refactor(be,fe): data-only OpenID providers with on-demand SSO discovery/JWKS caches

[sea-snake]

OpenID sign-in dispatched through trait objects (dyn OpenIdProvider) and resolved SSO organization domains client-side. This reworks it into a single data-driven verification pipeline with two clearly separated JWK sources of truth, moves SSO discovery onto the canister, and makes the "cache still warming" state a first-class retry signal instead of an error. No user-visible behavior changes for the configured Google / Microsoft / Apple providers; SSO (organization) sign-in now resolves and verifies entirely canister-side.

Changes

Backend

• Replace the dyn OpenIdProvider trait dispatch and the monolithic openid/generic.rs with a data-only provider model: one shared verification pipeline (openid/verify.rs, provider.rs, jwks.rs) that is identical for every provider up to the point it reads the JWK.
• Two JWK sources of truth behind that shared pipeline: configured providers (openid/configured.rs) keep their timers + stable-storage-persisted keys (some providers can't reach HTTP-outcall consensus); SSO providers (openid/sso.rs) source keys on demand through the single-flight cache.
• Canister-side SSO discovery: discover_sso : (text) -> () (fire-and-forget drive of the two-hop discovery+JWKS fetch) and get_sso_discovery : (text) -> (SsoDiscoveryState) query where SsoDiscoveryState = variant { Resolved : SsoDiscovery; Pending; NotAllowed }. Gated by the sso_discoverable_domains allowlist. Replaces the client-side discovery module.
• The four OpenID JWT methods take an optional SSO discovery domain and return Pending as a result arm (not an error) when the SSO discovery/JWKS cache is cold or has been evicted:
  • openid_credential_add, openid_prepare_delegation, openid_get_delegation return OpenIdResult<T, E> = variant { Ok; Pending; Err }.
  • openid_identity_registration_finish returns variant { Ok; Pending; Err }; its verification is hoisted into the endpoint so the JWT is verified exactly once and the pubkey-registration path is untouched.
  • Pending is removed from OpenIdCredentialAddError / OpenIdDelegationError.

Frontend

• SSO discovery polls get_sso_discovery and drives discover_sso while Pending; ssoDiscovery.ts no longer fetches discovery documents itself.
• Sign-in, account-link, and signup all retry while the canister reports Pending (shared retryWhilePending / poll loop), so a cold or evicted SSO cache no longer turns into a hard error.

Tests

• New config/sso_discovery.rs integration tests for the discover_sso / get_sso_discovery allowlist gate.
• Updated OpenID / attributes / v2_api registration integration suites and api helpers for the new return shapes.
• SSO Playwright e2e green (12/12) across the discovery, sign-in, link, and signup paths.

🤖 Generated with Claude Code

Next: #4045

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to ae6c8b3.

Security Overview

• 🔎 Scanned files: 39 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=8c2c192d-d24f-4d73-94fc-015cf30964df&codeScanTypes=PrScan&tab=issues

Detected Code Changes

The diff is too large to display a summary of code changes.

[Copilot]

Pull request overview

Refactors Internet Identity’s OpenID/SSO implementation from provider trait dispatch into a single shared, data-driven JWT verification pipeline. It moves SSO two-hop discovery and JWKS caching fully canister-side, and introduces a first-class Pending retry result for cold/evicted SSO discovery/JWKS caches, with corresponding frontend polling/retry logic.

Changes:

• Backend: Introduces shared OpenID verification pipeline (openid/verify.rs) with provider resolution (provider.rs) and a JWK source seam (jwks.rs) split between configured providers (stable+timer refreshed) and SSO providers (on-demand single-flight caches).
• Backend API/DID: Adds discover_sso / get_sso_discovery, and updates OpenID methods to accept an optional SSO discovery domain and return OpenIdResult { Ok | Pending | Err }.
• Frontend: Removes client-side two-hop discovery fetching; instead polls get_sso_discovery and drives discover_sso, and retries OpenID calls while the canister returns Pending.

Reviewed changes

Copilot reviewed 36 out of 38 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/internet_identity/tests/integration/v2_api/authn_method_test_helpers.rs	Updates OpenID registration helper to include discovery_domain.
src/internet_identity/tests/integration/config/sso_discovery.rs	New integration tests for SSO discovery allowlist gating.
src/internet_identity/tests/integration/config/oidc_configs.rs	Removes obsolete OIDC config registration/discovery tests.
src/internet_identity/tests/integration/config.rs	Switches integration test module from oidc_configs to sso_discovery.
src/internet_identity/src/storage/anchor.rs	Drops legacy fallback for unstamped SSO fields; reads stamped values directly.
src/internet_identity/src/single_flight_cache.rs	Adds query-safe peek API that never spawns fills/mutates cache.
src/internet_identity/src/openid/verify.rs	New shared JWT verification + credential build pipeline.
src/internet_identity/src/openid/sso.rs	New canister-side SSO discovery + JWKS single-flight caches and allowlist gate.
src/internet_identity/src/openid/provider.rs	Resolves JWTs to provider descriptors + JWK sources (configured vs SSO).
src/internet_identity/src/openid/jwks.rs	Introduces JWK source abstraction + shared JWKS fetch/transform.
src/internet_identity/src/openid/configured.rs	New configured-provider registry + stable JWKS seed/refresh logic.
src/internet_identity/src/openid.rs	Replaces provider trait dispatch with configured/SSO resolution and shared verify pipeline; adds SSO discovery APIs.
src/internet_identity/src/main.rs	Updates canister methods for new OpenID result shapes and adds SSO discovery endpoints.
src/internet_identity/src/attributes.rs	Updates SSO attribute tests to rely on stamped sso_domain.
src/internet_identity/src/anchor_management/registration/registration_flow_v2.rs	Hoists OpenID verification for registration and threads verified credential through finish path; supports Pending.
src/internet_identity/internet_identity.did	Updates DID types/methods for OpenIdResult, SSO discovery APIs, and new args.
src/internet_identity_interface/src/internet_identity/types/openid.rs	Adds OpenIdResult type used by updated OpenID APIs.
src/internet_identity_interface/src/internet_identity/types/api_v2.rs	Extends OpenIDRegFinishArg with discovery_domain.
src/internet_identity_interface/src/internet_identity/types.rs	Adds SsoDiscovery / SsoDiscoveryState and updates related docs.
src/frontend/tests/e2e-playwright/fixtures/sso.ts	Adjusts e2e fixture comments to reflect canister-side SSO discovery.
src/frontend/src/routes/(new-styling)/authorize/+page.ts	Updates allowlist-boundary comments for 1-click SSO entry.
src/frontend/src/routes/(new-styling)/authorize/+page.svelte	Removes client call to register discoverable OIDC config; passes SSO domain through OpenID flow.
src/frontend/src/lib/utils/ssoDiscovery.ts	Replaces FE two-hop fetch with canister-driven discover_sso/get_sso_discovery polling.
src/frontend/src/lib/utils/ssoDiscovery.test.ts	Updates unit tests to mock canister SSO discovery API and polling behavior.
src/frontend/src/lib/utils/openidPoll.ts	New shared polling helpers (pollDelay, retryWhilePending).
src/frontend/src/lib/utils/authentication/jwt.ts	Retries openid_prepare_delegation / openid_get_delegation while canister returns Pending.
src/frontend/src/lib/stores/last-used-identities.store.ts	Updates docs around SSO resolution source (canister discovery).
src/frontend/src/lib/generated/internet_identity_types.d.ts	Regenerates bindings for updated DID (new SSO types, new OpenID arg/result shapes).
src/frontend/src/lib/generated/internet_identity_idl.js	Regenerates IDL factory for updated DID (new methods and types).
src/frontend/src/lib/flows/authLastUsedFlow.svelte.ts	Re-resolves SSO configs via canister when continuing with last-used SSO identity.
src/frontend/src/lib/flows/authFlow.svelte.ts	Threads SSO discovery domain through OpenID flows and retries registration while Pending.
src/frontend/src/lib/flows/addAccessMethodFlow.svelte.ts	Links OpenID/SSO credentials while retrying openid_credential_add on Pending.
src/frontend/src/lib/components/wizards/auth/views/SignInWithSso.svelte	Removes canister-side SSO registration call; relies on discovery polling and updated error mapping.
src/frontend/src/lib/components/wizards/auth/views/PickAuthenticationMethod.svelte	Updates comments to reflect new SSO allowlist enforcement via discover_sso.
src/frontend/src/lib/components/wizards/addAccessMethod/views/AddAccessMethod.svelte	Updates comments to reflect new canister-side SSO resolution/rejection.
src/canister_tests/src/api/internet_identity/api_v2.rs	Updates v2 OpenID registration finish helper to collapse OpenIdResult via settled.
src/canister_tests/src/api/internet_identity.rs	Replaces OIDC discovery helpers with SSO discovery helpers and adds settled for OpenID result collapsing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sea-snake]

Merged main (only the two generated candid bindings conflicted — regenerated from the merged .did with the pinned didc; npm run generate yields no further diff).

Went through the 6 Copilot comments; only one was a real issue:

• sso.rs — discovery_domain stamped verbatim ✅ Fixed. Canonicalized (trim + lowercase) at the canister boundary in all four endpoints that accept discovery_domain (openid_credential_add, openid_prepare_delegation, openid_get_delegation, openid_identity_registration_finish) via a shared openid::canonical_discovery_domain, rather than inside resolve() — the arg is untrusted and the allowlist gate is case-insensitive, so it must be canonicalized where it enters, matching the existing sso_discoverable_domains setter and get_sso_discovery. Added a unit test.
• verify.rs:20 Storable "unused" ❌ It is used — caller().to_bytes() needs the trait in scope; removing it fails the build (E0599). No change.
• verify.rs:318 email_verified "won't compile" ❌ Current code matches with ref s, which binds by reference and doesn't move out of &Claims. Compiles. No change.
• internet_identity.rs 422/441/460 — helpers "fail candid" without the trailing arg ❌ Candid lets a caller omit trailing optional arguments (decoded as null); these are configured-provider helpers that intentionally pass no domain. Confirmed by the integration suite (19/19 OpenID tests green). No change.

Validation: clippy -D warnings clean, cargo fmt, frontend check/lint/format clean, OpenID integration 19/19, SSO discovery 2/2, openid unit 15/15.

[sea-snake]

Bounded the two SSO single-flight caches (DISCOVERY_CACHE, JWKS_CACHE) so canister state stays bounded once discovery domains / jwks_uris become caller-controlled (the allowlist removal is a separate follow-up).

Why this shape. II is on a system subnet — HTTP outcalls cost no cycles — and ingress flooding is handled by the boundary nodes. So these caches don't need outcall-rate-limiting or cycle accounting; their only DDoS-relevant job is bounded, fairly-evicted state.

Single shared budget. Discovery and JWKS are one coupled flow (domain → discovery → jwks_uri → JWKS); a verification needs both the domain's discovery entry and its JWKS entry warm, so they share one SSO_CACHE_MAX_ENTRIES = 5000 rather than separate caps (separate ones would just leave one cache holding entries the other can't back). Bounded by the larger JWKS entry (≤ 32 KiB): 5000 × 32 KiB ≈ 160 MB + ~10 MB discovery ≈ ~170 MB worst case, ~5–6% of the ~3 GB Wasm heap — wide eviction headroom so a junk-domain flood can't evict the providers real users rely on.

Per-fill / per-entry caps (fills were previously unbounded, max_response_bytes: None):

• Response size: discovery hops 16 KiB; JWKS fetch 32 KiB — broad because real key sets embed x5c chains (Microsoft's JWKS is ~14.5 KB with 8 keys) and this fetch is shared with the configured Google/Microsoft refresh, which must not be rejected.
• Content: ≤ 20 JWKs (verification matches by kid; providers publish far fewer) and ≤ 32 stored discovery scopes (the only unbounded DiscoveredConfig field).

No behavior change for honest providers.

[aterga]

Addressed the open review comments and got the branch compiling again.

Build fixes — the branch did not compile at e440e0c:

• openid.rs imported std::ffi::os_str::Display (a struct) instead of the std::fmt::Display trait, so impl Display for AudClaim failed with E0404.
• The SSO unit test resolve_cross_checks_issuer still called resolve() with the old 2-arg signature, with the new &AudClaim mis-placed as an assert! format argument.

Review comments:

• verify.rs:143 — destructured the verified Claims, explicitly dropping aud (only weakly checked via AudClaim::matches; the canonical client_id is stored instead) and the consumed nonce/exp/iat.
• verify.rs:292 — the JWT time checks are now panic-free: validity is compared in whole seconds and iat + window uses checked_add, so a malicious far-future iat/exp can no longer overflow secs_to_nanos.
• verify.rs:429 — added the negative-path tests (details in the inline reply).
• ssoDiscovery.ts:59 — the loopback host is now parsed with new URL instead of hand-splitting on : (and a host carrying a path/query/fragment is rejected).

Locally verified: cargo fmt --check, cargo clippy -D warnings, the openid unit tests (23/23), and the ssoDiscovery vitest suite (15/15) all pass. The remaining canister-tests / e2e jobs are running in CI.

---

Generated by Claude Code