feat(be): store a revocable session on the account reference

src/frontend/src/lib/generated/internet_identity_idl.js

@@ -561,6 +561,7 @@ export const idlFactory = ({ IDL }) => {
   });
   const BrowserInfo = IDL.Record({
     'id' : IDL.Nat32,
+    'session_count' : IDL.Nat32,
     'name' : IDL.Text,
     'created_at' : Timestamp,
     'last_used' : Timestamp,

src/frontend/src/lib/generated/internet_identity_types.d.ts

@@ -1541,6 +1541,10 @@ export type SessionDelegationError = { 'NoSuchDelegation' : null } |
  */
 export interface BrowserInfo {
   'id' : number,
+  /**
+   * Sessions this browser holds. Zero means it is signed in to nothing.
+   */
+  'session_count' : number,
   'name' : string,
   'created_at' : Timestamp,
   /**

src/internet_identity/internet_identity.did

@@ -1015,6 +1015,8 @@ type BrowserInfo = record {
     created_at : Timestamp;
     // Advanced by a sign-in from this browser and by every session refresh it drives.
     last_used : Timestamp;
+    // Sessions this browser holds. Zero means it is signed in to nothing.
+    session_count : nat32;
 };
 
 type IdentityInfo = record {

src/internet_identity/src/account_management.rs

@@ -400,7 +400,11 @@ fn should_create_account_for_origin() {
     use crate::state::{storage_borrow_mut, storage_replace};
 
     storage_replace(storage_with_salt());
-    let anchor = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
+    let anchor = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
     let origin = "https://example.com".to_string();
     let name = "Alice".to_string();
 
@@ -423,7 +427,11 @@ fn should_fail_to_create_accounts_above_max() {
     use crate::storage::MAX_ANCHOR_ACCOUNTS;
 
     storage_replace(storage_with_salt());
-    let anchor = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
+    let anchor = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
     let name = "Alice".to_string();
     for i in 0..=MAX_ANCHOR_ACCOUNTS {
         let origin = format!("https://example-{i}.com");
@@ -443,7 +451,11 @@ fn should_fail_to_update_default_accounts_above_max() {
     use crate::storage::MAX_ANCHOR_ACCOUNTS;
 
     storage_replace(storage_with_salt());
-    let anchor = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
+    let anchor = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
     let name = "Alice".to_string();
     for i in 0..MAX_ANCHOR_ACCOUNTS {
         let origin = format!("https://example-{i}.com");
@@ -468,7 +480,11 @@ fn should_get_accounts_for_origin() {
     use crate::state::{storage_borrow_mut, storage_replace};
 
     storage_replace(storage_with_salt());
-    let anchor = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
+    let anchor = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
     let origin = "https://example.com".to_string();
     let name = "Alice".to_string();
     let name_two = "Bob".to_string();
@@ -506,8 +522,16 @@ fn should_only_get_own_accounts_for_origin() {
     use crate::state::{storage_borrow_mut, storage_replace};
 
     storage_replace(storage_with_salt());
-    let anchor = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
-    let anchor_two = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
+    let anchor = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
+    let anchor_two = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
     let origin = "https://example.com".to_string();
     let name = "Alice".to_string();
     let name_two = "Bob".to_string();
@@ -553,7 +577,11 @@ fn should_update_account_for_origin() {
     use crate::state::{storage_borrow_mut, storage_replace};
 
     storage_replace(storage_with_salt());
-    let anchor = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
+    let anchor = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
     let origin = "https://example.com".to_string();
     let name = "Alice".to_string();
     let name_two = "Bob".to_string();
@@ -633,7 +661,11 @@ fn should_update_default_account_for_origin() {
     use crate::state::{storage_borrow_mut, storage_replace};
 
     storage_replace(storage_with_salt());
-    let anchor = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
+    let anchor = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
     let origin = "https://example.com".to_string();
     let name = "Alice".to_string();
     let name_two = "Bob".to_string();
@@ -787,7 +819,11 @@ fn should_get_default_account_for_origin() {
     use crate::state::{storage_borrow_mut, storage_replace};
 
     storage_replace(storage_with_salt());
-    let anchor = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
+    let anchor = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
     let origin = "https://example.com".to_string();
     let anchor_number = anchor.anchor_number();
 
@@ -944,7 +980,11 @@ fn can_get_default_before_update_account_for_origin() {
     use crate::state::{storage_borrow_mut, storage_replace};
 
     storage_replace(storage_with_salt());
-    let anchor = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
+    let anchor = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
     let origin = "https://example.com".to_string();
     let anchor_number = anchor.anchor_number();
 
@@ -962,7 +1002,11 @@ fn should_get_updated_default_account_after_modification() {
     use crate::state::{storage_borrow_mut, storage_replace};
 
     storage_replace(storage_with_salt());
-    let anchor = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
+    let anchor = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
     let origin = "https://example.com".to_string();
     let anchor_number = anchor.anchor_number();
 
@@ -1029,7 +1073,11 @@ fn should_fall_back_to_the_tracked_default_when_the_reservation_is_stale() {
     // to be there for the same test to hold all the way up the stack.
     storage.update_salt([17u8; 32]);
     storage_replace(storage);
-    let anchor = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
+    let anchor = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
     let anchor_number = anchor.anchor_number();
     let origin = "https://example.com".to_string();
     storage_borrow_mut(|storage| storage.write(anchor)).unwrap();
@@ -1063,7 +1111,11 @@ fn should_get_default_account_for_different_origins() {
     use crate::state::{storage_borrow_mut, storage_replace};
 
     storage_replace(storage_with_salt());
-    let anchor = storage_borrow_mut(|storage| storage.allocate_anchor(0).unwrap());
+    let anchor = storage_borrow_mut(|storage| {
+        let anchor = storage.allocate_anchor(0).unwrap();
+        storage.write(anchor.clone()).unwrap();
+        anchor
+    });
     let origin1 = "https://app1.com".to_string();
     let origin2 = "https://app2.com".to_string();
     let anchor_number = anchor.anchor_number();

src/internet_identity/src/delegation.rs

@@ -124,6 +124,34 @@ pub fn calculate_account_seed_with_salt(
     hash_bytes(blob)
 }
 
+const SESSION_SEED_PREFIX: &str = "session";
+
+/// The seed of a session's canister-signed identity.
+///
+/// Built on the account's own seed, so a session survives anything that leaves the
+/// account's principal unchanged, including naming a default account. `session_id` is
+/// the only other input, and no two sessions are ever allocated the same one, so a
+/// revoked session's identity can never be arrived at a second time. Unguessability
+/// comes from the salt.
+pub fn calculate_session_seed_with_salt(
+    salt: &[u8; 32],
+    account_seed: &Hash,
+    session_id: SessionId,
+) -> Hash {
+    fn push_field(blob: &mut Vec<u8>, data: &[u8]) {
+        blob.extend_from_slice(&(data.len() as u64).to_be_bytes());
+        blob.extend_from_slice(data);
+    }
+
+    let mut blob: Vec<u8> = vec![];
+    push_field(&mut blob, salt);
+    push_field(&mut blob, SESSION_SEED_PREFIX.as_bytes());
+    push_field(&mut blob, account_seed);
+    push_field(&mut blob, &session_id.to_be_bytes());
+
+    hash_bytes(blob)
+}
+
 fn hash_bytes(value: impl AsRef<[u8]>) -> Hash {
     let mut hasher = Sha256::new();
     hasher.update(value.as_ref());

src/internet_identity/src/email_recovery/remove.rs

@@ -77,6 +77,7 @@ mod tests {
         let mut a = Anchor {
             browsers: vec![],
             next_browser_id: 0,
+            session_count: 0,
             anchor_number: 1,
             devices: vec![],
             openid_credentials: vec![],

src/internet_identity/src/main.rs

@@ -1202,11 +1202,12 @@ mod v2_api {
         let stored_browsers: Vec<BrowserInfo> = state::anchor(identity_number)
             .browsers()
             .iter()
-            .map(|device| BrowserInfo {
-                id: device.id,
-                name: device.name.clone(),
-                created_at: device.created_at,
-                last_used: device.last_used,
+            .map(|browser| BrowserInfo {
+                id: browser.id,
+                name: browser.name.clone(),
+                created_at: browser.created_at,
+                last_used: browser.last_used,
+                session_count: browser.session_count,
             })
             .collect();
         let browsers = if stored_browsers.is_empty() {