feat(be,fe): answer a silent re-auth without rendering anything

[sea-snake]

Design: #4228, on the sessions of #4224. Overview: #4230. Sits on the frontend stack at #4249.

Sibling subdomains of one domain can share a sign-in: sign in on chat.example.com and hr.example.com is signed in too, sign out of one and the others follow. The client half is already specified in @icp-sdk/auth — a shared derivationOrigin, a domain-scoped cookie holding only a principal and an expiry, and a /reauth page running prompt: 'none' with a hint. This is only what II has to supply for that to work.

Re-issuing is a canister-checked mint like any other rather than an offline extension of a stored chain, so what the app receives stays revocable. The mint is unchanged; this adds one query, check_session, so the frontend can tell a record it still holds from a session the canister has already dropped.

Three authorize-URL parameters. prompt (none | login) and hint (a principal in text form) are preferences: both are read with .catch(undefined), so a value that cannot be read degrades to an interactive sign-in rather than failing the request, and neither is ever a credential. They survive the round trip an interactive flow may take through an IdP, and are stripped from the address bar once consumed.

resumable is not a preference, and it changes the interactive path. It flips storeAppSession from unconditional to conditional — one line, and the one that makes the silent path fail closed for every app that never opted in, since a session that was never stored cannot be silently re-issued. It is therefore load-bearing for the security argument below in a way prompt is not: prompt decides whether a held session is consulted, resumable decides whether there is one to consult. It is also the only change here that alters what happens on an ordinary, non-silent sign-in.

prompt=none renders nothing, ever. Either the redirect carries a session chain or it carries interaction_required, which the client can tell apart from a real error and fall back from. Three things make that hold: the context is read before the channel is established, so the handler has it when it answers, ahead of anything that paints; the denial goes on the channel rather than through the error store, which drives a full-page view; and every failure path answers, invalid params and the catch-all around the whole handler included. Otherwise a storage or WebCrypto hiccup would paint II's error page inside what the user experiences as their own app's tab and send no response at all, hanging the client's /reauth instead of letting it take its fallback branch.

prompt=none never creates a session, because a session comes only from prepare_account_session, which requires an anchor access method that a silent request has not proved. So it can exercise authority and never obtain it — the same rule that stops a stolen chain spawning siblings.

hint selects among the sessions this browser holds for the origin being authorized and can never name another origin's. That is what makes it safe for the hint to come from a cookie the app can read and write: it selects from what II already holds for that origin, and holding the session is what confers anything. The derivation origin is validated before the session lookup, and the store filters on exact origin match. Several candidates with nothing to choose between them is interaction_required, not a guess.

Silence is something an app asks for, twice. A session is stored only where the sign-in that created it was marked resumable, and a stored session is consulted only under prompt=none — anything else, an absent prompt included, runs the ceremony. So a session this browser holds is never handed over without the user seeing a screen they did not ask for, and an app that never asked for resumability has nothing held for it at all.

Sibling sharing and sign-out propagation need no mechanism of their own: a shared derivationOrigin means every sibling resolves to one application and sessions live at (anchor, application), so there is one record the siblings take turns re-issuing from — and app_revoke_session removes the record they all share, not merely the cookie.

promptParams.ts and silentReauth.ts sit inside the authorize route that uses them.

Tests: promptParams.test.ts (10) and silentReauth.test.ts (6) cover reading and degrading both parameters, the context surviving a resume, and selection — nothing held, one session, two personas asking rather than guessing, and hinted, unheld and ambiguous hints. sessionDelegation.test.ts gains a silent request answering rather than surfacing an unverified origin, and both prompt=login and an absent prompt running the ceremony with a session held.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to d31f27f.

Security Overview

• 🔎 Scanned files: 18 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=a2f28d54-a964-4b42-b3fb-33dd5b368448&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► src/canister_tests/src/api/internet_identity/api_v2.rs       Add check_session frontend II frontend liveness check
Enhancement	► src/frontend/src/lib/generated/internet_identity_idl.js       Expose check_session as IDL function
Enhancement	► src/frontend/src/lib/generated/internet_identity_types.d.ts       Add check_session method type to _SERVICE
Refactor	► src/frontend/src/lib/stores/app-session.store.ts       Remove discardAppSession functionality
Enhancement	► src/frontend/src/lib/stores/authorization.store.ts       Introduce authorizationPromptStore for silent/prompt handling
Enhancement	► src/frontend/src/lib/stores/channelHandlers/sessionDelegation.ts       Integrate authorizationPromptStore and silent reauth flow; add session live checks and silent denial handling
Enhancement	► src/frontend/src/lib/stores/channelHandlers/silentReauth.ts (new file)       Implement chooseSilentSession logic for silent reauth
Enhancement	► src/frontend/src/lib/stores/channelHandlers/silentReauth.test.ts (new file)       Add tests for chooseSilentSession behavior
Enhancement	► src/frontend/src/lib/stores/channelHandlers/silentReauth.ts (new file)       Export chooseSilentSession implementation
Enhancement	► src/frontend/src/lib/utils/transport/utils.ts       Add INTERACTION_REQUIRED_ERROR_CODE for silent requests
Enhancement	► src/frontend/src/routes/(new-styling)/authorize/+layout.svelte       Set authorizationPromptStore with prompt params; strip prompt params; adjust imports
Enhancement	► src/frontend/src/routes/(new-styling)/authorize/promptParams.test.ts (new file)       Add tests for prompt parameter parsing
Enhancement	► src/frontend/src/routes/(new-styling)/authorize/promptParams.ts (implied by tests referencing)
Bug Fix / Refactor	► (modifications across tests and mocks in tests) src/frontend/src/lib/stores/channelHandlers/sessionDelegation.test.ts       Adjust mocks and test expectations to accommodate new silent reauth flow

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.