@structured-id/ui-core 4.4.0 → 4.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@structured-id/ui-core",
-  "version": "4.4.0",
+  "version": "4.6.0",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -42,7 +42,7 @@
     "@protobuf-ts/grpcweb-transport": "^2.11.1",
     "@protobuf-ts/runtime": "^2.11.1",
     "@protobuf-ts/runtime-rpc": "^2.11.1",
-    "@structured-id/proto": "^0.4.1",
+    "@structured-id/proto": "^0.6.0",
     "@structured-world/structured-email-address-ts": "^0.0.22",
     "@structured-world/structured-public-domains": "0.0.x",
     "libphonenumber-js": "^1.13.15"
@@ -79,6 +79,6 @@
       "optional": true
     }
   },
-  "packageManager": "yarn@4.14.1",
+  "packageManager": "yarn@4.18.1",
   "license": "AGPL-3.0-only"
 }

package/src/composables/useAccountTransport.test.ts

@@ -1,8 +1,9 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import type {
-  MethodInfo,
-  RpcInterceptor,
-  RpcOptions,
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  RpcError,
+  type MethodInfo,
+  type RpcInterceptor,
+  type RpcOptions,
 } from "@protobuf-ts/runtime-rpc";
 
 const created: Array<{
@@ -19,6 +20,19 @@ vi.mock("@protobuf-ts/grpcweb-transport", () => ({
   }),
 }));
 
+/** What the UI host's session service answers; each test sets its calls. */
+const host = vi.hoisted(() => ({
+  getApplicationSession: vi.fn(),
+  endApplicationSession: vi.fn(),
+}));
+
+vi.mock("@structured-id/proto/sid/v1/authn/application_session.client", () => ({
+  ApplicationSessionServiceClient: class {
+    getApplicationSession = host.getApplicationSession;
+    endApplicationSession = host.endApplicationSession;
+  },
+}));
+
 import {
   initAccountApi,
   getAccountTransport,
@@ -26,9 +40,14 @@ import {
 } from "./useAccountTransport";
 import { bffLogout, checkBffSession, initBff } from "./useBffAuth";
 
+/** The account transport's options: the last transport created. */
+function account() {
+  return created[created.length - 1];
+}
+
 /** Run the transport's interceptor over a call and return the options it passed on. */
 function intercepted(options: RpcOptions): RpcOptions {
-  const [interceptor] = created[created.length - 1].interceptors ?? [];
+  const [interceptor] = account().interceptors ?? [];
   let passed: RpcOptions | undefined;
   interceptor.interceptUnary!(
     (_method, _input, opts) => {
@@ -42,68 +61,57 @@ function intercepted(options: RpcOptions): RpcOptions {
   return passed!;
 }
 
-/** The BFF's answer to the page's session check: the user with the session's token. */
-function bffSession(csrfToken: string) {
-  vi.stubGlobal(
-    "fetch",
-    vi.fn().mockResolvedValue({
-      ok: true,
-      status: 200,
-      json: async () => ({ sub: "up_1", csrf_token: csrfToken }),
-    }),
-  );
-}
-
-/** The BFF's answer without a session. */
-function noBffSession() {
-  vi.stubGlobal("fetch", vi.fn().mockResolvedValue({ ok: false, status: 401 }));
+/** The host's answer to the page's session read: a session with this token. */
+async function session(csrfToken: string) {
+  host.getApplicationSession.mockResolvedValue({
+    response: { sub: "up_1", acr: "", csrfToken },
+  });
+  await checkBffSession();
 }
 
 describe("account API transport", () => {
   beforeEach(async () => {
     created.length = 0;
+    vi.clearAllMocks();
     closeAccountTransport();
     initBff("");
-    noBffSession();
+    host.getApplicationSession.mockRejectedValue(
+      new RpcError("no session", "UNAUTHENTICATED"),
+    );
     await checkBffSession();
   });
 
-  afterEach(() => {
-    vi.unstubAllGlobals();
+  // The account API is reached only through the UI host on the page's own
+  // origin: its cookie rides along same-origin, and no other origin gets it.
+  it("goes to the UI host on the page's origin with same-origin credentials", () => {
+    initAccountApi({ baseUrl: "" });
+    expect(account().baseUrl).toBe("");
+    expect(account().fetchInit).toEqual({ credentials: "same-origin" });
   });
 
-  // The account API is reached only through the BFF on the page's own origin:
-  // its cookie rides along same-origin, and no other origin gets it.
-  it("goes to the BFF's API route with same-origin credentials", () => {
-    initAccountApi({ baseUrl: "/api" });
-    expect(created[0].baseUrl).toBe("/api");
-    expect(created[0].fetchInit).toEqual({ credentials: "same-origin" });
-  });
-
-  // Every call echoes the session's CSRF token, which the BFF hands the page
-  // with the session check: the BFF refuses a call without it, which is what
+  // Every call echoes the session's CSRF token, which the host hands the page
+  // with the session read: the host refuses a call without it, which is what
   // stops a foreign page driving the account API.
-  it("sends the CSRF token the BFF gave with the session on every call", async () => {
-    initAccountApi({ baseUrl: "/api" });
-    bffSession("token-1");
-    await checkBffSession();
+  it("sends the session's CSRF token on every call", async () => {
+    initAccountApi({ baseUrl: "" });
+    await session("token-1");
     const options = intercepted({ meta: { other: "kept" } });
     expect(options.meta).toEqual({ other: "kept", "x-csrf-token": "token-1" });
   });
 
-  // No session, no header: the call goes out and the BFF answers it (401 or
-  // 403), rather than the page inventing a token.
+  // No session, no header: the call goes out and the host answers it, rather
+  // than the page inventing a token.
   it("sends no CSRF header without a session", () => {
-    initAccountApi({ baseUrl: "/api" });
+    initAccountApi({ baseUrl: "" });
     const options = intercepted({ meta: {} });
     expect(options.meta).toEqual({});
   });
 
   // Sign-out ends the session; its token goes with it.
   it("forgets the token at sign-out", async () => {
-    initAccountApi({ baseUrl: "/api" });
-    bffSession("token-1");
-    await checkBffSession();
+    initAccountApi({ baseUrl: "" });
+    await session("token-1");
+    host.endApplicationSession.mockResolvedValue({ response: { grant: 1 } });
     await bffLogout();
     const options = intercepted({ meta: {} });
     expect(options.meta).toEqual({});
@@ -116,7 +124,7 @@ describe("account API transport", () => {
   });
 
   it("is the one set up", () => {
-    initAccountApi({ baseUrl: "/api" });
+    initAccountApi({ baseUrl: "" });
     expect(getAccountTransport()).toEqual({ type: "grpc-web-transport" });
   });
 });

package/src/composables/useAccountTransport.ts

@@ -1,8 +1,8 @@
 /**
- * The account API transport: gRPC-Web through the BFF (sid-auth-proxy) on the
- * page's own origin. The BFF holds the session's tokens and adds the Bearer
- * token itself; the page sends only its session cookie and, on every call,
- * the CSRF token the BFF set (double submit).
+ * The account API transport: gRPC-Web through the application's UI host on
+ * the page's own origin. The host holds the session's tokens and adds the
+ * Bearer token itself; the page sends only its session cookie and, on every
+ * call, the session's CSRF token.
  *
  * Sign-in ceremonies are not account API calls: they go to SID's own sign-in
  * surface through `getTransport()`, where the IdP's session lives.
@@ -13,7 +13,7 @@ import { bffCsrfToken } from "./useBffAuth";
 
 /** Where the account API is reached. */
 export interface AccountApiConfig {
-  /** The BFF's API route, usually `/api` on the page's own origin. */
+  /** The UI host's base URL: "" for the page's own origin, where it usually is. */
   baseUrl: string;
 }
 

package/src/composables/useBffAuth.test.ts

@@ -1,4 +1,20 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { RpcError } from "@protobuf-ts/runtime-rpc";
+import { GrantOutcome } from "@structured-id/proto/sid/v1/authn/application_session";
+
+/** What the UI host's session service answers; each test sets its calls. */
+const host = vi.hoisted(() => ({
+  getApplicationSession: vi.fn(),
+  endApplicationSession: vi.fn(),
+}));
+
+vi.mock("@structured-id/proto/sid/v1/authn/application_session.client", () => ({
+  ApplicationSessionServiceClient: class {
+    getApplicationSession = host.getApplicationSession;
+    endApplicationSession = host.endApplicationSession;
+  },
+}));
+
 import {
   bffCsrfToken,
   bffLogout,
@@ -6,90 +22,125 @@ import {
   initBff,
 } from "./useBffAuth";
 
-/** A BFF that answers every request with this response. */
-function bffAnswers(response: unknown) {
-  const fetchMock = vi.fn().mockResolvedValue(response);
-  vi.stubGlobal("fetch", fetchMock);
-  return fetchMock;
+/** A unary call that answers `response`. */
+function answers(response: unknown) {
+  return Promise.resolve({ response });
 }
 
-/** The BFF's sign-out answer: the session ended, with this grant outcome. */
-function ended(grant: string) {
-  return { ok: true, status: 200, json: async () => ({ grant }) };
+/** A unary call refused with gRPC status `code`. */
+function refused(code: string) {
+  return Promise.reject(new RpcError("refused", code));
 }
 
-describe("bffLogout", () => {
-  beforeEach(async () => {
+/** A live session with CSRF token `token-1`. */
+const LIVE = {
+  sub: "0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d9e",
+  email: "user@sid.example.com",
+  acr: "urn:sid:acr:basic",
+  csrfToken: "token-1",
+};
+
+describe("checkBffSession", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
     initBff("");
-    bffAnswers({
-      ok: true,
-      status: 200,
-      json: async () => ({ sub: "s", csrf_token: "token-1" }),
+  });
+
+  // The page shows the signed-in user and keeps the session's CSRF token for
+  // the state-changing calls that follow.
+  it("reads the live session and keeps its CSRF token", async () => {
+    host.getApplicationSession.mockReturnValue(answers(LIVE));
+    await expect(checkBffSession()).resolves.toEqual({
+      sub: LIVE.sub,
+      email: LIVE.email,
+      name: null,
+      preferred_username: null,
+      acr: LIVE.acr,
+      csrf_token: "token-1",
     });
+    expect(bffCsrfToken()).toBe("token-1");
+  });
+
+  // No session is a signed-out page, and no token is kept from before.
+  it("reports a signed-out page as null and forgets the token", async () => {
+    host.getApplicationSession.mockReturnValue(answers(LIVE));
     await checkBffSession();
+    host.getApplicationSession.mockReturnValue(refused("UNAUTHENTICATED"));
+    await expect(checkBffSession()).resolves.toBeNull();
+    expect(bffCsrfToken()).toBeNull();
   });
 
-  afterEach(() => {
-    vi.unstubAllGlobals();
+  // An outage must not send a signed-in user to sign-in again.
+  it.each(["UNAVAILABLE", "INTERNAL"])(
+    "throws on %s instead of reporting a signed-out page",
+    async (code) => {
+      host.getApplicationSession.mockReturnValue(refused(code));
+      await expect(checkBffSession()).rejects.toBeInstanceOf(RpcError);
+    },
+  );
+
+  it("reports nothing before the session is set up", async () => {
+    vi.resetModules();
+    const fresh = await import("./useBffAuth");
+    await expect(fresh.checkBffSession()).resolves.toBeNull();
+    expect(host.getApplicationSession).not.toHaveBeenCalled();
+  });
+});
+
+describe("bffLogout", () => {
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    initBff("");
+    host.getApplicationSession.mockReturnValue(answers(LIVE));
+    await checkBffSession();
   });
 
   // The page tells a local end of its session from one where the issuer also
   // revoked the grant, so it can say which happened.
-  it.each(["revoked", "not_revoked", "none"] as const)(
+  it.each([
+    [GrantOutcome.REVOKED, "revoked"],
+    [GrantOutcome.NOT_REVOKED, "not_revoked"],
+    [GrantOutcome.NONE, "none"],
+    [GrantOutcome.UNKNOWN, "unknown"],
+  ] as const)(
     "reports the ended session with grant %s",
-    async (grant) => {
-      const fetchMock = bffAnswers(ended(grant));
-      await expect(bffLogout()).resolves.toEqual({ ended: true, grant });
-      expect(fetchMock).toHaveBeenCalledWith("/auth/logout", {
-        method: "POST",
-        credentials: "include",
-        headers: { "X-CSRF-Token": "token-1" },
-      });
+    async (grant, name) => {
+      host.endApplicationSession.mockReturnValue(answers({ grant }));
+      await expect(bffLogout()).resolves.toEqual({ ended: true, grant: name });
+      expect(host.endApplicationSession).toHaveBeenCalledWith(
+        {},
+        { meta: { "x-csrf-token": "token-1" } },
+      );
     },
   );
 
-  // A refused or failed sign-out leaves the BFF session alive: the page must
-  // not report it as ended.
-  it.each([
-    ["refused", { ok: false, status: 403 }],
-    ["unavailable", { ok: false, status: 503 }],
-  ])("reports a %s sign-out as not ended", async (_name, response) => {
-    bffAnswers(response);
-    await expect(bffLogout()).resolves.toEqual({ ended: false });
-  });
+  // A refused or failed sign-out leaves the session alive: the page must not
+  // report it as ended.
+  it.each(["PERMISSION_DENIED", "UNAVAILABLE", "UNAUTHENTICATED"])(
+    "reports a sign-out refused with %s as not ended",
+    async (code) => {
+      host.endApplicationSession.mockReturnValue(refused(code));
+      await expect(bffLogout()).resolves.toEqual({ ended: false });
+    },
+  );
 
-  it("reports an unreachable BFF as not ended", async () => {
-    vi.stubGlobal("fetch", vi.fn().mockRejectedValue(new TypeError("offline")));
+  it("reports an unreachable host as not ended", async () => {
+    host.endApplicationSession.mockReturnValue(
+      Promise.reject(new TypeError("offline")),
+    );
     await expect(bffLogout()).resolves.toEqual({ ended: false });
   });
 
-  // An answer the page cannot read still came after the BFF ended the
-  // session; only the grant's fate is unknown.
-  it("reports an unreadable answer as ended with an unknown grant", async () => {
-    bffAnswers({
-      ok: true,
-      status: 200,
-      json: async () => {
-        throw new SyntaxError("not json");
-      },
-    });
-    await expect(bffLogout()).resolves.toEqual({
-      ended: true,
-      grant: "unknown",
-    });
-  });
-
-  it("reports nothing ended before the BFF is set up", async () => {
+  it("reports nothing ended before the session is set up", async () => {
     vi.resetModules();
     const fresh = await import("./useBffAuth");
-    const fetchMock = bffAnswers(ended("revoked"));
     await expect(fresh.bffLogout()).resolves.toEqual({ ended: false });
-    expect(fetchMock).not.toHaveBeenCalled();
+    expect(host.endApplicationSession).not.toHaveBeenCalled();
   });
 
-  // Whatever the BFF answers, the page forgets the session's token.
+  // Whatever the host answers, the page forgets the session's token.
   it("forgets the CSRF token even when the sign-out failed", async () => {
-    bffAnswers({ ok: false, status: 503 });
+    host.endApplicationSession.mockReturnValue(refused("UNAVAILABLE"));
     await bffLogout();
     expect(bffCsrfToken()).toBeNull();
   });

package/src/composables/useBffAuth.ts

@@ -1,107 +1,126 @@
 /**
- * BFF (Backend-For-Frontend) session management composable.
+ * The page's application session.
  *
- * The tokens live in sid-auth-proxy's BFF session; the page holds only the
- * BFF's httpOnly session cookie. gRPC calls go through the BFF, which adds
- * the Bearer token itself, so the page never sees an access token. The
- * session's CSRF token comes with the session check and every state-changing
- * call echoes it in `X-CSRF-Token`.
+ * The tokens live in the application's UI host; the page holds only the
+ * host's httpOnly session cookie. The page reads its session and signs out
+ * through `sid.v1.authn.ApplicationSessionService` over gRPC-Web on its own
+ * origin, so the cookie travels with the same-origin request. The session's
+ * CSRF token comes with the session read and every state-changing call echoes
+ * it in `x-csrf-token`.
  *
  * Usage:
- *   1. Call `initBff(bffBaseUrl)` at app boot
- *   2. Call `checkBffSession()` to verify the session + populate the auth store
- *   3. Call `startBffLogin()` to redirect the user to the PKCE auth flow
- *   4. Call `bffLogout()` to clear the session
+ *   1. Call `initBff(baseUrl)` at app boot ("" for the page's own origin)
+ *   2. Call `checkBffSession()` to read the session and populate the auth store
+ *   3. Call `startBffLogin()` to send the browser to sign-in
+ *   4. Call `bffLogout()` to end the session
  */
+import { GrpcWebFetchTransport } from "@protobuf-ts/grpcweb-transport";
+import { RpcError, type RpcTransport } from "@protobuf-ts/runtime-rpc";
+import { ApplicationSessionServiceClient } from "@structured-id/proto/sid/v1/authn/application_session.client";
+import { GrantOutcome } from "@structured-id/proto/sid/v1/authn/application_session";
 
-/** User info returned from BFF /auth/userinfo endpoint. */
+/** The signed-in user of the page's session. */
 export interface BffUserInfo {
   /** Opaque subject identifier; its form depends on the issuer, so it is never parsed as a profile id. */
   sub: string;
-  /** Email address (if available in session claims). */
+  /** Email address, when disclosed to this application. */
   email?: string | null;
-  /** Display name (full name from profile). */
+  /** Display name, when disclosed. */
   name?: string | null;
-  /** Username or email — preferred identifier for display. */
+  /** Username, when disclosed. */
   preferred_username?: string | null;
-  /** Group memberships. */
-  groups?: string[] | null;
-  /** Authentication Context Class Reference (acr_values). */
+  /** Authentication Context Class Reference of the sign-in. */
   acr?: string | null;
-  /** Role assignments. */
-  roles?: string[] | null;
-  /** The session's CSRF token, echoed in `X-CSRF-Token` by every state-changing call. */
+  /** The session's CSRF token, echoed in `x-csrf-token` by every state-changing call. */
   csrf_token?: string | null;
 }
 
 let _bffBaseUrl: string | null = null;
+let _session: ApplicationSessionServiceClient | null = null;
 /**
- * The CSRF token of the session the page last checked. Browser-only state:
- * the session check runs in the browser, never during server rendering.
+ * The CSRF token of the session the page last read. Browser-only state:
+ * the session read runs in the browser, never during server rendering.
  */
 let _csrfToken: string | null = null;
 
+/** The session service at `baseUrl`; the cookie never travels to another origin. */
+function sessionClient(baseUrl: string): ApplicationSessionServiceClient {
+  const transport: RpcTransport = new GrpcWebFetchTransport({
+    baseUrl,
+    fetchInit: { credentials: "same-origin" },
+  });
+  return new ApplicationSessionServiceClient(transport);
+}
+
 /**
- * Initialize BFF configuration. Call once at app boot.
+ * Initialize the session's UI host. Call once at app boot.
  *
- * @param baseUrl  BFF base URL: "" for the page's own origin, where the BFF usually is
+ * @param baseUrl  The UI host's base URL: "" for the page's own origin, where it usually is
  */
 export function initBff(baseUrl: string): void {
   _bffBaseUrl = baseUrl;
+  _session = sessionClient(baseUrl);
 }
 
-/** Get the configured BFF base URL, or null if not initialized. */
+/** Get the configured base URL, or null if not initialized. */
 export function getBffBaseUrl(): string | null {
   return _bffBaseUrl;
 }
 
 /**
- * The CSRF token the BFF gave with the session check, or null without a
- * checked session. The BFF refuses a state-changing call without it.
+ * The CSRF token the UI host gave with the session read, or null without a
+ * read session. The host refuses a state-changing call without it.
  */
 export function bffCsrfToken(): string | null {
   return _csrfToken;
 }
 
 /**
- * Check if the BFF session is valid by calling GET /auth/userinfo.
+ * Read the page's session with `GetApplicationSession`.
  *
- * Returns user info if session is active, null if unauthenticated, and
- * keeps the session's CSRF token for the calls that follow.
- * The browser automatically sends the httpOnly session cookie.
- * An empty base URL is the page's own origin, where the BFF usually is.
+ * Returns the user when the session is live and keeps its CSRF token for
+ * the calls that follow; null when the page is signed out (UNAUTHENTICATED)
+ * or the session was not set up. Any other failure (an unavailable session
+ * store, an unreachable host) is thrown: an outage never reads as a
+ * signed-out user.
  */
 export async function checkBffSession(
   bffBaseUrl?: string,
 ): Promise<BffUserInfo | null> {
-  const base = bffBaseUrl ?? _bffBaseUrl;
-  if (base === null) return null;
+  const client =
+    bffBaseUrl !== undefined ? sessionClient(bffBaseUrl) : _session;
+  if (client === null) return null;
   try {
-    const resp = await fetch(`${base}/auth/userinfo`, {
-      credentials: "include",
-    });
-    if (!resp.ok) {
+    const { response } = await client.getApplicationSession({});
+    _csrfToken = response.csrfToken || null;
+    return {
+      sub: response.sub,
+      email: response.email ?? null,
+      name: response.name ?? null,
+      preferred_username: response.preferredUsername ?? null,
+      acr: response.acr || null,
+      csrf_token: _csrfToken,
+    };
+  } catch (err) {
+    if (err instanceof RpcError && err.code === "UNAUTHENTICATED") {
       _csrfToken = null;
       return null;
     }
-    const info = (await resp.json()) as BffUserInfo;
-    _csrfToken = info.csrf_token ?? null;
-    return info;
-  } catch {
-    return null;
+    throw err;
   }
 }
 
 /**
- * Redirect user to BFF login (PKCE flow initiation).
+ * Send the browser to sign-in (`StartSignIn`, a navigation to
+ * `/auth/login`).
  *
- * After successful login, BFF sets httpOnly session cookie and redirects
- * back to the SPA. The SPA should call checkBffSession() on load to restore state.
+ * After sign-in the UI host sets its httpOnly session cookie and returns to
+ * the page, which calls `checkBffSession()` on load.
  *
- * @param bffBaseUrl  Override BFF base URL (uses configured URL if not provided)
- * @param postLoginRedirect  Path on the BFF's origin to return to after
- *   sign-in (`/account/security?tab=keys`), sent as the BFF's `rd`
- *   parameter; the BFF returns anything else to its root
+ * @param bffBaseUrl  Override the base URL (uses the configured one if not provided)
+ * @param postLoginRedirect  Local path to return to after sign-in
+ *   (`/account/security?tab=keys`), sent as `rd`; the host returns anything
+ *   else to its root
  */
 export function startBffLogin(
   bffBaseUrl?: string,
@@ -109,7 +128,7 @@ export function startBffLogin(
 ): void {
   const base = bffBaseUrl ?? _bffBaseUrl;
   if (base === null) {
-    console.warn("[BFF] Not initialized. Call initBff() at app boot.");
+    console.warn("[session] Not initialized. Call initBff() at app boot.");
     return;
   }
   const url = postLoginRedirect
@@ -119,59 +138,53 @@ export function startBffLogin(
 }
 
 /**
- * What became of the grant behind an ended BFF session: revoked by the
- * issuer, left to expire because the issuer did not revoke it, none held,
- * or unknown when the BFF's answer could not be read.
+ * What became of the grant behind an ended session: revoked by the issuer,
+ * left to expire because the issuer did not revoke it, none held, or
+ * unknown.
  */
 export type BffGrantOutcome = "revoked" | "not_revoked" | "none" | "unknown";
 
-/** The outcome of a sign-out: whether the BFF ended the session, and its grant. */
+/** The outcome of a sign-out: whether the session ended, and its grant. */
 export type BffLogoutResult =
   { ended: true; grant: BffGrantOutcome } | { ended: false };
 
-const GRANT_OUTCOMES: readonly BffGrantOutcome[] = [
-  "revoked",
-  "not_revoked",
-  "none",
-];
+const GRANT_OUTCOMES: Readonly<Partial<Record<GrantOutcome, BffGrantOutcome>>> =
+  {
+    [GrantOutcome.REVOKED]: "revoked",
+    [GrantOutcome.NOT_REVOKED]: "not_revoked",
+    [GrantOutcome.NONE]: "none",
+  };
 
 /**
- * Log out by calling POST /auth/logout with X-CSRF-Token header.
+ * End the session with `EndApplicationSession`, carrying the session's CSRF
+ * token in `x-csrf-token`.
  *
- * The BFF validates the CSRF header, ends the session, clears its cookie and
- * says whether the issuer revoked the grant. `ended: false` means the
- * session may still be alive (refused, unavailable, unreachable). The page
- * forgets the CSRF token either way.
+ * The host checks the token, ends the session, clears its cookie and says
+ * whether the issuer revoked the grant. `ended: false` means the session may
+ * still be alive (refused, unavailable, unreachable). The page forgets the
+ * CSRF token either way.
  *
- * @param bffBaseUrl  Override BFF base URL
+ * @param bffBaseUrl  Override the base URL
  */
 export async function bffLogout(bffBaseUrl?: string): Promise<BffLogoutResult> {
-  const base = bffBaseUrl ?? _bffBaseUrl;
-  if (base === null) return { ended: false };
+  const client =
+    bffBaseUrl !== undefined ? sessionClient(bffBaseUrl) : _session;
+  if (client === null) return { ended: false };
   const csrf = _csrfToken;
   _csrfToken = null;
-  let resp: Response;
   try {
-    resp = await fetch(`${base}/auth/logout`, {
-      method: "POST",
-      credentials: "include",
-      headers: csrf ? { "X-CSRF-Token": csrf } : {},
-    });
+    const { response } = await client.endApplicationSession(
+      {},
+      { meta: csrf ? { "x-csrf-token": csrf } : {} },
+    );
+    return { ended: true, grant: GRANT_OUTCOMES[response.grant] ?? "unknown" };
   } catch {
     return { ended: false };
   }
-  if (!resp.ok) return { ended: false };
-  try {
-    const { grant } = (await resp.json()) as { grant?: unknown };
-    const known = GRANT_OUTCOMES.find((outcome) => outcome === grant);
-    return { ended: true, grant: known ?? "unknown" };
-  } catch {
-    return { ended: true, grant: "unknown" };
-  }
 }
 
 /**
- * Vue composable for BFF auth actions.
+ * Vue composable for the session actions.
  */
 export function useBffAuth() {
   return {

package/src/stores/auth.test.ts

@@ -23,9 +23,7 @@ describe("useAuthStore (BFF cookie session)", () => {
       email: "alice@example.com",
       name: "Alice Smith",
       preferred_username: "alice",
-      groups: ["admins"],
       acr: "urn:sid:acr:mfa",
-      roles: ["member"],
     });
 
     expect(store.isAuthenticated).toBe(true);

package/src/utils/rpcRefusal.ts

@@ -130,6 +130,8 @@ export const REFUSAL_TEXTS: Readonly<
   [ErrorReason.AUTHENTICATION_FAILED]: "Sign-in failed.",
   [ErrorReason.TOKEN_EXPIRED]: "Your session has expired; sign in again.",
   [ErrorReason.TOKEN_INVALID]: "Your session is not valid; sign in again.",
+  [ErrorReason.CSRF_TOKEN_INVALID]:
+    "This page is out of date for your session; reload it and try again.",
   [ErrorReason.INSUFFICIENT_PERMISSIONS]:
     "You do not have permission to do this.",
   [ErrorReason.SCOPE_NOT_GRANTED]: "This access was not granted.",