "0.0.x",
     "libphonenumber-js": "^1.13.15"

package/src/composables/index.ts

@@ -1,11 +1,4 @@
-export {
-  useGrpc,
-  initGrpc,
-  getTransport,
-  closeTransport,
-  getTransportType,
-  type TransportType,
-} from "./useGrpc";
+export { useGrpc, initGrpc, getTransport, closeTransport } from "./useGrpc";
 export {
   initAccountApi,
   getAccountTransport,

package/src/composables/useAccountTransport.test.ts

@@ -1,8 +1,9 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import type {
-  MethodInfo,
-  RpcInterceptor,
-  RpcOptions,
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  RpcError,
+  type MethodInfo,
+  type RpcInterceptor,
+  type RpcOptions,
 } from "@protobuf-ts/runtime-rpc";
 
 const created: Array<{
@@ -19,6 +20,19 @@ vi.mock("@protobuf-ts/grpcweb-transport", () => ({
   }),
 }));
 
+/** What the UI host's session service answers; each test sets its calls. */
+const host = vi.hoisted(() => ({
+  getApplicationSession: vi.fn(),
+  endApplicationSession: vi.fn(),
+}));
+
+vi.mock("@structured-id/proto/sid/v1/authn/application_session.client", () => ({
+  ApplicationSessionServiceClient: class {
+    getApplicationSession = host.getApplicationSession;
+    endApplicationSession = host.endApplicationSession;
+  },
+}));
+
 import {
   initAccountApi,
   getAccountTransport,
@@ -26,9 +40,14 @@ import {
 } from "./useAccountTransport";
 import { bffLogout, checkBffSession, initBff } from "./useBffAuth";
 
+/** The account transport's options: the last transport created. */
+function account() {
+  return created[created.length - 1];
+}
+
 /** Run the transport's interceptor over a call and return the options it passed on. */
 function intercepted(options: RpcOptions): RpcOptions {
-  const [interceptor] = created[created.length - 1].interceptors ?? [];
+  const [interceptor] = account().interceptors ?? [];
   let passed: RpcOptions | undefined;
   interceptor.interceptUnary!(
     (_method, _input, opts) => {
@@ -42,68 +61,57 @@ function intercepted(options: RpcOptions): RpcOptions {
   return passed!;
 }
 
-/** The BFF's answer to the page's session check: the user with the session's token. */
-function bffSession(csrfToken: string) {
-  vi.stubGlobal(
-    "fetch",
-    vi.fn().mockResolvedValue({
-      ok: true,
-      status: 200,
-      json: async () => ({ sub: "up_1", csrf_token: csrfToken }),
-    }),
-  );
-}
-
-/** The BFF's answer without a session. */
-function noBffSession() {
-  vi.stubGlobal("fetch", vi.fn().mockResolvedValue({ ok: false, status: 401 }));
+/** The host's answer to the page's session read: a session with this token. */
+async function session(csrfToken: string) {
+  host.getApplicationSession.mockResolvedValue({
+    response: { sub: "up_1", acr: "", csrfToken },
+  });
+  await checkBffSession();
 }
 
 describe("account API transport", () => {
   beforeEach(async () => {
     created.length = 0;
+    vi.clearAllMocks();
     closeAccountTransport();
     initBff("");
-    noBffSession();
+    host.getApplicationSession.mockRejectedValue(
+      new RpcError("no session", "UNAUTHENTICATED"),
+    );
     await checkBffSession();
   });
 
-  afterEach(() => {
-    vi.unstubAllGlobals();
+  // The account API is reached only through the UI host on the page's own
+  // origin: its cookie rides along same-origin, and no other origin gets it.
+  it("goes to the UI host on the page's origin with same-origin credentials", () => {
+    initAccountApi({ baseUrl: "" });
+    expect(account().baseUrl).toBe("");
+    expect(account().fetchInit).toEqual({ credentials: "same-origin" });
   });
 
-  // The account API is reached only through the BFF on the page's own origin:
-  // its cookie rides along same-origin, and no other origin gets it.
-  it("goes to the BFF's API route with same-origin credentials", () => {
-    initAccountApi({ baseUrl: "/api" });
-    expect(created[0].baseUrl).toBe("/api");
-    expect(created[0].fetchInit).toEqual({ credentials: "same-origin" });
-  });
-
-  // Every call echoes the session's CSRF token, which the BFF hands the page
-  // with the session check: the BFF refuses a call without it, which is what
+  // Every call echoes the session's CSRF token, which the host hands the page
+  // with the session read: the host refuses a call without it, which is what
   // stops a foreign page driving the account API.
-  it("sends the CSRF token the BFF gave with the session on every call", async () => {
-    initAccountApi({ baseUrl: "/api" });
-    bffSession("token-1");
-    await checkBffSession();
+  it("sends the session's CSRF token on every call", async () => {
+    initAccountApi({ baseUrl: "" });
+    await session("token-1");
     const options = intercepted({ meta: { other: "kept" } });
     expect(options.meta).toEqual({ other: "kept", "x-csrf-token": "token-1" });
   });
 
-  // No session, no header: the call goes out and the BFF answers it (401 or
-  // 403), rather than the page inventing a token.
+  // No session, no header: the call goes out and the host answers it, rather
+  // than the page inventing a token.
   it("sends no CSRF header without a session", () => {
-    initAccountApi({ baseUrl: "/api" });
+    initAccountApi({ baseUrl: "" });
     const options = intercepted({ meta: {} });
     expect(options.meta).toEqual({});
   });
 
   // Sign-out ends the session; its token goes with it.
   it("forgets the token at sign-out", async () => {
-    initAccountApi({ baseUrl: "/api" });
-    bffSession("token-1");
-    await checkBffSession();
+    initAccountApi({ baseUrl: "" });
+    await session("token-1");
+    host.endApplicationSession.mockResolvedValue({ response: { grant: 1 } });
     await bffLogout();
     const options = intercepted({ meta: {} });
     expect(options.meta).toEqual({});
@@ -116,7 +124,7 @@ describe("account API transport", () => {
   });
 
   it("is the one set up", () => {
-    initAccountApi({ baseUrl: "/api" });
+    initAccountApi({ baseUrl: "" });
     expect(getAccountTransport()).toEqual({ type: "grpc-web-transport" });
   });
 });

package/src/composables/useAccountTransport.ts

@@ -1,8 +1,8 @@
 /**
- * The account API transport: gRPC-Web through the BFF (sid-auth-proxy) on the
- * page's own origin. The BFF holds the session's tokens and adds the Bearer
- * token itself; the page sends only its session cookie and, on every call,
- * the CSRF token the BFF set (double submit).
+ * The account API transport: gRPC-Web through the application's UI host on
+ * the page's own origin. The host holds the session's tokens and adds the
+ * Bearer token itself; the page sends only its session cookie and, on every
+ * call, the session's CSRF token.
  *
  * Sign-in ceremonies are not account API calls: they go to SID's own sign-in
  * surface through `getTransport()`, where the IdP's session lives.
@@ -13,7 +13,7 @@ import { bffCsrfToken } from "./useBffAuth";
 
 /** Where the account API is reached. */
 export interface AccountApiConfig {
-  /** The BFF's API route, usually `/api` on the page's own origin. */
+  /** The UI host's base URL: "" for the page's own origin, where it usually is. */
   baseUrl: string;
 }
 

package/src/composables/useBffAuth.test.ts

@@ -1,4 +1,20 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { RpcError } from "@protobuf-ts/runtime-rpc";
+import { GrantOutcome } from "@structured-id/proto/sid/v1/authn/application_session";
+
+/** What the UI host's session service answers; each test sets its calls. */
+const host = vi.hoisted(() => ({
+  getApplicationSession: vi.fn(),
+  endApplicationSession: vi.fn(),
+}));
+
+vi.mock("@structured-id/proto/sid/v1/authn/application_session.client", () => ({
+  ApplicationSessionServiceClient: class {
+    getApplicationSession = host.getApplicationSession;
+    endApplicationSession = host.endApplicationSession;
+  },
+}));
+
 import {
   bffCsrfToken,
   bffLogout,
@@ -6,90 +22,125 @@ import {
   initBff,
 } from "./useBffAuth";
 
-/** A BFF that answers every request with this response. */
-function bffAnswers(response: unknown) {
-  const fetchMock = vi.fn().mockResolvedValue(response);
-  vi.stubGlobal("fetch", fetchMock);
-  return fetchMock;
+/** A unary call that answers `response`. */
+function answers(response: unknown) {
+  return Promise.resolve({ response });
 }
 
-/** The BFF's sign-out answer: the session ended, with this grant outcome. */
-function ended(grant: string) {
-  return { ok: true, status: 200, json: async () => ({ grant }) };
+/** A unary call refused with gRPC status `code`. */
+function refused(code: string) {
+  return Promise.reject(new RpcError("refused", code));
 }
 
-describe("bffLogout", () => {
-  beforeEach(async () => {
+/** A live session with CSRF token `token-1`. */
+const LIVE = {
+  sub: "0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d9e",
+  email: "user@sid.example.com",
+  acr: "urn:sid:acr:basic",
+  csrfToken: "token-1",
+};
+
+describe("checkBffSession", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
     initBff("");
-    bffAnswers({
-      ok: true,
-      status: 200,
-      json: async () => ({ sub: "s", csrf_token: "token-1" }),
+  });
+
+  // The page shows the signed-in user and keeps the session's CSRF token for
+  // the state-changing calls that follow.
+  it("reads the live session and keeps its CSRF token", async () => {
+    host.getApplicationSession.mockReturnValue(answers(LIVE));
+    await expect(checkBffSession()).resolves.toEqual({
+      sub: LIVE.sub,
+      email: LIVE.email,
+      name: null,
+      preferred_username: null,
+      acr: LIVE.acr,
+      csrf_token: "token-1",
     });
+    expect(bffCsrfToken()).toBe("token-1");
+  });
+
+  // No session is a signed-out page, and no token is kept from before.
+  it("reports a signed-out page as null and forgets the token", async () => {
+    host.getApplicationSession.mockReturnValue(answers(LIVE));
     await checkBffSession();
+    host.getApplicationSession.mockReturnValue(refused("UNAUTHENTICATED"));
+    await expect(checkBffSession()).resolves.toBeNull();
+    expect(bffCsrfToken()).toBeNull();
   });
 
-  afterEach(() => {
-    vi.unstubAllGlobals();
+  // An outage must not send a signed-in user to sign-in again.
+  it.each(["UNAVAILABLE", "INTERNAL"])(
+    "throws on %s instead of reporting a signed-out page",
+    async (code) => {
+      host.getApplicationSession.mockReturnValue(refused(code));
+      await expect(checkBffSession()).rejects.toBeInstanceOf(RpcError);
+    },
+  );
+
+  it("reports nothing before the session is set up", async () => {
+    vi.resetModules();
+    const fresh = await import("./useBffAuth");
+    await expect(fresh.checkBffSession()).resolves.toBeNull();
+    expect(host.getApplicationSession).not.toHaveBeenCalled();
+  });
+});
+
+describe("bffLogout", () => {
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    initBff("");
+    host.getApplicationSession.mockReturnValue(answers(LIVE));
+    await checkBffSession();
   });
 
   // The page tells a local end of its session from one where the issuer also
   // revoked the grant, so it can say which happened.
-  it.each(["revoked", "not_revoked", "none"] as const)(
+  it.each([
+    [GrantOutcome.REVOKED, "revoked"],
+    [GrantOutcome.NOT_REVOKED, "not_revoked"],
+    [GrantOutcome.NONE, "none"],
+    [GrantOutcome.UNKNOWN, "unknown"],
+  ] as const)(
     "reports the ended session with grant %s",
-    async (grant) => {
-      const fetchMock = bffAnswers(ended(grant));
-      await expect(bffLogout()).resolves.toEqual({ ended: true, grant });
-      expect(fetchMock).toHaveBeenCalledWith("/auth/logout", {
-        method: "POST",
-        credentials: "include",
-        headers: { "X-CSRF-Token": "token-1" },
-      });
+    async (grant, name) => {
+      host.endApplicationSession.mockReturnValue(answers({ grant }));
+      await expect(bffLogout()).resolves.toEqual({ ended: true, grant: name });
+      expect(host.endApplicationSession).toHaveBeenCalledWith(
+        {},
+        { meta: { "x-csrf-token": "token-1" } },
+      );
     },
   );
 
-  // A refused or failed sign-out leaves the BFF session alive: the page must
-  // not report it as ended.
-  it.each([
-    ["refused", { ok: false, status: 403 }],
-    ["unavailable", { ok: false, status: 503 }],
-  ])("reports a %s sign-out as not ended", async (_name, response) => {
-    bffAnswers(response);
-    await expect(bffLogout()).resolves.toEqual({ ended: false });
-  });
+  // A refused or failed sign-out leaves the session alive: the page must not
+  // report it as ended.
+  it.each(["PERMISSION_DENIED", "UNAVAILABLE", "UNAUTHENTICATED"])(
+    "reports a sign-out refused with %s as not ended",
+    async (code) => {
+      host.endApplicationSession.mockReturnValue(refused(code));
+      await expect(bffLogout()).resolves.toEqual({ ended: false });
+    },
+  );
 
-  it("reports an unreachable BFF as not ended", async () => {
-    vi.stubGlobal("fetch", vi.fn().mockRejectedValue(new TypeError("offline")));
+  it("reports an unreachable host as not ended", async () => {
+    host.endApplicationSession.mockReturnValue(
+      Promise.reject(new TypeError("offline")),
+    );
     await expect(bffLogout()).resolves.toEqual({ ended: false });
   });
 
-  // An answer the page cannot read still came after the BFF ended the
-  // session; only the grant's fate is unknown.
-  it("reports an unreadable answer as ended with an unknown grant", async () => {
-    bffAnswers({
-      ok: true,
-      status: 200,
-      json: async () => {
-        throw new SyntaxError("not json");
-      },
-    });
-    await expect(bffLogout()).resolves.toEqual({
-      ended: true,
-      grant: "unknown",
-    });
-  });
-
-  it("reports nothing ended before the BFF is set up", async () => {
+  it("reports nothing ended before the session is set up", async () => {
     vi.resetModules();
     const fresh = await import("./useBffAuth");
-    const fetchMock = bffAnswers(ended("revoked"));
     await expect(fresh.bffLogout()).resolves.toEqual({ ended: false });
-    expect(fetchMock).not.toHaveBeenCalled();
+    expect(host.endApplicationSession).not.toHaveBeenCalled();
   });
 
-  // Whatever the BFF answers, the page forgets the session's token.
+  // Whatever the host answers, the page forgets the session's token.
   it("forgets the CSRF token even when the sign-out failed", async () => {
-    bffAnswers({ ok: false, status: 503 });
+    host.endApplicationSession.mockReturnValue(refused("UNAVAILABLE"));
     await bffLogout();
     expect(bffCsrfToken()).toBeNull();
   });

package/src/composables/useBffAuth.ts

@@ -1,107 +1,126 @@
 /**
- * BFF (Backend-For-Frontend) session management composable.
+ * The page's application session.
  *
- * The tokens live in sid-auth-proxy's BFF session; the page holds only the
- * BFF's httpOnly session cookie. gRPC calls go through the BFF, which adds
- * the Bearer token itself, so the page never sees an access token. The
- * session's CSRF token comes with the session check and every state-changing
- * call echoes it in `X-CSRF-Token`.
+ * The tokens live in the application's UI host; the page holds only the
+ * host's httpOnly session cookie. The page reads its session and signs out
+ * through `sid.v1.authn.ApplicationSessionService` over gRPC-Web on its own
+ * origin, so the cookie travels with the same-origin request. The session's
+ * CSRF token comes with the session read and every state-changing call echoes
+ * it in `x-csrf-token`.
  *
  * Usage:
- *   1. Call `initBff(bffBaseUrl)` at app boot
- *   2. Call `checkBffSession()` to verify the session + populate the auth store
- *   3. Call `startBffLogin()` to redirect the user to the PKCE auth flow
- *   4. Call `bffLogout()` to clear the session
+ *   1. Call `initBff(baseUrl)` at app boot ("" for the page's own origin)
+ *   2. Call `checkBffSession()` to read the session and populate the auth store
+ *   3. Call `startBffLogin()` to send the browser to sign-in
+ *   4. Call `bffLogout()` to end the session
  */
+import { GrpcWebFetchTransport } from "@protobuf-ts/grpcweb-transport";
+import { RpcError, type RpcTransport } from "@protobuf-ts/runtime-rpc";
+import { ApplicationSessionServiceClient } from "@structured-id/proto/sid/v1/authn/application_session.client";
+import { GrantOutcome } from "@structured-id/proto/sid/v1/authn/application_session";
 
-/** User info returned from BFF /auth/userinfo endpoint. */
+/** The signed-in user of the page's session. */
 export interface BffUserInfo {
   /** Opaque subject identifier; its form depends on the issuer, so it is never parsed as a profile id. */
   sub: string;
-  /** Email address (if available in session claims). */
+  /** Email address, when disclosed to this application. */
   email?: string | null;
-  /** Display name (full name from profile). */
+  /** Display name, when disclosed. */
   name?: string | null;
-  /** Username or email — preferred identifier for display. */
+  /** Username, when disclosed. */
   preferred_username?: string | null;
-  /** Group memberships. */
-  groups?: string[] | null;
-  /** Authentication Context Class Reference (acr_values). */
+  /** Authentication Context Class Reference of the sign-in. */
   acr?: string | null;
-  /** Role assignments. */
-  roles?: string[] | null;
-  /** The session's CSRF token, echoed in `X-CSRF-Token` by every state-changing call. */
+  /** The session's CSRF token, echoed in `x-csrf-token` by every state-changing call. */
   csrf_token?: string | null;
 }
 
 let _bffBaseUrl: string | null = null;
+let _session: ApplicationSessionServiceClient | null = null;
 /**
- * The CSRF token of the session the page last checked. Browser-only state:
- * the session check runs in the browser, never during server rendering.
+ * The CSRF token of the session the page last read. Browser-only state:
+ * the session read runs in the browser, never during server rendering.
  */
 let _csrfToken: string | null = null;
 
+/** The session service at `baseUrl`; the cookie never travels to another origin. */
+function sessionClient(baseUrl: string): ApplicationSessionServiceClient {
+  const transport: RpcTransport = new GrpcWebFetchTransport({
+    baseUrl,
+    fetchInit: { credentials: "same-origin" },
+  });
+  return new ApplicationSessionServiceClient(transport);
+}
+
 /**
- * Initialize BFF configuration. Call once at app boot.
+ * Initialize the session's UI host. Call once at app boot.
  *
- * @param baseUrl  BFF base URL: "" for the page's own origin, where the BFF usually is
+ * @param baseUrl  The UI host's base URL: "" for the page's own origin, where it usually is
  */
 export function initBff(baseUrl: string): void {
   _bffBaseUrl = baseUrl;
+  _session = sessionClient(baseUrl);
 }
 
-/** Get the configured BFF base URL, or null if not initialized. */
+/** Get the configured base URL, or null if not initialized. */
 export function getBffBaseUrl(): string | null {
   return _bffBaseUrl;
 }
 
 /**
- * The CSRF token the BFF gave with the session check, or null without a
- * checked session. The BFF refuses a state-changing call without it.
+ * The CSRF token the UI host gave with the session read, or null without a
+ * read session. The host refuses a state-changing call without it.
  */
 export function bffCsrfToken(): string | null {
   return _csrfToken;
 }
 
 /**
- * Check if the BFF session is valid by calling GET /auth/userinfo.
+ * Read the page's session with `GetApplicationSession`.
  *
- * Returns user info if session is active, null if unauthenticated, and
- * keeps the session's CSRF token for the calls that follow.
- * The browser automatically sends the httpOnly session cookie.
- * An empty base URL is the page's own origin, where the BFF usually is.
+ * Returns the user when the session is live and keeps its CSRF token for
+ * the calls that follow; null when the page is signed out (UNAUTHENTICATED)
+ * or the session was not set up. Any other failure (an unavailable session
+ * store, an unreachable host) is thrown: an outage never reads as a
+ * signed-out user.
  */
 export async function checkBffSession(
   bffBaseUrl?: string,
 ): Promise<BffUserInfo | null> {
-  const base = bffBaseUrl ?? _bffBaseUrl;
-  if (base === null) return null;
+  const client =
+    bffBaseUrl !== undefined ? sessionClient(bffBaseUrl) : _session;
+  if (client === null) return null;
   try {
-    const resp = await fetch(`${base}/auth/userinfo`, {
-      credentials: "include",
-    });
-    if (!resp.ok) {
+    const { response } = await client.getApplicationSession({});
+    _csrfToken = response.csrfToken || null;
+    return {
+      sub: response.sub,
+      email: response.email ?? null,
+      name: response.name ?? null,
+      preferred_username: response.preferredUsername ?? null,
+      acr: response.acr || null,
+      csrf_token: _csrfToken,
+    };
+  } catch (err) {
+    if (err instanceof RpcError && err.code === "UNAUTHENTICATED") {
       _csrfToken = null;
       return null;
     }
-    const info = (await resp.json()) as BffUserInfo;
-    _csrfToken = info.csrf_token ?? null;
-    return info;
-  } catch {
-    return null;
+    throw err;
   }
 }
 
 /**
- * Redirect user to BFF login (PKCE flow initiation).
+ * Send the browser to sign-in (`StartSignIn`, a navigation to
+ * `/auth/login`).
  *
- * After successful login, BFF sets httpOnly session cookie and redirects
- * back to the SPA. The SPA should call checkBffSession() on load to restore state.
+ * After sign-in the UI host sets its httpOnly session cookie and returns to
+ * the page, which calls `checkBffSession()` on load.
  *
- * @param bffBaseUrl  Override BFF base URL (uses configured URL if not provided)
- * @param postLoginRedirect  Path on the BFF's origin to return to after
- *   sign-in (`/account/security?tab=keys`), sent as the BFF's `rd`
- *   parameter; the BFF returns anything else to its root
+ * @param bffBaseUrl  Override the base URL (uses the configured one if not provided)
+ * @param postLoginRedirect  Local path to return to after sign-in
+ *   (`/account/security?tab=keys`), sent as `rd`; the host returns anything
+ *   else to its root
  */
 export function startBffLogin(
   bffBaseUrl?: string,
@@ -109,7 +128,7 @@ export function startBffLogin(
 ): void {
   const base = bffBaseUrl ?? _bffBaseUrl;
   if (base === null) {
-    console.warn("[BFF] Not initialized. Call initBff() at app boot.");
+    console.warn("[session] Not initialized. Call initBff() at app boot.");
     return;
   }
   const url = postLoginRedirect
@@ -119,59 +138,53 @@ export function startBffLogin(
 }
 
 /**
- * What became of the grant behind an ended BFF session: revoked by the
- * issuer, left to expire because the issuer did not revoke it, none held,
- * or unknown when the BFF's answer could not be read.
+ * What became of the grant behind an ended session: revoked by the issuer,
+ * left to expire because the issuer did not revoke it, none held, or
+ * unknown.
  */
 export type BffGrantOutcome = "revoked" | "not_revoked" | "none" | "unknown";
 
-/** The outcome of a sign-out: whether the BFF ended the session, and its grant. */
+/** The outcome of a sign-out: whether the session ended, and its grant. */
 export type BffLogoutResult =
   { ended: true; grant: BffGrantOutcome } | { ended: false };
 
-const GRANT_OUTCOMES: readonly BffGrantOutcome[] = [
-  "revoked",
-  "not_revoked",
-  "none",
-];
+const GRANT_OUTCOMES: Readonly<Partial<Record<GrantOutcome, BffGrantOutcome>>> =
+  {
+    [GrantOutcome.REVOKED]: "revoked",
+    [GrantOutcome.NOT_REVOKED]: "not_revoked",
+    [GrantOutcome.NONE]: "none",
+  };
 
 /**
- * Log out by calling POST /auth/logout with X-CSRF-Token header.
+ * End the session with `EndApplicationSession`, carrying the session's CSRF
+ * token in `x-csrf-token`.
  *
- * The BFF validates the CSRF header, ends the session, clears its cookie and
- * says whether the issuer revoked the grant. `ended: false` means the
- * session may still be alive (refused, unavailable, unreachable). The page
- * forgets the CSRF token either way.
+ * The host checks the token, ends the session, clears its cookie and says
+ * whether the issuer revoked the grant. `ended: false` means the session may
+ * still be alive (refused, unavailable, unreachable). The page forgets the
+ * CSRF token either way.
  *
- * @param bffBaseUrl  Override BFF base URL
+ * @param bffBaseUrl  Override the base URL
  */
 export async function bffLogout(bffBaseUrl?: string): Promise<BffLogoutResult> {
-  const base = bffBaseUrl ?? _bffBaseUrl;
-  if (base === null) return { ended: false };
+  const client =
+    bffBaseUrl !== undefined ? sessionClient(bffBaseUrl) : _session;
+  if (client === null) return { ended: false };
   const csrf = _csrfToken;
   _csrfToken = null;
-  let resp: Response;
   try {
-    resp = await fetch(`${base}/auth/logout`, {
-      method: "POST",
-      credentials: "include",
-      headers: csrf ? { "X-CSRF-Token": csrf } : {},
-    });
+    const { response } = await client.endApplicationSession(
+      {},
+      { meta: csrf ? { "x-csrf-token": csrf } : {} },
+    );
+    return { ended: true, grant: GRANT_OUTCOMES[response.grant] ?? "unknown" };
   } catch {
     return { ended: false };
   }
-  if (!resp.ok) return { ended: false };
-  try {
-    const { grant } = (await resp.json()) as { grant?: unknown };
-    const known = GRANT_OUTCOMES.find((outcome) => outcome === grant);
-    return { ended: true, grant: known ?? "unknown" };
-  } catch {
-    return { ended: true, grant: "unknown" };
-  }
 }
 
 /**
- * Vue composable for BFF auth actions.
+ * Vue composable for the session actions.
  */
 export function useBffAuth() {
   return {

package/src/composables/useGrpc.test.ts

@@ -4,28 +4,8 @@ import { describe, it, expect, vi, beforeEach } from "vitest";
 // Mock modules BEFORE importing the module under test
 // ---------------------------------------------------------------------------
 
-const mockAdaptiveInit = vi
-  .fn<() => Promise<void>>()
-  .mockResolvedValue(undefined);
-const mockAdaptiveClose = vi.fn();
-const mockAdaptiveActiveTransport = vi
-  .fn<() => string>()
-  .mockReturnValue("grpc-web");
-
-vi.mock("@structured-id/proto/transport", () => ({
-  // Constructor mocks are `function`s: they are called with `new`.
-  AdaptiveRpcTransport: vi.fn().mockImplementation(function () {
-    return {
-      init: mockAdaptiveInit,
-      close: mockAdaptiveClose,
-      get activeTransport() {
-        return mockAdaptiveActiveTransport();
-      },
-    };
-  }),
-}));
-
 vi.mock("@protobuf-ts/grpcweb-transport", () => ({
+  // Constructor mocks are `function`s: they are called with `new`.
   GrpcWebFetchTransport: vi.fn().mockImplementation(function () {
     return { type: "grpc-web-transport" };
   }),
@@ -33,14 +13,7 @@ vi.mock("@protobuf-ts/grpcweb-transport", () => ({
 
 // Import AFTER mocks
 import { GrpcWebFetchTransport } from "@protobuf-ts/grpcweb-transport";
-import { AdaptiveRpcTransport } from "@structured-id/proto/transport";
-import {
-  initGrpc,
-  getTransport,
-  closeTransport,
-  getTransportType,
-  useGrpc,
-} from "./useGrpc";
+import { initGrpc, getTransport, closeTransport, useGrpc } from "./useGrpc";
 import type { GrpcConfig } from "../types/auth";
 
 // ---------------------------------------------------------------------------
@@ -50,11 +23,12 @@ import type { GrpcConfig } from "../types/auth";
 describe("useGrpc", () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    // Reset transport state by calling close between tests
     closeTransport();
   });
 
-  describe("initGrpc — without WebTransport URL", () => {
+  describe("initGrpc", () => {
+    // The BFF session cookie rides on every call, so credentials are always
+    // included; nothing else configures the transport.
     it("creates GrpcWebFetchTransport with baseUrl and credentials", () => {
       const config: GrpcConfig = { baseUrl: "https://api.sid.example.com" };
       initGrpc(config);
@@ -63,75 +37,6 @@ describe("useGrpc", () => {
         baseUrl: "https://api.sid.example.com",
         fetchInit: { credentials: "include" },
       });
-      expect(AdaptiveRpcTransport).not.toHaveBeenCalled();
-    });
-
-    it("getTransportType returns grpc-web", () => {
-      initGrpc({ baseUrl: "https://api.sid.example.com" });
-      expect(getTransportType()).toBe("grpc-web");
-    });
-  });
-
-  describe("initGrpc — with WebTransport URL", () => {
-    it("creates AdaptiveRpcTransport with fetchInit credentials", () => {
-      const config: GrpcConfig = {
-        baseUrl: "https://api.sid.example.com",
-        webTransportUrl: "https://wt.api.sid.example.com",
-      };
-      initGrpc(config);
-
-      expect(AdaptiveRpcTransport).toHaveBeenCalledWith(
-        expect.objectContaining({
-          grpcWebUrl: "https://api.sid.example.com",
-          webTransportUrl: "https://wt.api.sid.example.com",
-          fetchInit: { credentials: "include" },
-        }),
-      );
-      expect(GrpcWebFetchTransport).not.toHaveBeenCalled();
-    });
-
-    it("calls adaptive.init() non-blocking on creation", async () => {
-      initGrpc({
-        baseUrl: "https://api.sid.example.com",
-        webTransportUrl: "https://wt.api.sid.example.com",
-      });
-
-      // init() should be called (non-blocking fire-and-forget)
-      // Give microtasks time to run
-      await Promise.resolve();
-      expect(mockAdaptiveInit).toHaveBeenCalled();
-    });
-
-    it("passes all WebTransport options to AdaptiveRpcTransport", () => {
-      const onChange = vi.fn();
-      initGrpc({
-        baseUrl: "https://api.sid.example.com",
-        webTransportUrl: "https://wt.api.sid.example.com",
-        webTransportCertHash: "abcdef1234567890",
-        webTransportReconnectDelay: 3000,
-        onTransportChange: onChange,
-      });
-
-      expect(AdaptiveRpcTransport).toHaveBeenCalledWith(
-        expect.objectContaining({
-          grpcWebUrl: "https://api.sid.example.com",
-          webTransportUrl: "https://wt.api.sid.example.com",
-          webTransportCertHash: "abcdef1234567890",
-          reconnectDelay: 3000,
-          onTransportChange: onChange,
-          fetchInit: { credentials: "include" },
-        }),
-      );
-    });
-
-    it("getTransportType delegates to AdaptiveRpcTransport.activeTransport", () => {
-      mockAdaptiveActiveTransport.mockReturnValue("webtransport");
-      initGrpc({
-        baseUrl: "https://api.sid.example.com",
-        webTransportUrl: "https://wt.api.sid.example.com",
-      });
-
-      expect(getTransportType()).toBe("webtransport");
     });
   });
 
@@ -142,8 +47,7 @@ describe("useGrpc", () => {
 
     it("returns transport after initGrpc", () => {
       initGrpc({ baseUrl: "https://api.sid.example.com" });
-      expect(() => getTransport()).not.toThrow();
-      expect(getTransport()).toBeDefined();
+      expect(getTransport()).toEqual({ type: "grpc-web-transport" });
     });
   });
 
@@ -164,36 +68,16 @@ describe("useGrpc", () => {
       expect(typeof composable.getTransport).toBe("function");
       expect(typeof composable.initGrpc).toBe("function");
     });
-
-    it("transport.value is null after closeTransport", () => {
-      initGrpc({ baseUrl: "https://api.sid.example.com" });
-      closeTransport();
-      const { transport } = useGrpc();
-      expect(transport.value).toBeNull();
-    });
   });
 
   describe("closeTransport", () => {
-    it("calls close() on AdaptiveRpcTransport", () => {
-      initGrpc({
-        baseUrl: "https://api.sid.example.com",
-        webTransportUrl: "https://wt.api.sid.example.com",
-      });
-
-      closeTransport();
-      expect(mockAdaptiveClose).toHaveBeenCalled();
-    });
-
+    // After close, the transport is gone: a later call must initialize
+    // again rather than reuse the old one.
     it("resets transport to null (getTransport throws after close)", () => {
       initGrpc({ baseUrl: "https://api.sid.example.com" });
       closeTransport();
       expect(() => getTransport()).toThrow("gRPC transport not initialized");
-    });
-
-    it("does not call close() on plain GrpcWebFetchTransport (no close method)", () => {
-      initGrpc({ baseUrl: "https://api.sid.example.com" });
-      // Should not throw even though GrpcWebFetchTransport has no close()
-      expect(() => closeTransport()).not.toThrow();
+      expect(useGrpc().transport.value).toBeNull();
     });
   });
 });

package/src/composables/useGrpc.ts

@@ -2,67 +2,28 @@ import { GrpcWebFetchTransport } from "@protobuf-ts/grpcweb-transport";
 import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
 import { ref, type Ref } from "vue";
 import type { GrpcConfig } from "../types/auth";
-import {
-  AdaptiveRpcTransport,
-  type TransportType,
-} from "@structured-id/proto/transport";
 
-/** Shared RPC transport instance (gRPC-web or AdaptiveRpcTransport). */
+/** Shared gRPC-web transport instance. */
 let _transport: RpcTransport | null = null;
-/** Separate reference to AdaptiveRpcTransport when active (avoids instanceof). */
-let _adaptive: AdaptiveRpcTransport | null = null;
 
 /**
- * Initialize the gRPC transport. Call once at app startup.
+ * Initialize the gRPC-web transport. Call once at app startup.
  *
- * When `config.webTransportUrl` is provided, creates an AdaptiveRpcTransport
- * with WebTransport as the primary and gRPC-web as the fallback. The initial
- * WebTransport connection is attempted asynchronously (non-blocking).
- *
- * Without `config.webTransportUrl`, falls back to plain gRPC-web (same as before).
- *
- * After BFF migration (#536i-3): `credentials: "include"` is always set
- * so the httpOnly BFF session cookie is sent with every gRPC-web request.
+ * `credentials: "include"` is always set so the httpOnly BFF session cookie
+ * is sent with every request.
  *
  * @example
  * ```ts
- * // gRPC-web only
  * initGrpc({ baseUrl: 'https://api.example.com' })
- *
- * // With WebTransport failover
- * initGrpc({
- *   baseUrl: 'https://api.example.com',
- *   webTransportUrl: 'https://wt.api.example.com',
- * })
  * ```
  */
 export function initGrpc(config: GrpcConfig): void {
-  if (config.webTransportUrl) {
-    const adaptive = new AdaptiveRpcTransport({
-      grpcWebUrl: config.baseUrl,
-      webTransportUrl: config.webTransportUrl,
-      webTransportCertHash: config.webTransportCertHash,
-      reconnectDelay: config.webTransportReconnectDelay,
-      onTransportChange: config.onTransportChange,
-      // Always include credentials so the BFF session cookie is attached.
-      // The BFF proxy exchanges the cookie for a Bearer token server-side.
-      fetchInit: { credentials: "include" },
-    });
-    // Attempt WebTransport connection in background — non-blocking.
-    adaptive.init().catch(() => {
-      // Silently falls back to gRPC-web if WebTransport is unavailable.
-    });
-    _adaptive = adaptive;
-    _transport = adaptive;
-  } else {
-    _adaptive = null;
-    _transport = new GrpcWebFetchTransport({
-      baseUrl: config.baseUrl,
-      // Always include credentials so the BFF session cookie is attached.
-      // The BFF proxy exchanges the cookie for a Bearer token server-side.
-      fetchInit: { credentials: "include" },
-    });
-  }
+  _transport = new GrpcWebFetchTransport({
+    baseUrl: config.baseUrl,
+    // The BFF proxy exchanges the session cookie for a Bearer token
+    // server-side.
+    fetchInit: { credentials: "include" },
+  });
 }
 
 /**
@@ -78,24 +39,12 @@ export function getTransport(): RpcTransport {
 }
 
 /**
- * Close the transport and release resources (timers, connections).
- * Call during app teardown if using WebTransport.
+ * Drop the shared transport; the next use needs `initGrpc()` again.
  */
 export function closeTransport(): void {
-  _adaptive?.close();
-  _adaptive = null;
   _transport = null;
 }
 
-/**
- * Get the currently active transport type.
- * Returns "grpc-web" if AdaptiveRpcTransport is not used or WebTransport
- * is not available.
- */
-export function getTransportType(): TransportType {
-  return _adaptive?.activeTransport ?? "grpc-web";
-}
-
 /**
  * Vue composable for gRPC transport.
  *
@@ -118,5 +67,3 @@ export function useGrpc() {
     initGrpc,
   };
 }
-
-export type { TransportType };

package/src/index.ts

@@ -4,8 +4,6 @@ export {
   initGrpc,
   getTransport,
   closeTransport,
-  getTransportType,
-  type TransportType,
 } from "./composables/useGrpc";
 export { useSession, type SessionCallbacks } from "./composables/useSession";
 export {

package/src/profile/components/SidLoginForm.test.ts

@@ -37,7 +37,6 @@ const quasarStubs = {
 };
 
 const loginFn = vi.fn().mockResolvedValue({
-  accessToken: "tok",
   expiresIn: 3600,
   sessionId: "sess-1",
 });

package/src/profile/components/SidLoginForm.vue

@@ -175,7 +175,6 @@ const props = withDefaults(
       password: string,
       onStep?: (step: number) => void,
     ) => Promise<{
-      accessToken: string;
       expiresIn: number;
       sessionId?: string;
     }>;
@@ -207,9 +206,7 @@ const props = withDefaults(
 );
 
 const emit = defineEmits<{
-  success: [
-    result: { accessToken: string; expiresIn: number; sessionId?: string },
-  ];
+  success: [result: { expiresIn: number; sessionId?: string }];
   error: [error: Error];
   "forgot-password": [];
 }>();

package/src/profile/composables/useAuth.test.ts

@@ -125,7 +125,6 @@ describe("createAuth prewarm", () => {
     });
     api.loginFinish.mockResolvedValue({
       sessionId: "s",
-      accessToken: "t",
       expiresIn: 60n,
     });
   });
@@ -173,10 +172,13 @@ describe("createAuth register", () => {
       registrationResponse: RESPONSE,
       history: wireContext(),
     });
-    api.regFinish.mockResolvedValue({
+    // An older server's answer, still carrying a Profile identifier the
+    // current message no longer has.
+    const fromOlderServer = {
       profileId: "profile-uuid",
       credentialId: "cred-uuid",
-    });
+    };
+    api.regFinish.mockResolvedValue(fromOlderServer);
   });
 
   it("runs the operation: start, evaluate, prove, finish with the proof", async () => {
@@ -650,7 +652,6 @@ describe("createAuth resetPassword", () => {
     api.executeReset.mockResolvedValue({ registrationResponse: RESPONSE });
     api.completeReset.mockResolvedValue({
       sessionId: "sess-1",
-      accessToken: "jwt",
       expiresIn: 3600,
     });
   });
@@ -686,9 +687,8 @@ describe("createAuth login", () => {
     });
     api.loginFinish.mockResolvedValue({
       sessionId: "sess-1",
-      accessToken: "jwt",
       expiresIn: BigInt(3600),
-    } as never);
+    });
   });
 
   it("signs in with the Pallas client in two round trips", async () => {
@@ -713,9 +713,10 @@ describe("createAuth login", () => {
       "server-state",
     );
     expect(steps).toEqual([1, 2, 3]);
+    // The result carries no credential: the browser holds the session
+    // cookie the answer set.
     expect(result).toEqual({
       sessionId: "sess-1",
-      accessToken: "jwt",
       expiresIn: 3600,
     });
   });

package/src/profile/composables/useAuth.ts

@@ -33,10 +33,13 @@ import {
 
 // ── Types ──
 
-/** A sign-in's session, as the server issued it. */
+/**
+ * A sign-in's session, as the server issued it. The credential itself never
+ * reaches page code: a browser holds the session cookie the answer set.
+ */
 export interface LoginResult {
   sessionId: string;
-  accessToken: string;
+  /** Seconds until the delivered credential expires. */
   expiresIn: number;
 }
 
@@ -540,7 +543,6 @@ export function createAuth(loadClient: ZkppClientLoader) {
     );
     return {
       sessionId: finished.sessionId,
-      accessToken: finished.accessToken,
       expiresIn: Number(finished.expiresIn),
     };
   }

package/src/profile/composables/useAuthApi.opaque.test.ts

@@ -71,7 +71,6 @@ describe("OPAQUE gRPC wrappers", () => {
     it("sends principal, finalization, and serverLoginState", async () => {
       const expected = {
         sessionId: "sess-1",
-        accessToken: "jwt",
         expiresIn: BigInt(3600),
       };
       mockOpaqueLoginFinish.mockResolvedValue({ response: expected });

package/src/stores/auth.test.ts

@@ -23,9 +23,7 @@ describe("useAuthStore (BFF cookie session)", () => {
       email: "alice@example.com",
       name: "Alice Smith",
       preferred_username: "alice",
-      groups: ["admins"],
       acr: "urn:sid:acr:mfa",
-      roles: ["member"],
     });
 
     expect(store.isAuthenticated).toBe(true);

package/src/types/auth.ts

@@ -29,30 +29,4 @@ export interface SessionInfo {
 export interface GrpcConfig {
   /** Base URL for gRPC-web transport (e.g., "https://api.example.com"). */
   baseUrl: string;
-  /**
-   * @deprecated BFF mode always uses credentials: "include".
-   * This field is kept for API compatibility but has no effect.
-   */
-  withCredentials?: boolean;
-  /**
-   * WebTransport server URL (e.g., "https://wt.api.example.com").
-   * When provided, AdaptiveRpcTransport is used with WebTransport as primary
-   * and gRPC-web as fallback. Omit to use gRPC-web only.
-   */
-  webTransportUrl?: string;
-  /**
-   * SHA-256 certificate hash (hex string) for dev self-signed WebTransport certs.
-   * Only needed when connecting to servers with self-signed certificates.
-   */
-  webTransportCertHash?: string;
-  /**
-   * Delay in milliseconds before attempting to reconnect WebTransport after failover.
-   * Defaults to 5000ms.
-   */
-  webTransportReconnectDelay?: number;
-  /**
-   * Callback fired when the active transport changes between "webtransport" and "grpc-web".
-   * Use this to show transport status indicators in the UI.
-   */
-  onTransportChange?: (transport: "webtransport" | "grpc-web") => void;
 }

package/src/utils/rpcRefusal.ts

@@ -130,6 +130,8 @@ export const REFUSAL_TEXTS: Readonly<
   [ErrorReason.AUTHENTICATION_FAILED]: "Sign-in failed.",
   [ErrorReason.TOKEN_EXPIRED]: "Your session has expired; sign in again.",
   [ErrorReason.TOKEN_INVALID]: "Your session is not valid; sign in again.",
+  [ErrorReason.CSRF_TOKEN_INVALID]:
+    "This page is out of date for your session; reload it and try again.",
   [ErrorReason.INSUFFICIENT_PERMISSIONS]:
     "You do not have permission to do this.",
   [ErrorReason.SCOPE_NOT_GRANTED]: "This access was not granted.",