Merge feat/openid-sso-cache-verify into feat/sso-allow-any-domain

Bring in the 3 base commits (incl. the TS2367 SSO discovery abort fix) that
landed on #4022 after this branch was cut.

Author: sea-snake

src/frontend/src/lib/utils/openidPoll.ts

@@ -9,8 +9,27 @@
 export const POLL_INTERVAL_MS = 500;
 export const MAX_POLL_ATTEMPTS = 60;
 
-export const pollDelay = (): Promise<void> =>
-  new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+/**
+ * Sleep one poll interval. Resolves early when `signal` aborts so the caller's
+ * next abort check runs without waiting out the full delay (and, in turn,
+ * without firing another canister call for an already-cancelled lookup).
+ */
+export const pollDelay = (signal?: AbortSignal): Promise<void> =>
+  new Promise((resolve) => {
+    if (signal?.aborted === true) {
+      resolve();
+      return;
+    }
+    const onAbort = (): void => {
+      clearTimeout(timer);
+      resolve();
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, POLL_INTERVAL_MS);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
 
 /**
  * Retry an update call that reports the top-level `Pending` arm while SSO

src/frontend/src/lib/utils/ssoDiscovery.test.ts

@@ -152,5 +152,32 @@ describe("ssoDiscovery", () => {
         discoverSsoConfig("dfinity.org", controller.signal),
       ).rejects.toThrow("aborted");
     });
+
+    it("aborting mid-sleep stops the poll without firing another update", async () => {
+      vi.useFakeTimers();
+      vi.mocked(anonymousActor.get_sso_discovery).mockResolvedValue({
+        Pending: null,
+      });
+      vi.mocked(anonymousActor.discover_sso).mockResolvedValue(undefined);
+
+      const controller = new AbortController();
+      const settled = discoverSsoConfig("dfinity.org", controller.signal).catch(
+        (e: unknown) => e,
+      );
+
+      // First iteration: query reads Pending → one update → parked in the sleep.
+      await vi.advanceTimersByTimeAsync(0);
+      expect(anonymousActor.discover_sso).toHaveBeenCalledTimes(1);
+
+      // Abort during the 500ms sleep: it resolves early and the loop-top check
+      // throws before a second query/update can fire.
+      controller.abort();
+      await vi.advanceTimersByTimeAsync(0);
+
+      const error = await settled;
+      expect(error).toBeInstanceOf(Error);
+      expect((error as Error).message).toContain("aborted");
+      expect(anonymousActor.discover_sso).toHaveBeenCalledTimes(1);
+    });
   });
 });

src/frontend/src/lib/utils/ssoDiscovery.ts

@@ -108,6 +108,12 @@ const toResult = (discovery: SsoDiscovery): SsoDiscoveryResult => ({
   },
 });
 
+// Wrap the abort check in a function so each call returns a fresh `boolean`.
+// Reading `signal?.aborted` inline narrows it to `false` for the rest of the
+// iteration, and TypeScript doesn't re-widen across the `await`s — so a second
+// inline check on the same `signal` is flagged as always-false (TS2367).
+const isAborted = (signal?: AbortSignal): boolean => signal?.aborted === true;
+
 /**
  * Resolve a domain's SSO configuration. Validates the domain, then polls
  * `get_sso_discovery` (query) for the state; on `Pending` it drives the fetch
@@ -125,7 +131,7 @@ export const discoverSsoConfig = async (
   const validatedDomain = validateDomain(domain);
 
   for (let attempt = 0; attempt < MAX_POLL_ATTEMPTS; attempt++) {
-    if (signal?.aborted === true) {
+    if (isAborted(signal)) {
       throw new Error("SSO discovery aborted");
     }
     // Read the discovery state via the cheap query.
@@ -136,9 +142,16 @@ export const discoverSsoConfig = async (
     if ("NotAllowed" in state) {
       throw new DomainNotConfiguredError("rejected");
     }
-    // Pending — drive the fetch with an update, then poll again.
+    // Re-check before the update: the query above may have spanned an abort,
+    // and we don't want to drive a fetch for a lookup the user already dropped.
+    if (isAborted(signal)) {
+      throw new Error("SSO discovery aborted");
+    }
+    // Pending — drive the fetch with an update, then poll again. The sleep is
+    // abortable so a mid-delay abort skips straight to the next iteration's
+    // check instead of firing another query.
     await anonymousActor.discover_sso(validatedDomain);
-    await pollDelay();
+    await pollDelay(signal);
   }
 
   throw new DomainNotConfiguredError("timeout");

src/internet_identity/src/main.rs

@@ -1348,7 +1348,7 @@ mod openid_api {
     ) -> OpenIdResult<IdRegFinishResult, IdRegFinishError> {
         // Canonicalize the untrusted discovery domain at the boundary so both
         // verification and the credential stored from `arg` see the same value.
-        arg.discovery_domain = openid::canonical_discovery_domain(arg.discovery_domain);
+        arg.discovery_domain = openid::canonical_discovery_domain_opt(arg.discovery_domain);
         // Verify the JWT (driving the SSO discovery/JWKS fetches it may need)
         // up front: a cold or evicted cache surfaces as the `Pending` retry arm
         // instead of a terminal registration error. The verified credential is
@@ -1375,7 +1375,7 @@ mod openid_api {
         salt: [u8; 32],
         discovery_domain: Option<String>,
     ) -> OpenIdResult<(), OpenIdCredentialAddError> {
-        let discovery_domain = openid::canonical_discovery_domain(discovery_domain);
+        let discovery_domain = openid::canonical_discovery_domain_opt(discovery_domain);
         openid::prefetch_sso(discovery_domain.as_deref());
         let openid_credential = match openid::verify_jwt(&jwt, &salt, discovery_domain.as_deref()) {
             Ok(openid::Cached::Ready(credential)) => credential,
@@ -1428,7 +1428,7 @@ mod openid_api {
         // read the result. A cold cache reads `Pending`; the frontend polls
         // `openid_get_delegation` and re-calls this until the delegation is
         // ready.
-        let discovery_domain = openid::canonical_discovery_domain(discovery_domain);
+        let discovery_domain = openid::canonical_discovery_domain_opt(discovery_domain);
         openid::prefetch_sso(discovery_domain.as_deref());
         let openid_credential = match openid::verify_jwt(&jwt, &salt, discovery_domain.as_deref()) {
             Ok(openid::Cached::Ready(credential)) => credential,
@@ -1490,7 +1490,7 @@ mod openid_api {
         // caches. A `Pending` means discovery/JWKS isn't cached yet — the
         // frontend re-calls `openid_prepare_delegation` (an update, which drives
         // the fetch) and polls this again.
-        let discovery_domain = openid::canonical_discovery_domain(discovery_domain);
+        let discovery_domain = openid::canonical_discovery_domain_opt(discovery_domain);
         let openid_credential = match openid::verify_jwt(&jwt, &salt, discovery_domain.as_deref()) {
             Ok(openid::Cached::Ready(credential)) => credential,
             Ok(openid::Cached::Pending) => return OpenIdResult::Pending,
@@ -1517,7 +1517,7 @@ mod openid_api {
     /// query until it returns `Resolved`.
     #[update]
     fn discover_sso(domain: String) {
-        openid::discover_sso(&domain)
+        openid::discover_sso(&openid::canonical_discovery_domain(&domain))
     }
 
     /// Read the state of `domain`'s SSO discovery: `Resolved` with the config,
@@ -1526,7 +1526,7 @@ mod openid_api {
     fn get_sso_discovery(
         domain: String,
     ) -> internet_identity_interface::internet_identity::types::SsoDiscoveryState {
-        openid::get_sso_discovery(&domain)
+        openid::get_sso_discovery(&openid::canonical_discovery_domain(&domain))
     }
 }
 

src/internet_identity/src/openid.rs

@@ -286,12 +286,18 @@ pub fn setup(configs: Vec<OpenIdConfig>) {
 /// Canonicalize an untrusted SSO discovery domain received as a canister-call
 /// argument: trim surrounding whitespace and lowercase ASCII. Domains are
 /// case-insensitive (DNS), but the value is stamped onto the credential as
-/// `sso_domain` and used as the equality key for `sso:<domain>` scope routing,
-/// so it must be canonical the moment it crosses the trust boundary. Endpoints
-/// taking a `discovery_domain` run this before any further use, matching the
-/// `sso_discoverable_domains` config setter and the `get_sso_discovery` reply.
-pub fn canonical_discovery_domain(domain: Option<String>) -> Option<String> {
-    domain.map(|domain| domain.trim().to_ascii_lowercase())
+/// `sso_domain` and used as the equality key for `sso:<domain>` scope routing
+/// and the allowlist gate, so it must be canonical the moment it crosses the
+/// trust boundary. Every endpoint taking a `discovery_domain` runs this before
+/// any further use, matching the `sso_discoverable_domains` config setter.
+pub fn canonical_discovery_domain(domain: &str) -> String {
+    domain.trim().to_ascii_lowercase()
+}
+
+/// [`canonical_discovery_domain`] over an optional argument (the JWT endpoints,
+/// where the domain selects an SSO vs configured provider).
+pub fn canonical_discovery_domain_opt(domain: Option<String>) -> Option<String> {
+    domain.map(|domain| canonical_discovery_domain(&domain))
 }
 
 /// Drive the on-demand SSO discovery / JWKS fetches for `domain` forward. Only
@@ -550,17 +556,18 @@ mod tests {
     fn canonical_discovery_domain_trims_and_lowercases() {
         // Untrusted canister-call args: a mixed-case / padded domain that
         // passes the case-insensitive allowlist gate must be canonicalized so
-        // the stamped `sso:<domain>` scope matches the allowlisted value.
-        assert_eq!(
-            canonical_discovery_domain(Some("  Example.ORG  ".to_string())),
-            Some("example.org".to_string())
-        );
+        // the stamped `sso:<domain>` scope matches the allowlisted value, and
+        // so the discovery endpoints (`discover_sso` / `get_sso_discovery`) gate
+        // on the same canonical form as the JWT endpoints.
+        assert_eq!(canonical_discovery_domain("  Example.ORG  "), "example.org");
+        assert_eq!(canonical_discovery_domain("example.org"), "example.org");
+        // Optional wrapper for the JWT endpoints: a configured provider supplies
+        // no domain.
         assert_eq!(
-            canonical_discovery_domain(Some("example.org".to_string())),
+            canonical_discovery_domain_opt(Some("  Example.ORG  ".to_string())),
             Some("example.org".to_string())
         );
-        // A configured provider supplies no domain.
-        assert_eq!(canonical_discovery_domain(None), None);
+        assert_eq!(canonical_discovery_domain_opt(None), None);
     }
 
     #[test]