[Bccorb]

Summary

The API now owns the binding between a first-party session and the provider clients it signed in to. The provider service creates a binding with POST /oidc/sessions/:id/bind, presenting the user's own access token for that session. Provider lookups, user token signing, session revoke and account notices all require it, so records the provider service writes on its own no longer bind a session to a client.

Part of #558.

Changes

• POST /oidc/sessions/:id/bind: validates the access token, requires its session to be the one named, refuses recovery sessions and inactive clients, and records the binding under a model the payload routes cannot name
• hasOidcGrantForSession and hasOidcGrantForUser require the binding as well as a live grant, so revoking a grant still ends access
• POST /oidc/sessions/:id/revoke answers only for a session bound to some client
• Device-flow tokens are refused when they carry amr or auth_time, as they already were for acr
• @seamless-auth/types 0.35.0, which raises the provider contract to version 3

Rollout

Contract-affecting for seamless-auth-oidc-provider only. It must be upgraded together with this release (fells-code/seamless-auth-oidc-provider#45). Provider sessions made before the upgrade have no binding, so their users sign in again to get new provider tokens. Server adapters and SDKs are unaffected.

Checks

npm run typecheck, npm run lint, npx prettier --check ., npm run build and npm run coverage pass. The Postgres specs for the binding pass against a real database.