feat(be,fe): session delegations for ceremony-free account reads

src/canister_tests/src/api/internet_identity/api_v2.rs

@@ -372,6 +372,79 @@ pub fn get_accounts(
     .map(|(x,)| x)
 }
 
+pub fn get_default_account(
+    env: &PocketIc,
+    canister_id: CanisterId,
+    sender: Principal,
+    identity_number: IdentityNumber,
+    origin: FrontendHostname,
+) -> Result<Result<AccountInfo, GetDefaultAccountError>, RejectResponse> {
+    query_candid_as(
+        env,
+        canister_id,
+        sender,
+        "get_default_account",
+        (identity_number, origin),
+    )
+    .map(|(x,)| x)
+}
+
+pub fn set_default_account(
+    env: &PocketIc,
+    canister_id: CanisterId,
+    sender: Principal,
+    identity_number: IdentityNumber,
+    origin: FrontendHostname,
+    account_number: Option<AccountNumber>,
+) -> Result<Result<AccountInfo, SetDefaultAccountError>, RejectResponse> {
+    call_candid_as(
+        env,
+        canister_id,
+        RawEffectivePrincipal::None,
+        sender,
+        "set_default_account",
+        (identity_number, origin, account_number),
+    )
+    .map(|(x,)| x)
+}
+
+pub fn prepare_session_delegation(
+    env: &PocketIc,
+    canister_id: CanisterId,
+    sender: Principal,
+    anchor_number: AnchorNumber,
+    session_key: SessionKey,
+    max_ttl: Option<u64>,
+) -> Result<Result<PrepareSessionDelegation, SessionDelegationError>, RejectResponse> {
+    call_candid_as(
+        env,
+        canister_id,
+        RawEffectivePrincipal::None,
+        sender,
+        "prepare_session_delegation",
+        (anchor_number, session_key, max_ttl),
+    )
+    .map(|(x,)| x)
+}
+
+pub fn get_session_delegation(
+    env: &PocketIc,
+    canister_id: CanisterId,
+    sender: Principal,
+    anchor_number: AnchorNumber,
+    session_key: SessionKey,
+    expiration: Timestamp,
+) -> Result<Result<SignedDelegation, SessionDelegationError>, RejectResponse> {
+    query_candid_as(
+        env,
+        canister_id,
+        sender,
+        "get_session_delegation",
+        (anchor_number, session_key, expiration),
+    )
+    .map(|(x,)| x)
+}
+
 pub fn update_account(
     env: &PocketIc,
     canister_id: CanisterId,

src/frontend/src/lib/flows/authFlow.svelte.ts

@@ -42,6 +42,7 @@ import {
 } from "$lib/utils/openID";
 import type { SsoDiscoveryResult } from "$lib/utils/ssoDiscovery";
 import { nanosToMillis } from "$lib/utils/time";
+import { mintSession } from "$lib/stores/session-delegation.store";
 
 interface AuthFlowOptions {
   trackLastUsed?: boolean;
@@ -342,6 +343,7 @@ export class AuthFlow {
       });
     const authMethod = { passkey: { credentialId } };
     await authenticationStore.set({ identity, identityNumber, authMethod });
+    void mintSession({ identityNumber, actor: get(authenticatedStore).actor });
     const info =
       await get(authenticatedStore).actor.get_anchor_info(identityNumber);
     const pendingLastUsedEntry = this.#options.trackLastUsed
@@ -531,6 +533,10 @@ export class AuthFlow {
         identityNumber,
         authMethod: { openid: { iss, sub } },
       });
+      void mintSession({
+        identityNumber,
+        actor: get(authenticatedStore).actor,
+      });
       const info =
         await get(authenticatedStore).actor.get_anchor_info(identityNumber);
       return {
@@ -626,6 +632,10 @@ export class AuthFlow {
         identityNumber,
         authMethod: { passkey: { credentialId } },
       });
+      void mintSession({
+        identityNumber,
+        actor: get(authenticatedStore).actor,
+      });
       if (this.#options.trackLastUsed) {
         lastUsedIdentitiesStore.addLastUsedIdentity({
           identityNumber,
@@ -791,6 +801,10 @@ export class AuthFlow {
         identityNumber,
         authMethod: { openid: { iss, sub } },
       });
+      void mintSession({
+        identityNumber,
+        actor: get(authenticatedStore).actor,
+      });
       this.#captcha = undefined;
       return { iss, sub, loginHint, identityNumber, decodedJwt };
     } catch (error) {

src/frontend/src/lib/generated/internet_identity_idl.js

@@ -517,6 +517,11 @@ export const idlFactory = ({ IDL }) => {
     'Unauthorized' : IDL.Principal,
     'NoSuchCredentials' : IDL.Text,
   });
+  const SessionDelegationError = IDL.Variant({
+    'NoSuchDelegation' : IDL.Null,
+    'InternalCanisterError' : IDL.Text,
+    'Unauthorized' : IDL.Principal,
+  });
   const HeaderField = IDL.Tuple(IDL.Text, IDL.Text);
   const HttpRequest = IDL.Record({
     'url' : IDL.Text,
@@ -693,6 +698,10 @@ export const idlFactory = ({ IDL }) => {
     'InternalCanisterError' : IDL.Text,
     'Unauthorized' : IDL.Principal,
   });
+  const PrepareSessionDelegation = IDL.Record({
+    'user_key' : UserKey,
+    'expiration' : Timestamp,
+  });
   const ChallengeResult = IDL.Record({
     'key' : ChallengeKey,
     'chars' : IDL.Text,
@@ -1006,6 +1015,16 @@ export const idlFactory = ({ IDL }) => {
         [IDL.Principal],
         ['query'],
       ),
+    'get_session_delegation' : IDL.Func(
+        [UserNumber, SessionKey, Timestamp],
+        [
+          IDL.Variant({
+            'Ok' : SignedDelegation,
+            'Err' : SessionDelegationError,
+          }),
+        ],
+        ['query'],
+      ),
     'http_request' : IDL.Func([HttpRequest], [HttpResponse], ['query']),
     'identity_authn_info' : IDL.Func(
         [IdentityNumber],
@@ -1155,6 +1174,16 @@ export const idlFactory = ({ IDL }) => {
         [IDL.Variant({ 'Ok' : PreparedIdAlias, 'Err' : PrepareIdAliasError })],
         [],
       ),
+    'prepare_session_delegation' : IDL.Func(
+        [UserNumber, SessionKey, IDL.Opt(IDL.Nat64)],
+        [
+          IDL.Variant({
+            'Ok' : PrepareSessionDelegation,
+            'Err' : SessionDelegationError,
+          }),
+        ],
+        [],
+      ),
     'register' : IDL.Func(
         [DeviceData, ChallengeResult, IDL.Opt(IDL.Principal)],
         [RegisterResponse],

src/frontend/src/lib/generated/internet_identity_types.d.ts

@@ -1310,6 +1310,10 @@ export interface PrepareIdAliasRequest {
    */
   'identity_number' : IdentityNumber,
 }
+export interface PrepareSessionDelegation {
+  'user_key' : UserKey,
+  'expiration' : Timestamp,
+}
 /**
  * The prepared id alias contains two (still unsigned) credentials in JWT format,
  * certifying the id alias for the issuer resp. the relying party.
@@ -1394,6 +1398,9 @@ export interface Rrsig {
   'type_covered' : number,
 }
 export type Salt = Uint8Array | number[];
+export type SessionDelegationError = { 'NoSuchDelegation' : null } |
+  { 'InternalCanisterError' : string } |
+  { 'Unauthorized' : Principal };
 export type SessionKey = PublicKey;
 export type SetDefaultAccountError = {
     'NoSuchOrigin' : { 'anchor_number' : UserNumber }
@@ -1822,6 +1829,11 @@ export interface _SERVICE {
       { 'Err' : GetIdAliasError }
   >,
   'get_principal' : ActorMethod<[UserNumber, FrontendHostname], Principal>,
+  'get_session_delegation' : ActorMethod<
+    [UserNumber, SessionKey, Timestamp],
+    { 'Ok' : SignedDelegation } |
+      { 'Err' : SessionDelegationError }
+  >,
   /**
    * HTTP Gateway protocol
    * =====================
@@ -1994,6 +2006,11 @@ export interface _SERVICE {
     { 'Ok' : PreparedIdAlias } |
       { 'Err' : PrepareIdAliasError }
   >,
+  'prepare_session_delegation' : ActorMethod<
+    [UserNumber, SessionKey, [] | [bigint]],
+    { 'Ok' : PrepareSessionDelegation } |
+      { 'Err' : SessionDelegationError }
+  >,
   'register' : ActorMethod<
     [DeviceData, ChallengeResult, [] | [Principal]],
     RegisterResponse