fix: bind provider lookups to the asking client's grant when a session has several

.changeset/oidc-grant-binding-per-client.md

@@ -0,0 +1,5 @@
+---
+'seamless-auth-api': patch
+---
+
+Bind provider lookups and signatures to the grant for the asking client, even when one session has signed in to several clients. The check used to read one grant for the session and compare its client, so a session signed in to two apps could be refused for one of them.

src/services/oidcPayloadStore.ts

@@ -134,10 +134,13 @@ async function findOne(
 export async function hasOidcGrantForSession(sessionId: string, clientId: string) {
   if (!isUuid(sessionId)) return false;
 
+  // One first-party session can sign in to several clients, so the client is part of the
+  // query rather than checked on whichever grant comes back first.
   const grant = await OidcPayload.findOne({
     where: {
       model: 'Grant',
       sessionId,
+      payload: { clientId },
       expiresAt: { [Op.gt]: new Date() },
     } as WhereOptions<OidcPayloadAttributes>,
   });

tests/postgres/oidcProvider.spec.ts

@@ -136,6 +136,31 @@ describe('grant binding', () => {
     expect((await findGrantBoundSession(session.id, 'app'))?.id).toBe(session.id);
     expect(await findGrantBoundSession(session.id, 'other')).toBeNull();
   });
+
+  it('binds every client a session signed in to, not just one of them', async () => {
+    const { User } = await import('../../src/models/users.js');
+    const { Session } = await import('../../src/models/sessions.js');
+    const user = await User.create({ email: `${randomUUID()}@example.com` } as never);
+    const session = await Session.create({
+      userId: user.id,
+      mode: 'server',
+      expiresAt: new Date(Date.now() + 3_600_000),
+      idleExpiresAt: new Date(Date.now() + 3_600_000),
+    });
+
+    for (const clientId of ['first', 'second', 'third']) {
+      await upsertOidcPayload('Grant', randomUUID(), {
+        payload: { clientId, accountId: user.id },
+        expiresIn: 600,
+        sessionId: session.id,
+      });
+    }
+
+    for (const clientId of ['first', 'second', 'third']) {
+      expect((await findGrantBoundSession(session.id, clientId))?.id).toBe(session.id);
+    }
+    expect(await findGrantBoundSession(session.id, 'other')).toBeNull();
+  });
 });
 
 describe('oidc_clients', () => {

tests/unit/services/oidcPayloadStore.spec.ts

@@ -158,7 +158,7 @@ describe('hasOidcGrantForSession', () => {
     vi.mocked(OidcPayload.findOne).mockResolvedValueOnce({ payload: { clientId: 'app' } } as never);
     expect(await hasOidcGrantForSession(SESSION, 'app')).toBe(true);
     expect(vi.mocked(OidcPayload.findOne).mock.calls[0][0]).toMatchObject({
-      where: { model: 'Grant', sessionId: SESSION },
+      where: { model: 'Grant', sessionId: SESSION, payload: { clientId: 'app' } },
     });
 
     vi.mocked(OidcPayload.findOne).mockResolvedValueOnce({