fix: preserve reauthentication through consent

Add multi-account regression coverage for prompt=login consent, max_age, OP logout, cross-client account-selection policy, and pending TOTP promotion. Rebind trusted reauthentication fingerprints across authorize/consent continuation prompt transitions while keeping the session bound to the selected user and authenticated_at.

Author: winetree94

packages/server/src/routes/api/auth/accounts.test.ts

@@ -1,6 +1,7 @@
 import { testClient } from 'hono/testing';
 import { afterAll, beforeAll, describe, expect, test } from 'vitest';
 import type { AppType } from '../../../entrypoints/app.ts';
+import type { TinyAuthRuntimeConfigInput } from '../../../lib/config/index.ts';
 import type { ServiceContainer } from '../../../services/container.ts';
 import {
   assertJsonBody,
@@ -19,6 +20,10 @@ let app: AppType;
 let services: ServiceContainer;
 let cleanup: () => Promise<void>;
 
+type TestClientConfig = NonNullable<
+  TinyAuthRuntimeConfigInput['clients']
+>[number];
+
 beforeAll(async () => {
   const server = await createTestApp({
     ...MINIMAL_TEST_CONFIG,
@@ -172,6 +177,122 @@ describe('remembered account APIs', () => {
     }
   });
 
+  test('applies each requesting client policy without corrupting the shared remembered roster', async () => {
+    const restrictedRedirectUri = 'http://localhost:8080/restricted-callback';
+    const normalRedirectUri = 'http://localhost:8080/normal-callback';
+    const restrictedClient = {
+      ...TEST_OAUTH_CLIENT_CONFIG,
+      id: 'restricted-account-selection-client-config',
+      name: 'Restricted Account Selection Client',
+      client_id: 'restricted-account-selection-client',
+      redirect_uris: [restrictedRedirectUri],
+      account_selection: {
+        mode: 'never',
+        allow_add_account: false,
+      },
+    } satisfies TestClientConfig;
+    const normalClient = {
+      ...TEST_OAUTH_CLIENT_CONFIG,
+      id: 'normal-account-selection-client-config',
+      name: 'Normal Account Selection Client',
+      client_id: 'normal-account-selection-client',
+      redirect_uris: [normalRedirectUri],
+    } satisfies TestClientConfig;
+    const scopedServer = await createTestApp({
+      ...MINIMAL_TEST_CONFIG,
+      auth: {
+        account_selection: {
+          enabled: true,
+          mode: 'smart',
+          allow_add_account: true,
+        },
+      },
+      clients: [restrictedClient, normalClient],
+      users: [TEST_USER_CONFIG],
+    });
+
+    try {
+      const scopedClient = testClient(scopedServer.app);
+      const secondUser = await createPasswordUser(
+        undefined,
+        scopedServer.services,
+      );
+      const firstLogin = await scopedClient.api.auth.login.$post({
+        json: { email: TEST_USER.email, password: TEST_USER.password },
+      });
+      const firstCookie = extractCookie(firstLogin, 'session');
+      const secondLogin = await scopedClient.api.auth.login.$post(
+        { json: { email: secondUser.email, password: secondUser.password } },
+        { headers: { Cookie: `session=${firstCookie}` } },
+      );
+      const sessionCookie = extractCookie(secondLogin, 'session');
+
+      const restrictedListRes = await scopedClient.api.auth.accounts.$get(
+        { query: { client_id: restrictedClient.client_id } },
+        { headers: { Cookie: `session=${sessionCookie}` } },
+      );
+      const restrictedList = await assertJsonBody(restrictedListRes);
+      expect(restrictedList.allow_add_account).toBe(false);
+      expect(restrictedList.accounts.map((account) => account.sub)).toEqual([
+        TEST_USER_CONFIG.sub,
+        secondUser.sub,
+      ]);
+
+      const restrictedAuthorizeRes = await scopedClient.oauth.authorize.$get(
+        {
+          query: {
+            response_type: 'code',
+            client_id: restrictedClient.client_id,
+            redirect_uri: restrictedRedirectUri,
+            scope: 'openid profile email',
+            state: 'restricted-client-selection-state',
+            code_challenge: 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ',
+            code_challenge_method: 'S256',
+            prompt: 'select_account',
+          },
+        },
+        { headers: { Cookie: `session=${sessionCookie}` } },
+      );
+      expect(restrictedAuthorizeRes.status).toBe(302);
+      expect(
+        new URL(restrictedAuthorizeRes.headers.get('location') ?? '').pathname,
+      ).toBe('/login');
+
+      const normalListRes = await scopedClient.api.auth.accounts.$get(
+        { query: { client_id: normalClient.client_id } },
+        { headers: { Cookie: `session=${sessionCookie}` } },
+      );
+      const normalList = await assertJsonBody(normalListRes);
+      expect(normalList.allow_add_account).toBe(true);
+      expect(normalList.accounts.map((account) => account.sub)).toEqual([
+        TEST_USER_CONFIG.sub,
+        secondUser.sub,
+      ]);
+
+      const normalAuthorizeRes = await scopedClient.oauth.authorize.$get(
+        {
+          query: {
+            response_type: 'code',
+            client_id: normalClient.client_id,
+            redirect_uri: normalRedirectUri,
+            scope: 'openid profile email',
+            state: 'normal-client-selection-state',
+            code_challenge: 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ',
+            code_challenge_method: 'S256',
+            prompt: 'select_account',
+          },
+        },
+        { headers: { Cookie: `session=${sessionCookie}` } },
+      );
+      expect(normalAuthorizeRes.status).toBe(302);
+      expect(
+        new URL(normalAuthorizeRes.headers.get('location') ?? '').pathname,
+      ).toBe('/account/select');
+    } finally {
+      await scopedServer.cleanup();
+    }
+  });
+
   test('returns disabled affordances and no remembered roster when global account selection is disabled', async () => {
     const scopedServer = await createTestApp({
       ...MINIMAL_TEST_CONFIG,

packages/server/src/routes/api/auth/stateful-flow.test.ts

@@ -18,6 +18,7 @@ import type { ServiceContainer } from '../../../services/container.ts';
 import {
   assertJsonBody,
   createTestApp,
+  enableTotpForUser,
   expectError,
   extractCookie,
   generateUniqueEmail,
@@ -666,6 +667,99 @@ describe('Stateful auth flows', () => {
     }
   });
 
+  test('keeps the current account active while a different account waits for TOTP verification', async () => {
+    const scopedServer = await createTestApp({
+      ...MINIMAL_TEST_CONFIG,
+      auth: {
+        password: {
+          enabled: true,
+          totp: {
+            enabled: true,
+            issuer: 'TinyAuthPendingTotpSwitchTest',
+          },
+        },
+        account_selection: {
+          enabled: true,
+          mode: 'smart',
+        },
+      },
+    });
+
+    try {
+      const password = 'stateful-switch-totp-password-123';
+      const userAEmail = generateUniqueEmail('stateful-switch-totp-a');
+      const userBEmail = generateUniqueEmail('stateful-switch-totp-b');
+
+      const { userA, userB } = await withMikroContext(
+        scopedServer.services,
+        async () => {
+          const passwordHash =
+            await scopedServer.services.securityService.hashPassword(password);
+          const userAEntity = scopedServer.services.mikro.user.create({
+            email: userAEmail,
+            password_hash: passwordHash,
+          });
+          userAEntity.email_verified = true;
+          const userBEntity = scopedServer.services.mikro.user.create({
+            email: userBEmail,
+            password_hash: passwordHash,
+          });
+          userBEntity.email_verified = true;
+          scopedServer.services.mikro.em.persist(userAEntity);
+          scopedServer.services.mikro.em.persist(userBEntity);
+          await scopedServer.services.mikro.em.flush();
+          return { userA: userAEntity, userB: userBEntity };
+        },
+      );
+      const totpSecret = await enableTotpForUser(
+        scopedServer.services,
+        userB.sub,
+      );
+
+      const client = testClient(scopedServer.app);
+      const loginARes = await client.api.auth.login.$post({
+        json: { email: userAEmail, password },
+      });
+      expect(loginARes.status).toBe(200);
+      const userACookie = extractCookie(loginARes, 'session');
+
+      const loginBRes = await client.api.auth.login.$post(
+        { json: { email: userBEmail, password } },
+        { headers: { Cookie: `session=${userACookie}` } },
+      );
+      const loginBBody = await assertJsonBody(loginBRes);
+      expect(loginBBody.user.sub).toBe(userB.sub);
+      expect(loginBBody.user.totp_registered).toBe(true);
+      const pendingTotpCookie = extractCookie(loginBRes, 'session');
+
+      const pendingSessionRes = await client.api.user.session.$get(
+        {},
+        { headers: { Cookie: `session=${pendingTotpCookie}` } },
+      );
+      const pendingSessionBody = await assertJsonBody(pendingSessionRes);
+      expect(pendingSessionBody.user?.sub).toBe(userA.sub);
+
+      const verifyRes = await client.api.auth.totp.verify.$post(
+        {
+          json: {
+            code: scopedServer.services.totpService.generateToken(totpSecret),
+          },
+        },
+        { headers: { Cookie: `session=${pendingTotpCookie}` } },
+      );
+      const verifyBody = await assertJsonBody(verifyRes);
+      expect(verifyBody.user.sub).toBe(userB.sub);
+      const verifiedCookie = extractCookie(verifyRes, 'session');
+      const verifiedSession = await readEncryptedSessionCookie(verifiedCookie);
+      expect(verifiedSession).toMatchObject({
+        user: { sub: userB.sub },
+        accounts: [{ sub: userA.sub }, { sub: userB.sub }],
+      });
+    } finally {
+      await scopedServer.cleanup();
+    }
+  });
+
   test('keeps active account when stale pending 2FA login user is missing', async () => {
     const scopedServer = await createTestApp({
       ...MINIMAL_TEST_CONFIG,

packages/server/src/routes/api/consent/post.test.ts

@@ -51,6 +51,7 @@ function buildReauthenticationRequestFingerprint(params: {
   ui_locales?: string | undefined;
   id_token_hint?: string | undefined;
   acr_values?: string | undefined;
+  account_selected?: '1' | undefined;
 }): string {
   return JSON.stringify(
     [
@@ -70,6 +71,7 @@ function buildReauthenticationRequestFingerprint(params: {
       ['ui_locales', params.ui_locales],
       ['id_token_hint', params.id_token_hint],
       ['acr_values', params.acr_values],
+      ['account_selected', params.account_selected],
     ].filter(([, value]) => value !== undefined),
   );
 }
@@ -233,6 +235,44 @@ describe('POST /api/consent', () => {
     expect(redirect.searchParams.get('state')).toBe('state-login-consent');
   });
 
+  test('should preserve reauthentication when consent submits after prompt=login was stripped', async () => {
+    const originalBody: ConsentAllowBody = {
+      client_id: TEST_OAUTH_CLIENT.clientId,
+      redirect_uri: TEST_OAUTH_CLIENT.redirectUri,
+      response_type: 'code',
+      scope: 'openid profile email',
+      state: 'state-stripped-login-consent',
+      nonce: 'nonce-stripped-login-consent',
+      code_challenge: TEST_PKCE.codeChallenge,
+      code_challenge_method: TEST_PKCE.codeChallengeMethod,
+      prompt: 'login consent',
+      max_age: 0,
+      login_hint: TEST_USER_CONFIG.email,
+      account_selected: '1',
+      reauthenticated: '1',
+      decision: 'allow',
+    };
+    const sessionCookie =
+      await createBoundReauthenticationSessionCookie(originalBody);
+    const client = testClient(app);
+
+    const res = await client.api.consent.$post(
+      {
+        json: {
+          ...originalBody,
+          prompt: 'consent',
+        },
+      },
+      { headers: { Cookie: `session=${sessionCookie}` } },
+    );
+
+    const responseBody = await assertJsonBody(res, 200);
+    const redirect = new URL(responseBody.redirect_url);
+    expect(redirect.searchParams.get('reauthenticated')).toBe('1');
+    expect(redirect.searchParams.get('account_selected')).toBe('1');
+    expect(redirect.searchParams.has('prompt')).toBe(false);
+  });
+
   test('should not consume prompt=login based on forged reauthenticated body value', async () => {
     const authenticatedAt = Math.floor(Date.now() / 1000);
     const sessionCookie = await encrypt(