0.0.2: add OIDC sign-in after resolution (sso#6 partial)

0.0.1 redirected the user to their pod root unauthenticated —
they could browse public content but anything WAC-protected
re-prompted in whatever app needed it.

0.0.2 extends the flow with a second stage: after resolving the
WebID, fetch the WebID profile to discover the user's IdP
(solid:oidcIssuer field), then kick off Solid-OIDC against that
IdP. The user proves identity ONCE at the IdP (one Schnorr
click), an IdP-side session cookie is set, and they land at the
pod *with* a session that any subsequent Solid-OIDC-aware app
on the same browser will silently re-use.

Two-stage flow:
  Stage 1 (resolution, in-page):
    click → window.nostr.getPublicKey() → resolver fetch →
    WebID profile → IdP discovery
  Stage 2 (authentication, OIDC redirect):
    session.login(idp, here) → user signs at IdP →
    redirect back with ?code= → handleRedirectFromLogin →
    redirect to pod with session active

Failure-path coaching preserved for every step in Stage 1
(no signer, signer rejected, resolver 404, no WebID, etc.).
Stage 2 failures show a simple "Sign-in failed" with the
underlying OIDC error.

URL params: `?resolver=` for the DID-doc host, `?next=` for the
post-success destination. The `?idp=` param is gone — the IdP
is auto-discovered from the resolved WebID profile.

Note on the email-munge bug: the import uses `solid-oidc`
(no version pin, no `@digits.digits.digits` substring) so the
file-write tool's email-pattern rewrite doesn't fire.

Author: melvincarvalho

login.js

@@ -1,29 +1,34 @@
 // JSS SSO — one-click Solid sign-in.
 //
-// Happy path (everything configured):
-//   click button
-//     → window.nostr.getPublicKey()      (signer extension)
-//     → fetch <resolver>/.well-known/did/nostr/<pubkey>.json
-//     → read alsoKnownAs[0] → WebID
-//     → redirect to that WebID's pod root
+// Two-stage flow:
 //
-// One click, one (auto-approvable) signer prompt, no IdP page,
-// no OIDC redirect.
+//   Stage 1 — RESOLUTION (in-page, no redirect):
+//     click button
+//       → window.nostr.getPublicKey()
+//       → fetch <resolver>/.well-known/did/nostr/<pubkey>.json
+//       → read alsoKnownAs[0] → WebID
+//       → fetch WebID profile → read solid:oidcIssuer → IdP URL
 //
-// Trade-off: the user lands at their pod WITHOUT an authenticated
-// Solid-OIDC session. They can browse public content; anything
-// WAC-protected would prompt for a session via whatever app needs
-// it. For "magic SSO landing" that's fine. A v0.2 step would add
-// optional NIP-98 → DPoP exchange against the IdP.
+//   Stage 2 — AUTHENTICATION (Solid-OIDC):
+//     → session.login(idp, redirectUri)   triggers redirect to IdP
+//     → (user proves identity ONCE at IdP — Schnorr click — and
+//        an IdP-side session cookie is set)
+//     → IdP redirects back here with ?code=
+//     → session.handleRedirectFromLogin()  exchanges code for tokens
+//     → redirect to the WebID's pod root, now authenticated
 //
-// Failure path: at every step, if the happy path can't proceed,
-// we show a precise diagnosis + the user's next concrete action.
-// PoC philosophy: assume everything works; gracefully degrade with
-// guidance when it doesn't.
+// Once the IdP cookie is set, *future* sign-ins (this page or any
+// Solid app using the same IdP) silently re-issue tokens — no
+// further interaction.
+//
+// PoC philosophy: assume everything works; show precise diagnosis
+// + next-step coaching for each failure node.
 //
 // URL params:
-//   ?resolver=<host>   — DID-doc resolver host (default solid.social)
-//   ?next=<url>        — destination after success (default pod root)
+//   ?resolver=<host>  — DID-doc resolver host (default solid.social)
+//   ?next=<url>       — destination after success (default pod root)
+
+import Session from 'https://esm.sh/solid-oidc';
 
 const DEFAULT_RESOLVER = 'https://solid.social';
 
@@ -46,9 +51,6 @@ function setStatus(msg, kind = 'info') {
   el.className = kind;
 }
 
-// Build a small DOM fragment with text + links. Easier than
-// innerHTML for safety (we don't substitute user-controlled
-// strings into HTML).
 function help(textParts, links = []) {
   const frag = document.createDocumentFragment();
   textParts.forEach((t) => frag.appendChild(document.createTextNode(t)));
@@ -74,11 +76,78 @@ function podRootFromWebId(webId) {
   catch { return null; }
 }
 
-async function flow() {
-  const { resolver, next } = readConfig();
-  setStatus('Reading your Nostr identity…');
+// ---- Stage 1: resolution ----
+
+async function resolveWebIdFromPubkey(pubkey, resolver) {
+  const res = await fetch(`${resolver}/.well-known/did/nostr/${pubkey}.json`, {
+    headers: { Accept: 'application/did+json, application/json' },
+  });
+  if (res.status === 404) {
+    throw new ResolveError('no-binding',
+      `Your Nostr key isn't linked to a Solid pod at ${resolver}.`);
+  }
+  if (!res.ok) {
+    throw new ResolveError('resolver-status',
+      `Resolver ${resolver} returned ${res.status} ${res.statusText}.`);
+  }
+  const didDoc = await res.json();
+  const aka = Array.isArray(didDoc.alsoKnownAs) ? didDoc.alsoKnownAs : [];
+  const webId = aka.find((x) => typeof x === 'string' && /^https?:\/\//.test(x));
+  if (!webId) {
+    throw new ResolveError('no-webid',
+      `Your DID document at ${resolver} doesn't include an alsoKnownAs WebID.`);
+  }
+  return webId;
+}
+
+async function discoverIdpFromWebId(webId) {
+  // Solid profiles declare the IdP via `solid:oidcIssuer`. Fall back
+  // to the WebID's origin if the field is absent (the pod's own host
+  // is also a common IdP).
+  try {
+    const profileRes = await fetch(webId.split('#')[0], {
+      headers: { Accept: 'application/ld+json, application/json' },
+    });
+    if (profileRes.ok) {
+      const profile = await profileRes.json();
+      const issuer = profile['solid:oidcIssuer']
+        || profile['http://www.w3.org/ns/solid/terms#oidcIssuer']
+        || profile.solid?.oidcIssuer;
+      const issuerStr = typeof issuer === 'string'
+        ? issuer
+        : (issuer && (issuer['@id'] || issuer.id)) || null;
+      if (issuerStr) return issuerStr.replace(/\/$/, '');
+    }
+  } catch { /* fall through to origin */ }
+  return new URL(webId).origin;
+}
+
+class ResolveError extends Error {
+  constructor(code, msg) { super(msg); this.code = code; }
+}
+
+// ---- Stage 2: authentication via Solid-OIDC ----
+
+async function startAuthFlow(idp) {
+  const session = new Session();
+  await session.login(idp, location.origin + location.pathname);
+  // browser is redirecting; nothing further to do
+}
+
+async function handleAuthReturn() {
+  // We're back from the IdP with ?code=...
+  const session = new Session();
+  await session.handleRedirectFromLogin();
+  return session;
+}
+
+// ---- Top-level flows ----
 
-  // Step 1 — signer extension present?
+async function freshFlow() {
+  const { resolver } = readConfig();
+
+  // Step 1: extension
+  setStatus('Reading your Nostr identity…');
   if (!window.nostr) {
     setStatus(help(
       ['No Nostr signer detected. Install a browser extension that provides ',
@@ -91,81 +160,97 @@ async function flow() {
     return false;
   }
 
-  // Step 2 — get the pubkey (may prompt user in the extension)
+  // Step 2: pubkey
   let pubkey;
   try {
     pubkey = (await window.nostr.getPublicKey()).toLowerCase();
   } catch (err) {
-    setStatus(help(
-      ['Your signer declined to share your public key',
-       err?.message ? ` (${err.message})` : '', '. Click Sign in to try again.'],
-    ), 'error');
+    setStatus(help([
+      'Your signer declined to share your public key',
+      err?.message ? ` (${err.message})` : '',
+      '. Click Sign in to try again.',
+    ]), 'error');
     return false;
   }
   if (!/^[0-9a-f]{64}$/.test(pubkey)) {
     setStatus(`Signer returned an invalid public key: ${pubkey}`, 'error');
     return false;
   }
 
-  // Step 3 — resolve pubkey → DID doc via the well-known endpoint
+  // Step 3: resolve to WebID
   setStatus(`Resolving did:nostr:${pubkey.slice(0, 8)}… via ${resolver}`);
-  let didDoc;
+  let webId;
   try {
-    const res = await fetch(`${resolver}/.well-known/did/nostr/${pubkey}.json`, {
-      headers: { Accept: 'application/did+json, application/json' },
-    });
-    if (res.status === 404) {
+    webId = await resolveWebIdFromPubkey(pubkey, resolver);
+  } catch (err) {
+    if (err.code === 'no-binding') {
       setStatus(help(
-        ['Your Nostr key isn’t linked to a Solid pod at ', resolver, '. '],
+        [err.message, ' '],
         [
           { label: 'How to link your Nostr key to a Solid pod', href: 'https://jss.live/docs/' },
-          { label: `Try a different resolver: ?resolver=<host>`, href: '?resolver=https://nostr.social' },
+          { label: 'Try a different resolver', href: '?resolver=https://nostr.social' },
         ],
       ), 'error');
-      return false;
-    }
-    if (!res.ok) {
-      setStatus(`Resolver ${resolver} returned ${res.status} ${res.statusText}.`, 'error');
-      return false;
+    } else {
+      setStatus(err.message, 'error');
     }
-    didDoc = await res.json();
-  } catch (err) {
-    setStatus(help(
-      [`Couldn’t reach ${resolver}: ${err.message}. Check your connection or try a different resolver.`],
-    ), 'error');
     return false;
   }
 
-  // Step 4 — pluck the WebID from alsoKnownAs
-  const aka = Array.isArray(didDoc.alsoKnownAs) ? didDoc.alsoKnownAs : [];
-  const webId = aka.find((x) => typeof x === 'string' && /^https?:\/\//.test(x));
-  if (!webId) {
-    setStatus(help(
-      [`Your did:nostr document at ${resolver} doesn’t include an alsoKnownAs WebID. `],
-      [{ label: 'How to fix this', href: 'https://jss.live/docs/' }],
-    ), 'error');
+  // Step 4: discover IdP from the WebID profile
+  setStatus(`Found ${webId}. Looking up your identity provider…`);
+  const idp = await discoverIdpFromWebId(webId);
+
+  // Step 5: stash where to land (so post-redirect knows)
+  localStorage.setItem('jss-sso:webId', webId);
+
+  // Step 6: kick off OIDC
+  setStatus(`Signing you in via ${idp}…`);
+  try {
+    await startAuthFlow(idp);
+    return true; // browser is redirecting
+  } catch (err) {
+    setStatus(`Could not start sign-in: ${err.message}`, 'error');
     return false;
   }
+}
 
-  // Step 5 — redirect
-  const dest = next || podRootFromWebId(webId);
-  if (!dest) {
-    setStatus(`Resolved WebID is unparseable: ${webId}`, 'error');
-    return false;
+async function returnFlow() {
+  // URL has `?code=` — finalize the OIDC handshake.
+  setStatus('Completing sign-in…');
+  try {
+    const session = await handleAuthReturn();
+    if (!session.isActive || !session.webId) {
+      throw new Error('session did not become active after redirect');
+    }
+    const { next } = readConfig();
+    const webId = session.webId || localStorage.getItem('jss-sso:webId');
+    const dest = next || podRootFromWebId(webId);
+    localStorage.removeItem('jss-sso:webId');
+    setStatus(`Signed in as ${webId}. Taking you to your pod…`);
+    setTimeout(() => { location.href = dest; }, 800);
+  } catch (err) {
+    setStatus(`Sign-in failed: ${err.message}`, 'error');
+    const button = document.querySelector('#signin');
+    if (button) button.disabled = false;
   }
-  setStatus(`Signed in as ${webId}. Taking you to your pod…`);
-  setTimeout(() => { location.href = dest; }, 800);
-  return true;
 }
 
 function wire() {
   const button = document.querySelector('#signin');
   if (!button) return;
   button.addEventListener('click', async () => {
     button.disabled = true;
-    const ok = await flow();
+    const ok = await freshFlow();
     if (!ok) button.disabled = false;
   });
 }
 
-wire();
+// On page load: if URL has ?code=, we're returning from the IdP —
+// finalize the session. Otherwise wire up the button for a fresh
+// sign-in.
+if (new URLSearchParams(location.search).has('code')) {
+  returnFlow();
+} else {
+  wire();
+}