@undefineds.co/xpod 0.4.2 → 0.4.3

package/config/xpod.base.json

@@ -2,13 +2,80 @@
   "@context": [
     "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld",
     "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld",
-    "https://linkedsoftwaredependencies.org/bundles/npm/asynchronous-handlers/^1.0.0/components/context.jsonld"
+    "https://linkedsoftwaredependencies.org/bundles/npm/asynchronous-handlers/^1.0.0/components/context.jsonld",
+    {
+      "rememberedGrantStorage": "RememberedClientGrantStore:_storage",
+      "rememberedPromptSource": "RememberedClientPromptFactory:_source",
+      "rememberedPromptStore": "RememberedClientPromptFactory:_store",
+      "rememberedConsentSource": "RememberedConsentHandler:_source",
+      "rememberedConsentStore": "RememberedConsentHandler:_store",
+      "rememberedConsentProvider": "RememberedConsentHandler:_providerFactory",
+      "scopedRememberedGrantStore": "ScopedPickWebIdHandler:_options_rememberedClientGrantStore"
+    }
   ],
   "import": [
     "./cli.json",
     "./resolver.json"
   ],
   "@graph": [
+    {
+      "@id": "urn:undefineds:xpod:RememberedClientGrantStore",
+      "@type": "RememberedClientGrantStore",
+      "rememberedGrantStorage": {
+        "@type": "WrappedExpiringStorage",
+        "source": {
+          "@type": "ContainerPathStorage",
+          "relativePath": "/idp/remembered-clients/",
+          "source": { "@id": "urn:solid-server:default:KeyValueStorage" }
+        }
+      }
+    },
+    {
+      "comment": "Retain default account/WebID checks and restore explicitly remembered Desktop grants before consent.",
+      "@type": "Override",
+      "overrideInstance": { "@id": "urn:solid-server:default:PromptFactory" },
+      "overrideParameters": {
+        "@type": "RememberedClientPromptFactory",
+        "rememberedPromptSource": {
+          "@type": "AccountPromptFactory",
+          "webIdStore": { "@id": "urn:solid-server:default:WebIdStore" },
+          "cookieStore": { "@id": "urn:solid-server:default:CookieStore" },
+          "cookieName": { "@id": "urn:solid-server:default:value:accountCookieName" }
+        },
+        "rememberedPromptStore": { "@id": "urn:undefineds:xpod:RememberedClientGrantStore" }
+      }
+    },
+    {
+      "comment": "Keep CSS consent processing and persist the user's explicit remember-app choice.",
+      "@type": "Override",
+      "overrideInstance": { "@id": "urn:solid-server:default:ConsentHandler" },
+      "overrideParameters": {
+        "@type": "StatusWaterfallHandler",
+        "handlers": [
+          {
+            "@type": "MethodFilterHandler",
+            "methods": [ "GET" ],
+            "source": {
+              "@type": "ClientInfoHandler",
+              "providerFactory": { "@id": "urn:solid-server:default:IdentityProviderFactory" }
+            }
+          },
+          {
+            "@type": "MethodFilterHandler",
+            "methods": [ "POST" ],
+            "source": {
+              "@type": "RememberedConsentHandler",
+              "rememberedConsentProvider": { "@id": "urn:solid-server:default:IdentityProviderFactory" },
+              "rememberedConsentSource": {
+                "@type": "ConsentHandler",
+                "providerFactory": { "@id": "urn:solid-server:default:IdentityProviderFactory" }
+              },
+              "rememberedConsentStore": { "@id": "urn:undefineds:xpod:RememberedClientGrantStore" }
+            }
+          }
+        ]
+      }
+    },
     {
       "comment": "Close the profile-owned RDF authority after writes stop.",
       "@id": "urn:solid-server:default:CleanupFinalizer",
@@ -152,6 +219,7 @@
       },
       "overrideParameters": {
         "@type": "ScopedPickWebIdHandler",
+        "scopedRememberedGrantStore": { "@id": "urn:undefineds:xpod:RememberedClientGrantStore" },
         "ownershipResolver": {
           "@id": "urn:undefineds:xpod:PodOwnershipResolver"
         },

package/dist/components/components.jsonld

@@ -102,6 +102,9 @@
     "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld",
     "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld",
     "undefineds:dist/identity/oidc/LoopbackClientIdAdapterFactory.jsonld",
+    "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld",
+    "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld",
+    "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld",
     "undefineds:dist/identity/oidc/ScopedPickWebIdHandler.jsonld",
     "undefineds:dist/authentication/ConfiguredLoopbackDPoPWebIdExtractor.jsonld",
     "undefineds:dist/identity/AccountStorageBindingsHandler.jsonld",

package/dist/components/context.jsonld

@@ -3102,6 +3102,45 @@
           }
         }
       },
+      "RememberedClientGrantStore": {
+        "@id": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore",
+        "@prefix": true,
+        "@context": {
+          "storage": {
+            "@id": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore_storage"
+          }
+        }
+      },
+      "RememberedConsentHandler": {
+        "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler",
+        "@prefix": true,
+        "@context": {
+          "store": {
+            "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler_store"
+          },
+          "providerFactory": {
+            "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler_providerFactory"
+          },
+          "source": {
+            "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler_source"
+          },
+          "rFactory": {
+            "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler_providerFactory"
+          }
+        }
+      },
+      "RememberedClientPromptFactory": {
+        "@id": "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld#RememberedClientPromptFactory",
+        "@prefix": true,
+        "@context": {
+          "store": {
+            "@id": "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld#RememberedClientPromptFactory_store"
+          },
+          "source": {
+            "@id": "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld#RememberedClientPromptFactory_source"
+          }
+        }
+      },
       "ScopedPickWebIdHandler": {
         "@id": "undefineds:dist/identity/oidc/ScopedPickWebIdHandler.jsonld#ScopedPickWebIdHandler",
         "@prefix": true,
@@ -3118,6 +3157,9 @@
           "options_provisionBaseUrl": {
             "@id": "undefineds:dist/identity/oidc/ScopedPickWebIdHandler.jsonld#ScopedPickWebIdHandler_options_provisionBaseUrl"
           },
+          "options_rememberedClientGrantStore": {
+            "@id": "undefineds:dist/identity/oidc/ScopedPickWebIdHandler.jsonld#ScopedPickWebIdHandler_options_rememberedClientGrantStore"
+          },
           "ownershipResolver": {
             "@id": "undefineds:dist/identity/oidc/ScopedPickWebIdHandler.jsonld#ScopedPickWebIdHandler_options_ownershipResolver"
           },
@@ -3129,6 +3171,9 @@
           },
           "provisionBaseUrl": {
             "@id": "undefineds:dist/identity/oidc/ScopedPickWebIdHandler.jsonld#ScopedPickWebIdHandler_options_provisionBaseUrl"
+          },
+          "rememberedClientGrantStore": {
+            "@id": "undefineds:dist/identity/oidc/ScopedPickWebIdHandler.jsonld#ScopedPickWebIdHandler_options_rememberedClientGrantStore"
           }
         }
       },

package/dist/identity/oidc/RememberedClientGrantStore.d.ts

@@ -0,0 +1,18 @@
+import type { ExpiringStorage } from '@solid/community-server';
+import type { Grant, Provider } from 'oidc-provider';
+export declare const XPOD_DESKTOP_CLIENT_ID = "https://id.undefineds.co/app/xpod-desktop-client.json";
+export interface RememberedClientGrant {
+    accountId: string;
+    clientId: string;
+    grantId: string;
+    expires: number;
+}
+/** One authoritative account/client record, always validated against the provider's live grant. */
+export declare class RememberedClientGrantStore {
+    private readonly storage;
+    constructor(storage: ExpiringStorage<string, RememberedClientGrant>);
+    remember(grant: Grant): Promise<void>;
+    forget(accountId: string, clientId: string): Promise<void>;
+    find(provider: Provider, accountId: string, clientId: string): Promise<Grant | undefined>;
+    private clientKey;
+}

package/dist/identity/oidc/RememberedClientGrantStore.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RememberedClientGrantStore = exports.XPOD_DESKTOP_CLIENT_ID = void 0;
+exports.XPOD_DESKTOP_CLIENT_ID = 'https://id.undefineds.co/app/xpod-desktop-client.json';
+/** One authoritative account/client record, always validated against the provider's live grant. */
+class RememberedClientGrantStore {
+    constructor(storage) {
+        this.storage = storage;
+    }
+    async remember(grant) {
+        const { accountId, clientId, jti: grantId, exp } = grant;
+        if (!accountId || !clientId || !grantId || !exp || exp * 1000 <= Date.now()) {
+            return;
+        }
+        const entry = { accountId, clientId, grantId, expires: exp * 1000 };
+        await this.storage.set(this.clientKey(accountId, clientId), entry, new Date(entry.expires));
+    }
+    async forget(accountId, clientId) {
+        await this.storage.delete(this.clientKey(accountId, clientId));
+    }
+    async find(provider, accountId, clientId) {
+        const entry = await this.storage.get(this.clientKey(accountId, clientId));
+        if (!entry || entry.accountId !== accountId || entry.clientId !== clientId || entry.expires <= Date.now()) {
+            return undefined;
+        }
+        const grant = await provider.Grant.find(entry.grantId);
+        if (!grant || grant.accountId !== accountId || grant.clientId !== clientId ||
+            !grant.exp || grant.exp * 1000 <= Date.now()) {
+            return undefined;
+        }
+        return grant;
+    }
+    clientKey(accountId, clientId) {
+        return encodeURIComponent(JSON.stringify(['remembered-client', accountId, clientId]));
+    }
+}
+exports.RememberedClientGrantStore = RememberedClientGrantStore;
+//# sourceMappingURL=RememberedClientGrantStore.js.map

package/dist/identity/oidc/RememberedClientGrantStore.jsonld

@@ -0,0 +1,61 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore",
+      "@type": "Class",
+      "requireElement": "RememberedClientGrantStore",
+      "comment": "One authoritative account/client record, always validated against the provider's live grant.",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore_storage",
+          "range": {
+            "@type": "ParameterRangeGenericComponent",
+            "component": "css:dist/storage/keyvalue/ExpiringStorage.jsonld#ExpiringStorage",
+            "genericTypeInstances": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeWildcard"
+              }
+            ]
+          }
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore__member_storage",
+          "memberFieldName": "storage"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore__member_remember",
+          "memberFieldName": "remember"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore__member_forget",
+          "memberFieldName": "forget"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore__member_find",
+          "memberFieldName": "find"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore__member_clientKey",
+          "memberFieldName": "clientKey"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore_storage"
+        }
+      ]
+    }
+  ]
+}

package/dist/identity/oidc/RememberedClientPromptFactory.d.ts

@@ -0,0 +1,10 @@
+import { PromptFactory } from '@solid/community-server';
+import { interactionPolicy } from 'oidc-provider';
+import { RememberedClientGrantStore } from './RememberedClientGrantStore';
+/** Runs after the existing account and WebID checks, before any consent checks. */
+export declare class RememberedClientPromptFactory extends PromptFactory {
+    private readonly source;
+    private readonly store;
+    constructor(source: PromptFactory, store: RememberedClientGrantStore);
+    handle(policy: interactionPolicy.DefaultPolicy): Promise<void>;
+}

package/dist/identity/oidc/RememberedClientPromptFactory.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RememberedClientPromptFactory = void 0;
+const community_server_1 = require("@solid/community-server");
+const oidc_provider_1 = require("oidc-provider");
+const RememberedClientGrantStore_1 = require("./RememberedClientGrantStore");
+/** Runs after the existing account and WebID checks, before any consent checks. */
+class RememberedClientPromptFactory extends community_server_1.PromptFactory {
+    constructor(source, store) {
+        super();
+        this.source = source;
+        this.store = store;
+    }
+    async handle(policy) {
+        await this.source.handleSafe(policy);
+        const consent = policy.get('consent');
+        const native = consent?.checks.get('native_client_prompt');
+        const consentIndex = policy.findIndex((prompt) => prompt.name === 'consent');
+        const loginIndex = policy.findIndex((prompt) => prompt.name === 'login');
+        if (!consent || !native || loginIndex < 0 || loginIndex >= consentIndex) {
+            throw new community_server_1.InternalServerError('Missing ordered default login and consent policies.');
+        }
+        const remembered = new WeakSet();
+        policy.add(new oidc_provider_1.interactionPolicy.Prompt({ name: 'restore_remembered_client', requestable: false }, new oidc_provider_1.interactionPolicy.Check('restore_remembered_client', 'Restore previously remembered consent.', async (ctx) => {
+            const { oidc } = ctx;
+            const accountId = oidc.session?.accountId;
+            const clientId = oidc.client?.clientId;
+            if (!accountId || clientId !== RememberedClientGrantStore_1.XPOD_DESKTOP_CLIENT_ID || oidc.result?.consent) {
+                return false;
+            }
+            const grant = await this.store.find(oidc.provider, accountId, clientId);
+            if (grant) {
+                oidc.session.ensureClientContainer(clientId);
+                oidc.session.grantIdFor(clientId, grant.jti);
+                oidc.entity('Grant', grant);
+                remembered.add(ctx);
+            }
+            return false;
+        })), consentIndex);
+        const originalCheck = native.check;
+        native.check = async (ctx) => remembered.has(ctx) ? false : originalCheck(ctx);
+    }
+}
+exports.RememberedClientPromptFactory = RememberedClientPromptFactory;
+//# sourceMappingURL=RememberedClientPromptFactory.js.map

package/dist/identity/oidc/RememberedClientPromptFactory.jsonld

@@ -0,0 +1,54 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld#RememberedClientPromptFactory",
+      "@type": "Class",
+      "requireElement": "RememberedClientPromptFactory",
+      "extends": [
+        "css:dist/identity/configuration/PromptFactory.jsonld#PromptFactory"
+      ],
+      "comment": "Runs after the existing account and WebID checks, before any consent checks.",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld#RememberedClientPromptFactory_store",
+          "range": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld#RememberedClientPromptFactory_source",
+          "range": "css:dist/identity/configuration/PromptFactory.jsonld#PromptFactory"
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld#RememberedClientPromptFactory__member_source",
+          "memberFieldName": "source"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld#RememberedClientPromptFactory__member_store",
+          "memberFieldName": "store"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld#RememberedClientPromptFactory__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld#RememberedClientPromptFactory__member_handle",
+          "memberFieldName": "handle"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld#RememberedClientPromptFactory_source"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld#RememberedClientPromptFactory_store"
+        }
+      ]
+    }
+  ]
+}

package/dist/identity/oidc/RememberedConsentHandler.d.ts

@@ -0,0 +1,11 @@
+import { JsonInteractionHandler, type JsonInteractionHandlerInput, type JsonRepresentation, type ProviderFactory } from '@solid/community-server';
+import { RememberedClientGrantStore } from './RememberedClientGrantStore';
+/** Records successful CSS consent without replacing its grant or interaction handling. */
+export declare class RememberedConsentHandler extends JsonInteractionHandler {
+    private readonly providerFactory;
+    private readonly source;
+    private readonly store;
+    constructor(providerFactory: ProviderFactory, source: JsonInteractionHandler, store: RememberedClientGrantStore);
+    canHandle(input: JsonInteractionHandlerInput): Promise<void>;
+    handle(input: JsonInteractionHandlerInput): Promise<JsonRepresentation>;
+}

package/dist/identity/oidc/RememberedConsentHandler.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RememberedConsentHandler = void 0;
+const community_server_1 = require("@solid/community-server");
+const yup_1 = require("yup");
+const RememberedClientGrantStore_1 = require("./RememberedClientGrantStore");
+const rememberSchema = (0, yup_1.object)({ remember: (0, yup_1.boolean)().default(false) });
+/** Records successful CSS consent without replacing its grant or interaction handling. */
+class RememberedConsentHandler extends community_server_1.JsonInteractionHandler {
+    constructor(providerFactory, source, store) {
+        super();
+        this.providerFactory = providerFactory;
+        this.source = source;
+        this.store = store;
+    }
+    async canHandle(input) {
+        await this.source.canHandle(input);
+    }
+    async handle(input) {
+        const interaction = input.oidcInteraction;
+        const previousResult = interaction?.result;
+        try {
+            return await this.source.handleSafe(input);
+        }
+        catch (error) {
+            if (!(error instanceof community_server_1.FoundHttpError) || !interaction?.result?.consent ||
+                interaction.result === previousResult) {
+                throw error;
+            }
+            const accountId = interaction.session?.accountId;
+            const clientId = interaction.params.client_id;
+            const grantId = interaction.result.consent.grantId ?? interaction.grantId;
+            if (accountId && clientId === RememberedClientGrantStore_1.XPOD_DESKTOP_CLIENT_ID && grantId) {
+                const provider = await this.providerFactory.getProvider();
+                const grant = await provider.Grant.find(grantId);
+                if (grant?.accountId === accountId && grant.clientId === clientId) {
+                    const { remember } = await rememberSchema.validate(input.json);
+                    if (remember) {
+                        await this.store.remember(grant);
+                    }
+                    else {
+                        await this.store.forget(accountId, clientId);
+                    }
+                }
+            }
+            throw error;
+        }
+    }
+}
+exports.RememberedConsentHandler = RememberedConsentHandler;
+//# sourceMappingURL=RememberedConsentHandler.js.map

package/dist/identity/oidc/RememberedConsentHandler.jsonld

@@ -0,0 +1,69 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler",
+      "@type": "Class",
+      "requireElement": "RememberedConsentHandler",
+      "extends": [
+        "css:dist/identity/interaction/JsonInteractionHandler.jsonld#JsonInteractionHandler"
+      ],
+      "comment": "Records successful CSS consent without replacing its grant or interaction handling.",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler_store",
+          "range": "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld#RememberedClientGrantStore"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler_providerFactory",
+          "range": "css:dist/identity/configuration/ProviderFactory.jsonld#ProviderFactory"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler_source",
+          "range": "css:dist/identity/interaction/JsonInteractionHandler.jsonld#JsonInteractionHandler"
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler__member_providerFactory",
+          "memberFieldName": "providerFactory"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler__member_source",
+          "memberFieldName": "source"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler__member_store",
+          "memberFieldName": "store"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler__member_canHandle",
+          "memberFieldName": "canHandle"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler__member_handle",
+          "memberFieldName": "handle"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler_providerFactory"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler_source"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld#RememberedConsentHandler_store"
+        }
+      ]
+    }
+  ]
+}

package/dist/identity/oidc/ScopedPickWebIdHandler.d.ts

@@ -1,11 +1,13 @@
 import { JsonInteractionHandler } from '@solid/community-server';
 import type { JsonInteractionHandlerInput, JsonRepresentation, JsonView, ProviderFactory } from '@solid/community-server';
 import type { PodOwnershipResolver } from './PodOwnershipResolver';
+import { RememberedClientGrantStore } from './RememberedClientGrantStore';
 export interface ScopedPickWebIdHandlerOptions {
     ownershipResolver: PodOwnershipResolver;
     providerFactory: ProviderFactory;
     storageBaseUrl?: string;
     provisionBaseUrl?: string;
+    rememberedClientGrantStore?: RememberedClientGrantStore;
 }
 /**
  * CSS-compatible WebID picker scoped to the current storage provider.
@@ -21,9 +23,11 @@ export declare class ScopedPickWebIdHandler extends JsonInteractionHandler imple
     private readonly providerFactory;
     private readonly storageBaseUrl?;
     private readonly provisionBaseUrl?;
+    private readonly rememberedClientGrantStore?;
     constructor(options: ScopedPickWebIdHandlerOptions);
     getView({ accountId, oidcInteraction }: JsonInteractionHandlerInput): Promise<JsonRepresentation>;
     handle({ oidcInteraction, accountId, json }: JsonInteractionHandlerInput): Promise<never>;
+    private clearSelectedWebId;
     private resolveScopedEntries;
     private resolveTargetStorage;
 }

package/dist/identity/oidc/ScopedPickWebIdHandler.js

@@ -5,6 +5,7 @@ const yup_1 = require("yup");
 const global_logger_factory_1 = require("global-logger-factory");
 const community_server_1 = require("@solid/community-server");
 const ProvisionCodeCodec_1 = require("../../provision/ProvisionCodeCodec");
+const RememberedClientGrantStore_1 = require("./RememberedClientGrantStore");
 const inSchema = (0, yup_1.object)({
     webId: (0, yup_1.string)().trim().required(),
     remember: (0, yup_1.boolean)().default(false),
@@ -25,6 +26,7 @@ class ScopedPickWebIdHandler extends community_server_1.JsonInteractionHandler {
         this.providerFactory = options.providerFactory;
         this.storageBaseUrl = normalizeOptionalUrl(options.storageBaseUrl);
         this.provisionBaseUrl = normalizeOptionalUrl(options.provisionBaseUrl);
+        this.rememberedClientGrantStore = options.rememberedClientGrantStore;
     }
     async getView({ accountId, oidcInteraction }) {
         (0, community_server_1.assertAccountId)(accountId);
@@ -51,7 +53,7 @@ class ScopedPickWebIdHandler extends community_server_1.JsonInteractionHandler {
             this.logger.warn('Rejected an unverified WebID selection; ownership could not be established');
             throw new community_server_1.BadRequestHttpError('WebID does not belong to this storage provider.');
         }
-        await (0, community_server_1.forgetWebId)(provider, oidcInteraction);
+        await this.clearSelectedWebId(provider, oidcInteraction);
         const location = await (0, community_server_1.finishInteraction)(oidcInteraction, {
             login: {
                 accountId: webId,
@@ -60,6 +62,28 @@ class ScopedPickWebIdHandler extends community_server_1.JsonInteractionHandler {
         }, true);
         throw new community_server_1.FoundHttpError(location);
     }
+    async clearSelectedWebId(provider, interaction) {
+        const clientId = interaction.params.client_id;
+        const accountId = interaction.session?.accountId;
+        const remembered = accountId && clientId === RememberedClientGrantStore_1.XPOD_DESKTOP_CLIENT_ID && interaction.grantId
+            ? await this.rememberedClientGrantStore?.find(provider, accountId, clientId)
+            : undefined;
+        if (!remembered || remembered.jti !== interaction.grantId) {
+            await (0, community_server_1.forgetWebId)(provider, interaction);
+            return;
+        }
+        // Preserve only explicitly remembered consent. Detach every current grant
+        // reference so oidc-provider can establish the selected WebID's own grant.
+        const session = await provider.Session.find(interaction.session.cookie);
+        if (session) {
+            delete session.accountId;
+            delete session.authorizationFor(RememberedClientGrantStore_1.XPOD_DESKTOP_CLIENT_ID).grantId;
+            await session.persist();
+        }
+        delete interaction.grantId;
+        delete interaction.result?.consent;
+        delete interaction.lastSubmission?.consent;
+    }
     async resolveScopedEntries(accountId, target) {
         try {
             const candidateWebIds = await this.ownershipResolver.listAccountWebIds(accountId);