feat(be): mint short-lived app delegations from a session

src/canister_tests/src/api/internet_identity/api_v2.rs

@@ -772,3 +772,29 @@ pub fn get_account_session(
 ) -> Result<Result<GetAccountSessionResponse, AccountSessionError>, RejectResponse> {
     query_candid_as(env, canister_id, sender, "get_account_session", (request,)).map(|(x,)| x)
 }
+
+pub fn app_prepare_delegation(
+    env: &PocketIc,
+    canister_id: CanisterId,
+    sender: Principal,
+    request: AppPrepareDelegationRequest,
+) -> Result<Result<AppPrepareDelegationResponse, AppSessionError>, RejectResponse> {
+    call_candid_as(
+        env,
+        canister_id,
+        RawEffectivePrincipal::None,
+        sender,
+        "app_prepare_delegation",
+        (request,),
+    )
+    .map(|(x,)| x)
+}
+
+pub fn app_get_delegation(
+    env: &PocketIc,
+    canister_id: CanisterId,
+    sender: Principal,
+    request: AppGetDelegationRequest,
+) -> Result<Result<SignedDelegation, AppSessionError>, RejectResponse> {
+    query_candid_as(env, canister_id, sender, "app_get_delegation", (request,)).map(|(x,)| x)
+}

src/frontend/src/lib/generated/internet_identity_idl.js

@@ -138,6 +138,33 @@ export const idlFactory = ({ IDL }) => {
       'device_registration_timeout' : Timestamp,
     }),
   });
+  const SessionKey = PublicKey;
+  const AppGetDelegationRequest = IDL.Record({
+    'session_key' : SessionKey,
+    'expiration' : Timestamp,
+  });
+  const Delegation = IDL.Record({
+    'permissions' : IDL.Opt(IDL.Text),
+    'pubkey' : PublicKey,
+    'targets' : IDL.Opt(IDL.Vec(IDL.Principal)),
+    'expiration' : Timestamp,
+  });
+  const SignedDelegation = IDL.Record({
+    'signature' : IDL.Vec(IDL.Nat8),
+    'delegation' : Delegation,
+  });
+  const AppSessionError = IDL.Variant({
+    'NoSuchDelegation' : IDL.Null,
+    'InternalCanisterError' : IDL.Text,
+    'NoSuchSession' : IDL.Null,
+  });
+  const AppPrepareDelegationRequest = IDL.Record({
+    'session_key' : SessionKey,
+  });
+  const AppPrepareDelegationResponse = IDL.Record({
+    'user_key' : PublicKey,
+    'expiration' : Timestamp,
+  });
   const IdentityNumber = IDL.Nat64;
   const AuthnMethodProtection = IDL.Variant({
     'Protected' : IDL.Null,
@@ -358,22 +385,11 @@ export const idlFactory = ({ IDL }) => {
     'nonce' : IDL.Text,
     'expires_at' : Timestamp,
   });
-  const SessionKey = PublicKey;
   const EmailRecoveryGetDelegationArgs = IDL.Record({
     'session_key' : SessionKey,
     'expiration' : Timestamp,
     'nonce' : IDL.Text,
   });
-  const Delegation = IDL.Record({
-    'permissions' : IDL.Opt(IDL.Text),
-    'pubkey' : PublicKey,
-    'targets' : IDL.Opt(IDL.Vec(IDL.Principal)),
-    'expiration' : Timestamp,
-  });
-  const SignedDelegation = IDL.Record({
-    'signature' : IDL.Vec(IDL.Nat8),
-    'delegation' : Delegation,
-  });
   const BufferedArchiveEntry = IDL.Record({
     'sequence_number' : IDL.Nat64,
     'entry' : IDL.Vec(IDL.Nat8),
@@ -923,6 +939,21 @@ export const idlFactory = ({ IDL }) => {
         [AddTentativeDeviceResponse],
         [],
       ),
+    'app_get_delegation' : IDL.Func(
+        [AppGetDelegationRequest],
+        [IDL.Variant({ 'Ok' : SignedDelegation, 'Err' : AppSessionError })],
+        ['query'],
+      ),
+    'app_prepare_delegation' : IDL.Func(
+        [AppPrepareDelegationRequest],
+        [
+          IDL.Variant({
+            'Ok' : AppPrepareDelegationResponse,
+            'Err' : AppSessionError,
+          }),
+        ],
+        [],
+      ),
     'authn_method_add' : IDL.Func(
         [IdentityNumber, AuthnMethodData],
         [IDL.Variant({ 'Ok' : IDL.Null, 'Err' : AuthnMethodAddError })],

src/frontend/src/lib/generated/internet_identity_types.d.ts

@@ -89,6 +89,41 @@ export interface AnchorCredentials {
   'credentials' : Array<WebAuthnCredential>,
   'recovery_credentials' : Array<WebAuthnCredential>,
 }
+export interface AppGetDelegationRequest {
+  'session_key' : SessionKey,
+  /**
+   * Must match the prepared value.
+   */
+  'expiration' : Timestamp,
+}
+export interface AppPrepareDelegationRequest {
+  /**
+   * The key the app delegation delegates to. Nothing about the account is named:
+   * the caller's own session chain is what identifies it.
+   */
+  'session_key' : SessionKey,
+}
+export interface AppPrepareDelegationResponse {
+  'user_key' : PublicKey,
+  'expiration' : Timestamp,
+}
+export type AppSessionError = {
+    /**
+     * The session is live, but nothing was signed for the session_key and expiration
+     * asked for — so the expiration is one app_prepare_delegation never returned. Prepare
+     * again and use what comes back; signing in afresh is not the remedy.
+     */
+    'NoSuchDelegation' : null
+  } |
+  { 'InternalCanisterError' : string } |
+  {
+    /**
+     * No usable session behind this caller: revoked, expired, pruned, or never one at
+     * all. One outcome, because which of those it is depends on whether a prune has run
+     * yet, and because an app can act on none of them differently.
+     */
+    'NoSuchSession' : null
+  };
 /**
  * Configuration parameters related to the archive.
  */
@@ -1957,6 +1992,21 @@ export interface _SERVICE {
     [UserNumber, DeviceData],
     AddTentativeDeviceResponse
   >,
+  'app_get_delegation' : ActorMethod<
+    [AppGetDelegationRequest],
+    { 'Ok' : SignedDelegation } |
+      { 'Err' : AppSessionError }
+  >,
+  /**
+   * Mints a short-lived app delegation from a live session. Called by app frontends
+   * with the session chain, so revoking the session ends access within one delegation
+   * lifetime.
+   */
+  'app_prepare_delegation' : ActorMethod<
+    [AppPrepareDelegationRequest],
+    { 'Ok' : AppPrepareDelegationResponse } |
+      { 'Err' : AppSessionError }
+  >,
   /**
    * Adds a new authentication method to the identity.
    * Requires authentication.

src/internet_identity/internet_identity.did

@@ -1127,6 +1127,35 @@ type AccountSessionError = variant {
     InternalCanisterError : text;
 };
 
+type AppPrepareDelegationRequest = record {
+    // The key the app delegation delegates to. Nothing about the account is named:
+    // the caller's own session chain is what identifies it.
+    session_key : SessionKey;
+};
+
+type AppPrepareDelegationResponse = record {
+    user_key : PublicKey;
+    expiration : Timestamp;
+};
+
+type AppGetDelegationRequest = record {
+    session_key : SessionKey;
+    // Must match the prepared value.
+    expiration : Timestamp;
+};
+
+type AppSessionError = variant {
+    // No usable session behind this caller: revoked, expired, pruned, or never one at
+    // all. One outcome, because which of those it is depends on whether a prune has run
+    // yet, and because an app can act on none of them differently.
+    NoSuchSession;
+    // The session is live, but nothing was signed for the session_key and expiration
+    // asked for — so the expiration is one app_prepare_delegation never returned. Prepare
+    // again and use what comes back; signing in afresh is not the remedy.
+    NoSuchDelegation;
+    InternalCanisterError : text;
+};
+
 type IdentityInfo = record {
     authn_methods : vec AuthnMethodData;
     authn_method_registration : opt AuthnMethodRegistrationInfo;
@@ -1988,6 +2017,12 @@ service : (opt InternetIdentityInit) -> {
     prepare_account_session : (PrepareAccountSessionRequest) -> (variant { Ok : PrepareAccountSessionResponse; Err : AccountSessionError });
     get_account_session : (GetAccountSessionRequest) -> (variant { Ok : GetAccountSessionResponse; Err : AccountSessionError }) query;
 
+    // Mints a short-lived app delegation from a live session. Called by app frontends
+    // with the session chain, so revoking the session ends access within one delegation
+    // lifetime.
+    app_prepare_delegation : (AppPrepareDelegationRequest) -> (variant { Ok : AppPrepareDelegationResponse; Err : AppSessionError });
+    app_get_delegation : (AppGetDelegationRequest) -> (variant { Ok : SignedDelegation; Err : AppSessionError }) query;
+
     prepare_account_delegation : (
         anchor_number : UserNumber,
         origin : FrontendHostname,

src/internet_identity/src/main.rs

@@ -512,6 +512,20 @@ fn get_account_session(
     sessions::get_account_session(request)
 }
 
+#[update]
+fn app_prepare_delegation(
+    request: AppPrepareDelegationRequest,
+) -> Result<AppPrepareDelegationResponse, AppSessionError> {
+    sessions::app_prepare_delegation(request)
+}
+
+#[query]
+fn app_get_delegation(
+    request: AppGetDelegationRequest,
+) -> Result<SignedDelegation, AppSessionError> {
+    sessions::app_get_delegation(request)
+}
+
 #[update]
 fn prepare_account_delegation(
     anchor_number: AnchorNumber,