@wtfalch/auth 0.6.0 → 0.8.0

package/README.md

@@ -139,11 +139,24 @@ app URL, and refreshes itself when the id token is close to expiring.
 `ORG_CLAIM` is enforced on every token: a token from another organisation is
 refused even when the issuer and the signature are good.
 
+## Passkeys and QR sign-in
+
+Passkeys live on each app's own domain: the relying-party ID is the app's
+origin, so one made on one app never signs in on another. `@wtfalch/auth/passkey`
+is the browser half of the WebAuthn ceremony; `startPasskeyRegistration`,
+`finishPasskeyRegistration`, `startPasskeySignIn` and `finishPasskeySignIn` are
+the server half.
+
+A phone that is already signed in can also approve a new device from a QR
+code, the issuer's OAuth device grant opted into per namespace binding with
+`qrSignIn: true`, through `startQrSignIn` and `pollQrSignIn`.
+
 ## Documentation
 
 `docs/adopting.md` in [wtfalch/auth](https://github.com/wtfalch/auth) covers a
-full adoption: the files to add, the email flows, invitations, refresh, and the
-checks to run against a real issuer.
+full adoption: the files to add, the email flows, invitations, refresh,
+passkeys, signing in a new device from a QR code, and the checks to run
+against a real issuer.
 
 ## Licence
 

package/dist/auth.d.ts

@@ -65,6 +65,26 @@ export type SignUpResult = {
     error: SignUpError;
     message: string;
 };
+export interface PasskeyRegistrationStart {
+    passkeyId: string;
+    /** ZITADEL's `publicKeyCredentialCreationOptions`, opaque here -- `@wtfalch/auth/passkey`'s `createPasskey` knows its shape. */
+    options: unknown;
+}
+export type PasskeyRegistrationResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: 'invalid';
+};
+export type PasskeySignInStart = {
+    ok: true;
+    sessionId: string;
+    /** ZITADEL's `publicKeyCredentialRequestOptions`, opaque here -- `@wtfalch/auth/passkey`'s `getPasskey` knows its shape. */
+    options: unknown;
+} | {
+    ok: false;
+    error: SignInError;
+};
 export interface Completed {
     location: string;
     cookies: SetCookie[];
@@ -80,6 +100,27 @@ export type SignedIn = {
     error: ResetError;
     message: string;
 };
+export interface QrSignInStart {
+    /** The verification URL, complete with the user code -- what the QR code encodes. */
+    url: string;
+    /** The same code, for a person to type in by hand instead of scanning. */
+    userCode: string;
+    expiresIn: number;
+    /** Seconds between polls; the issuer's own pace. */
+    interval: number;
+    cookies: SetCookie[];
+}
+export type QrPollStatus = 'pending' | 'slow_down' | 'expired' | 'denied'
+/** Namespace mode: the binding stopped being active between approval and this poll. */
+ | 'unavailable'
+/** The issuer's token response or the id token it carried was rejected -- `reason` is the same vocabulary `auth_error` uses. */
+ | 'failed' | 'signed_in';
+export interface QrPollResult {
+    status: QrPollStatus;
+    /** Set only when `status` is `'failed'`. */
+    reason?: string;
+    cookies: SetCookie[];
+}
 export interface Auth {
     readonly sessionCookieName: string;
     /** GET {basePath}/start?next=&intent= : begins the OIDC flow; the issuer sends the browser to {basePath}/login?authRequest= */
@@ -199,6 +240,48 @@ export interface Auth {
     signUp(input: {
         authRequestId: string;
     } & NewUser): Promise<SignUpResult>;
+    /**
+     * Starts registering a passkey on this app's own domain, for whoever is
+     * signed in on `request` -- never for a stranger. Throws `AuthError` when
+     * nobody is: `account_changed`/`unavailable` exactly as `read` reports
+     * them, `unauthenticated` otherwise.
+     */
+    startPasskeyRegistration(request: Request): Promise<PasskeyRegistrationStart>;
+    /** The second half of `startPasskeyRegistration`. Same signed-in requirement. */
+    finishPasskeyRegistration(request: Request, input: {
+        passkeyId: string;
+        credential: unknown;
+        name: string;
+    }): Promise<PasskeyRegistrationResult>;
+    /** The passkey half of `signIn`: a challenge to answer with `@wtfalch/auth/passkey`'s `getPasskey`. */
+    startPasskeySignIn(input: {
+        authRequestId: string;
+        email: string;
+    }): Promise<PasskeySignInStart>;
+    /** The second half of a passkey sign-in -- otherwise exactly `signIn`: same redirect and hosted-login handling, same error mapping. */
+    finishPasskeySignIn(input: {
+        authRequestId: string;
+        sessionId: string;
+        credential: unknown;
+    }): Promise<SignInResult>;
+    /**
+     * Starts a QR sign-in: the OAuth device authorization grant, on this app's
+     * own web client. `url` is what the QR code encodes (and `userCode` what a
+     * person types instead); a phone already signed in approves it, and
+     * `pollQrSignIn` is how this device finds out. In namespace mode, throws
+     * `AuthError('unavailable', ...)` when the binding is not active -- unlike
+     * `start`, which answers a 503 `Response` for the same case rather than
+     * throwing.
+     */
+    startQrSignIn(): Promise<QrSignInStart>;
+    /**
+     * Polls the transaction `startQrSignIn` began; `request` carries its
+     * cookie. Never throws for an outcome of the poll itself -- a suspended
+     * binding or a rejected token response answers `'unavailable'`/`'failed'`
+     * with the transaction cookie cleared, the same way `complete` answers a
+     * failed callback rather than throwing.
+     */
+    pollQrSignIn(request: Request): Promise<QrPollResult>;
 }
 export declare function createAuth(input: AuthOptions): Auth;
 export type { AuthRequest, NewUser, SetCookie };

package/dist/auth.js

@@ -2,9 +2,10 @@ import { errors } from 'jose';
 import * as client from 'openid-client';
 import { Broker, BrokerError } from './broker.js';
 import { resolveOptions } from './config.js';
-import { clearSession, clearTransaction, cookieFrom, openSession, openTransaction, sealSession, sealTransaction, sessionCookieName, transactionCookieName, } from './cookies.js';
+import { clearQrTransaction, clearSession, clearTransaction, cookieFrom, openQrTransaction, openSession, openTransaction, qrTransactionCookieName, sealQrTransaction, sealSession, sealTransaction, sessionCookieName, transactionCookieName, } from './cookies.js';
 import { namespaceSessions } from './namespace-session.js';
-import { AuthError, ORG_CLAIM, Oidc } from './oidc.js';
+import { AuthError, ORG_CLAIM, Oidc, scopeFor } from './oidc.js';
+import { pollDeviceToken, requestDeviceAuthorization } from './qr.js';
 import { safeNextPath } from './redirect.js';
 export function createAuth(input) {
     // Resolved on first use so `next build`, which imports every route module, needs none of the values set.
@@ -59,6 +60,19 @@ export function createAuth(input) {
     const sessionCookie = (tokens) => options().namespace
         ? sessions.create(tokens)
         : sealSession(options(), { idt: tokens.idToken, rt: tokens.refreshToken });
+    /**
+     * Signing in again replaces this binding's previous session outright: in
+     * namespace mode, ends whatever session record `cookieHeader` already
+     * named. Shared by `complete` and `pollQrSignIn`, the two places a fresh
+     * session is created for a browser that may already hold one.
+     */
+    const replacePreviousSession = async (cookieHeader) => {
+        if (!options().namespace)
+            return;
+        await sessions
+            .end(cookieFrom(cookieHeader, sessionCookieName(options())))
+            .catch((error) => console.error('@wtfalch/auth: could not end the replaced session', error));
+    };
     const unavailable = () => new Response('Sign-in is unavailable for this workspace', { status: 503 });
     const startUrl = (next, intent = 'login') => {
         const url = new URL(`${options().basePath}/start`, options().appUrl);
@@ -114,11 +128,7 @@ export function createAuth(input) {
         catch (error) {
             return failure(reasonOf(error), [cleared]);
         }
-        // Signing in again replaces this binding's previous session outright.
-        if (options().namespace)
-            await sessions
-                .end(cookieFrom(cookieHeader, sessionCookieName(options())))
-                .catch((error) => console.error('@wtfalch/auth: could not end the replaced session', error));
+        await replacePreviousSession(cookieHeader);
         return {
             location: new URL(transaction.nx, options().appUrl).href,
             cookies: [cleared, session],
@@ -256,6 +266,22 @@ export function createAuth(input) {
             return { kind: 'deny', cookies };
         return { kind: 'redirect', location: startUrl(`${url.pathname}${url.search}`), cookies };
     };
+    /**
+     * The person signed in on `request`, for the passkey routes -- never a
+     * stranger. Adapts `requireUser`'s reasons for a caller that throws rather
+     * than redirects: `account_changed`/`unavailable` are read's own, and
+     * plain absence becomes `unauthenticated`, which read has no reason for.
+     */
+    const currentUser = async (request) => {
+        const { user, accountChanged, unavailable } = await read(request, { refresh: false });
+        if (accountChanged)
+            throw new AuthError('account_changed', 'Choose an account to continue');
+        if (unavailable)
+            throw new AuthError('unavailable', 'Sign-in is unavailable for this workspace');
+        if (!user)
+            throw new AuthError('unauthenticated', 'sign in to use a passkey');
+        return user;
+    };
     const people = (options) => broker().people(options);
     const setPersonActive = async (userId, active) => {
         const result = await broker().setPersonActive(userId, active);
@@ -417,6 +443,114 @@ export function createAuth(input) {
             return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
         }
     };
+    const startPasskeyRegistration = async (request) => {
+        const user = await currentUser(request);
+        return broker().startPasskeyRegistration(user.id);
+    };
+    const finishPasskeyRegistration = async (request, input) => {
+        const user = await currentUser(request);
+        // Built from named fields, never spread: `input` crosses a trust
+        // boundary (a Next.js Server Action does not enforce its TS parameter
+        // types on the wire), and a spread after `userId: user.id` would let a
+        // caller-supplied `userId` key overwrite the session's own identity.
+        const passkeyId = input?.passkeyId;
+        const name = typeof input?.name === 'string' ? input.name.trim() : '';
+        const credential = input?.credential;
+        if (typeof passkeyId !== 'string' ||
+            passkeyId.length === 0 ||
+            name.length === 0 ||
+            name.length > 64 ||
+            !credential ||
+            typeof credential !== 'object' ||
+            Array.isArray(credential)) {
+            return { ok: false, error: 'invalid' };
+        }
+        try {
+            await broker().finishPasskeyRegistration({ userId: user.id, passkeyId, credential, name });
+            return { ok: true };
+        }
+        catch (error) {
+            if (error instanceof BrokerError && error.status < 500)
+                return { ok: false, error: 'invalid' };
+            throw error;
+        }
+    };
+    const startPasskeySignIn = async ({ authRequestId, email, }) => {
+        try {
+            const { sessionId, options } = await broker().startPasskeySignIn({ authRequestId, email });
+            return { ok: true, sessionId, options };
+        }
+        catch (error) {
+            return { ok: false, error: signInError(error) };
+        }
+    };
+    const finishPasskeySignIn = async ({ authRequestId, sessionId, credential, }) => {
+        try {
+            return {
+                ok: true,
+                redirectTo: await broker().finishPasskeySignIn({ authRequestId, sessionId, credential }),
+            };
+        }
+        catch (error) {
+            if (needsHostedLogin(error))
+                return { ok: true, redirectTo: hostedUrl(authRequestId), hosted: true };
+            return { ok: false, error: signInError(error) };
+        }
+    };
+    const startQrSignIn = async () => {
+        if (options().namespace && !(await sessions.bindingActive()))
+            throw new AuthError('unavailable', 'the namespace binding is not active');
+        const device = await requestDeviceAuthorization(options(), scopeFor(options().organizationId));
+        const cookie = await sealQrTransaction(options(), { dc: device.deviceCode, iv: device.interval }, device.expiresIn);
+        return {
+            url: device.verificationUriComplete,
+            userCode: device.userCode,
+            expiresIn: device.expiresIn,
+            interval: device.interval,
+            cookies: [cookie],
+        };
+    };
+    const pollQrSignIn = async (request) => {
+        const cleared = clearQrTransaction(options());
+        const transaction = await openQrTransaction(options(), cookieFrom(request.headers.get('cookie'), qrTransactionCookieName(options())));
+        // Missing, tampered, another binding's, or its own `exp` (the issuer's
+        // `expires_in`, sealed in by `startQrSignIn`) already past: all the same
+        // refusal a stranger's cookie gets everywhere else in this file.
+        if (!transaction)
+            return { status: 'expired', cookies: [cleared] };
+        // An outcome of the poll itself -- a rejected token response, or an id
+        // token that fails validation (wrong organisation, bad signature) --
+        // answers rather than throws, exactly as `complete` answers a failed
+        // exchange with `failure(reasonOf(error), ...)` instead of throwing it.
+        let outcome;
+        try {
+            outcome = await pollDeviceToken(options(), oidc(), transaction.dc);
+        }
+        catch (error) {
+            return { status: 'failed', reason: reasonOf(error), cookies: [cleared] };
+        }
+        if (outcome.status === 'pending')
+            return { status: 'pending', cookies: [] };
+        if (outcome.status === 'slow_down')
+            return { status: 'slow_down', cookies: [] };
+        if (outcome.status === 'expired')
+            return { status: 'expired', cookies: [cleared] };
+        if (outcome.status === 'denied')
+            return { status: 'denied', cookies: [cleared] };
+        // The binding can go suspended between approval and this poll landing;
+        // that is this outcome, not a programmer error, so it answers too.
+        if (options().namespace && !(await sessions.bindingActive()))
+            return { status: 'unavailable', cookies: [cleared] };
+        let session;
+        try {
+            session = await sessionCookie(outcome.tokens);
+        }
+        catch (error) {
+            return { status: 'failed', reason: reasonOf(error), cookies: [cleared] };
+        }
+        await replacePreviousSession(request.headers.get('cookie'));
+        return { status: 'signed_in', cookies: [cleared, session] };
+    };
     const failure = (reason, cookies) => {
         const url = new URL(options().onError, options().appUrl);
         url.searchParams.set('auth_error', reason);
@@ -456,6 +590,12 @@ export function createAuth(input) {
         authRequest,
         signIn,
         signUp,
+        startPasskeyRegistration,
+        finishPasskeyRegistration,
+        startPasskeySignIn,
+        finishPasskeySignIn,
+        startQrSignIn,
+        pollQrSignIn,
     };
 }
 function redirect(location, cookies, status = 302) {

package/dist/broker.d.ts

@@ -63,6 +63,30 @@ export declare class Broker {
     signUp(input: {
         authRequestId: string;
     } & NewUser): Promise<string>;
+    /** A passkey for somebody already signed in on the app's own domain. */
+    startPasskeyRegistration(userId: string): Promise<{
+        passkeyId: string;
+        options: unknown;
+    }>;
+    finishPasskeyRegistration(input: {
+        userId: string;
+        passkeyId: string;
+        credential: unknown;
+        name: string;
+    }): Promise<void>;
+    /** The passkey half of `signIn`: a challenge to answer, not yet a session. */
+    startPasskeySignIn(input: {
+        authRequestId: string;
+        email: string;
+    }): Promise<{
+        sessionId: string;
+        options: unknown;
+    }>;
+    finishPasskeySignIn(input: {
+        authRequestId: string;
+        sessionId: string;
+        credential: unknown;
+    }): Promise<string>;
     followLink(input: {
         authRequestId: string;
         sessionId: string;
@@ -89,11 +113,14 @@ export declare class Broker {
     /**
      * What the service routes this key to. A suspended binding's key is refused.
      * Bounded, because every namespace request waits on this answer when it is due.
+     * `revoked` names the organization's recently deactivated people. It is absent
+     * from an older service, or while the service cannot ask the issuer.
      */
     binding(): Promise<{
         organizationId: string;
         clientIds: string[];
         origins: string[];
+        revoked?: string[];
     }>;
     verifyEmail(userId: string, code: string): Promise<unknown>;
     /** A public client revoking its own token: no key, no service. */

package/dist/broker.js

@@ -76,6 +76,21 @@ export class Broker {
         });
         return callbackUrl;
     }
+    /** A passkey for somebody already signed in on the app's own domain. */
+    startPasskeyRegistration(userId) {
+        return this.call('POST', '/passkey/register/start', { userId });
+    }
+    async finishPasskeyRegistration(input) {
+        await this.call('POST', '/passkey/register/finish', input);
+    }
+    /** The passkey half of `signIn`: a challenge to answer, not yet a session. */
+    startPasskeySignIn(input) {
+        return this.call('POST', '/passkey/start', input);
+    }
+    async finishPasskeySignIn(input) {
+        const { callbackUrl } = await this.call('POST', '/passkey/finish', input);
+        return callbackUrl;
+    }
     async followLink(input) {
         const { callbackUrl } = await this.call('POST', '/link/follow', input);
         return callbackUrl;
@@ -99,6 +114,8 @@ export class Broker {
     /**
      * What the service routes this key to. A suspended binding's key is refused.
      * Bounded, because every namespace request waits on this answer when it is due.
+     * `revoked` names the organization's recently deactivated people. It is absent
+     * from an older service, or while the service cannot ask the issuer.
      */
     binding() {
         return this.call('GET', '/binding', {}, AbortSignal.timeout(5_000));

package/dist/cookies.d.ts

@@ -28,6 +28,11 @@ export interface LinkPayload extends JWTPayload {
     stk: string;
     ar: string;
 }
+/** The QR device-grant transaction: the device_code, never handed to the caller, and the interval the issuer asked us to poll at. Its own `exp` -- set to the issuer's `expires_in` -- is what makes an unsealed-past-expiry cookie fail open with the others below. */
+export interface QrTransactionPayload extends JWTPayload {
+    dc: string;
+    iv: number;
+}
 export interface SetCookie {
     name: string;
     value: string;
@@ -52,6 +57,15 @@ export declare function digest(value: string): Promise<string>;
 export declare function sealTransaction(options: ResolvedOptions, payload: Omit<TransactionPayload, keyof JWTPayload>): Promise<SetCookie>;
 export declare function openTransaction(options: ResolvedOptions, value: string | undefined): Promise<TransactionPayload | null>;
 export declare function clearTransaction(options: ResolvedOptions): SetCookie;
+export declare function qrTransactionCookieName(options: ResolvedOptions): string;
+/**
+ * `ttl` is the issuer's own `expires_in` for the device code, not a fixed
+ * constant like the other transactions: the cookie must not outlive what it
+ * points at.
+ */
+export declare function sealQrTransaction(options: ResolvedOptions, payload: Omit<QrTransactionPayload, keyof JWTPayload>, ttl: number): Promise<SetCookie>;
+export declare function openQrTransaction(options: ResolvedOptions, value: string | undefined): Promise<QrTransactionPayload | null>;
+export declare function clearQrTransaction(options: ResolvedOptions): SetCookie;
 export declare function linkCookieName(options: ResolvedOptions): string;
 export declare function sealLink(options: ResolvedOptions, payload: Omit<LinkPayload, keyof JWTPayload>): Promise<SetCookie>;
 export declare function openLink(options: ResolvedOptions, value: string | undefined): Promise<LinkPayload | null>;

package/dist/cookies.js

@@ -3,6 +3,7 @@ import { AuthError } from './oidc.js';
 const SESSION = 'wtfalch_auth';
 const TRANSACTION = 'wtfalch_auth_tx';
 const LINK = 'wtfalch_auth_link';
+const QR = 'wtfalch_auth_qr';
 const TRANSACTION_TTL = 10 * 60;
 /**
  * A namespace session handle lives as long as a browser will keep a cookie.
@@ -80,6 +81,27 @@ export async function openTransaction(options, value) {
 export function clearTransaction(options) {
     return setCookie(transactionCookieName(options), '', 0, options.secure);
 }
+export function qrTransactionCookieName(options) {
+    return options.secure ? `__Host-${QR}` : QR;
+}
+/**
+ * `ttl` is the issuer's own `expires_in` for the device code, not a fixed
+ * constant like the other transactions: the cookie must not outlive what it
+ * points at.
+ */
+export async function sealQrTransaction(options, payload, ttl) {
+    const value = await seal(options, 'qr', payload, ttl);
+    return setCookie(qrTransactionCookieName(options), value, ttl, options.secure);
+}
+export async function openQrTransaction(options, value) {
+    const payload = await open(options, 'qr', value);
+    return payload && typeof payload.dc === 'string' && typeof payload.iv === 'number'
+        ? payload
+        : null;
+}
+export function clearQrTransaction(options) {
+    return setCookie(qrTransactionCookieName(options), '', 0, options.secure);
+}
 export function linkCookieName(options) {
     return options.secure ? `__Host-${LINK}` : LINK;
 }

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { type Auth, type AuthRequest, type Gate, type GateRules, type Intent, type NewUser, type ReadResult, type ResetError, type SignInError, type SignInResult, type SignUpError, type SignUpResult, type SignedIn, type User, createAuth, } from './auth.js';
+export { type Auth, type AuthRequest, type Gate, type GateRules, type Intent, type NewUser, type PasskeyRegistrationResult, type PasskeyRegistrationStart, type PasskeySignInStart, type QrPollResult, type QrPollStatus, type QrSignInStart, type ReadResult, type ResetError, type SignInError, type SignInResult, type SignUpError, type SignUpResult, type SignedIn, type User, createAuth, } from './auth.js';
 export { type AuthOptions, ISSUER } from './config.js';
 export type { SetCookie } from './cookies.js';
 export type { SessionRecord, SessionStore, SessionUpdate } from './sessions.js';

package/dist/namespace-server.js

@@ -1,7 +1,7 @@
 import { jwtDecrypt } from 'jose';
 import { resolveOptions } from './config.js';
 import { cookieFrom, openTransaction, transactionCookieName } from './cookies.js';
-import { parseNamespaceRegistry, } from './namespaces.js';
+import { isWebService, parseNamespaceRegistry, } from './namespaces.js';
 /** Resolve a shared callback from its authenticated transaction, never a URL
  * namespace hint. The second open checks the entire current registry binding. */
 export async function resolveNamespaceCallback(input) {
@@ -9,12 +9,16 @@ export async function resolveNamespaceCallback(input) {
         const registry = parseNamespaceRegistry(input.registry);
         const callback = new URL(`${input.basePath ?? '/auth'}/callback`, input.appOrigin).href;
         const candidates = registry.namespaces.filter((n) => n.status === 'active' &&
-            n.services.some((s) => s.serviceId === input.serviceId &&
+            n.services
+                .filter(isWebService)
+                .some((s) => s.serviceId === input.serviceId &&
                 s.deploymentId === input.deploymentId &&
                 s.appOrigin === input.appOrigin &&
                 s.redirectUris.includes(callback)));
         const optionsFor = (namespace) => {
-            const service = namespace.services.find((s) => s.serviceId === input.serviceId && s.deploymentId === input.deploymentId);
+            const service = namespace.services
+                .filter(isWebService)
+                .find((s) => s.serviceId === input.serviceId && s.deploymentId === input.deploymentId);
             if (!service)
                 throw new Error('Missing service');
             const selection = {

package/dist/namespace-session.js

@@ -35,15 +35,40 @@ export function namespaceSessions(deps) {
     let status = null;
     let retryAt = 0;
     let pending = null;
+    // People whose sessions this instance has already ended for the current
+    // deactivation. Someone who leaves the list, by reactivation or by ageing
+    // out of the service's window, is forgotten, so a second deactivation
+    // ends their sessions again.
+    const ended = new Set();
+    const endDeactivated = async (revoked) => {
+        if (!Array.isArray(revoked))
+            return;
+        const current = new Set(revoked.filter((s) => typeof s === 'string' && !!s));
+        for (const subject of ended)
+            if (!current.has(subject))
+                ended.delete(subject);
+        for (const subject of current) {
+            if (ended.has(subject))
+                continue;
+            await revokeSubject(subject);
+            ended.add(subject);
+        }
+    };
     const askService = async () => {
         const namespace = options().namespace;
         if (!namespace)
             return false;
         try {
             const routed = await deps.broker().binding();
-            return (routed.organizationId === namespace.organizationId &&
+            const active = routed.organizationId === namespace.organizationId &&
                 routed.clientIds.includes(namespace.clientId) &&
-                routed.origins.includes(namespace.appOrigin));
+                routed.origins.includes(namespace.appOrigin);
+            // Deactivated anywhere, by any service or in the issuer's console: their
+            // sessions here end before this answer is used, so within the same bound
+            // as a suspension. Only a list about this binding's own organization counts.
+            if (routed.organizationId === namespace.organizationId)
+                await endDeactivated(routed.revoked);
+            return active;
         }
         catch (error) {
             // Suspension removes the binding's key, so the service no longer knows it.