feat(be,fe): answer a silent re-auth without rendering anything

src/canister_tests/src/api/internet_identity/api_v2.rs

@@ -773,6 +773,15 @@ pub fn get_account_session(
     query_candid_as(env, canister_id, sender, "get_account_session", (request,)).map(|(x,)| x)
 }
 
+/// The II frontend's liveness check, called as the query it is declared as.
+pub fn check_session(
+    env: &PocketIc,
+    canister_id: CanisterId,
+    sender: Principal,
+) -> Result<bool, RejectResponse> {
+    query_candid_as(env, canister_id, sender, "check_session", ()).map(|(x,)| x)
+}
+
 pub fn app_prepare_delegation(
     env: &PocketIc,
     canister_id: CanisterId,

src/frontend/src/lib/generated/internet_identity_idl.js

@@ -1067,6 +1067,7 @@ export const idlFactory = ({ IDL }) => {
         ],
         [],
       ),
+    'check_session' : IDL.Func([], [IDL.Bool], ['query']),
     'config' : IDL.Func([], [InternetIdentityInit], ['query']),
     'create_account' : IDL.Func(
         [UserNumber, FrontendHostname, IDL.Text],

src/frontend/src/lib/generated/internet_identity_types.d.ts

@@ -2143,6 +2143,13 @@ export interface _SERVICE {
     { 'Ok' : IdRegNextStepResult } |
       { 'Err' : CheckCaptchaError }
   >,
+  /**
+   * Whether the calling session is still usable. For the II frontend's silent
+   * re-auth path, which must decide whether it can answer without rendering
+   * anything. Advisory: a query reply is not certified, and every mint enforces
+   * the same conditions regardless of the answer here.
+   */
+  'check_session' : ActorMethod<[], boolean>,
   'config' : ActorMethod<[], InternetIdentityInit>,
   'create_account' : ActorMethod<
     [UserNumber, FrontendHostname, string],

src/frontend/src/lib/stores/app-session.store.test.ts

@@ -4,7 +4,6 @@ import { createStore, set as idbSet } from "idb-keyval";
 import {
   appAccountsForOrigin,
   appSessionsForOrigin,
-  discardAppSession,
   purgeAppSessions,
   rememberAppAccount,
   storeAppSession,
@@ -65,16 +64,6 @@ describe("app session store", () => {
     ]);
   });
 
-  it("keeps the account mapping when the session is discarded", async () => {
-    const key = { identityNumber: BigInt(10_000), origin: ORIGIN };
-    await rememberAppAccount(key, { accountPrincipal: "2vxsx-fae" });
-    await storeAppSession(key, record(anHourFromNow()));
-
-    await discardAppSession(key);
-
-    await expect(appAccountsForOrigin(ORIGIN)).resolves.toHaveLength(1);
-  });
-
   it("keeps accounts of one identity apart", async () => {
     const identityNumber = BigInt(10_000);
     await storeAppSession(
@@ -99,15 +88,6 @@ describe("app session store", () => {
     await expect(appSessionsForOrigin(ORIGIN)).resolves.toEqual([]);
   });
 
-  it("discards a session", async () => {
-    const key = { identityNumber: BigInt(10_000), origin: ORIGIN };
-    await storeAppSession(key, record(anHourFromNow()));
-
-    await discardAppSession(key);
-
-    await expect(appSessionsForOrigin(ORIGIN)).resolves.toEqual([]);
-  });
-
   it("lists every identity holding a session at one origin", async () => {
     await storeAppSession(
       { identityNumber: BigInt(10_000), origin: ORIGIN },

src/frontend/src/lib/stores/app-session.store.ts

@@ -115,14 +115,6 @@ export const rememberAppAccount = async (
   }
 };
 
-export const discardAppSession = async (key: SessionKey): Promise<void> => {
-  try {
-    await idbDel(sessionKey(key), APP_SESSION_STORE);
-  } catch {
-    // A session that cannot be discarded locally is still revocable canister-side.
-  }
-};
-
 /** Every session this identity holds, for the sibling lookup and for sign-out.
  *
  *  Each carries the principal its account is known by, which lives in the other store

src/frontend/src/lib/stores/authorization.store.ts

@@ -33,6 +33,18 @@ export type Authorized = {
 const contextInternal = writable<AuthorizationContext | undefined>();
 const authorizedInternal = writable<Authorized | undefined>();
 
+export type AuthorizationPromptContext = {
+  prompt?: "none" | "login";
+  hint?: string;
+  resumable?: boolean;
+};
+
+/** Kept out of `AuthorizationContext`, whose presence is what makes the sign-in UI
+ *  render: URL state must not paint anything before there is a request to answer. */
+export const authorizationPromptStore = writable<AuthorizationPromptContext>(
+  {},
+);
+
 export const authorizationStore = {
   /** Called by the channel handler once the delegation request is parsed.
    *  Sets the effective origin and the app's requested session duration in a