feat(fe): cap the account delegation at the SSO session length

[sea-snake]

Top of stack, stacked on #4189.

Motivation

The sign-in screen and the relying party both key re-authentication off delegation expiry. Without this, an organization could set an eight-hour session and a dapp holding a 30-day delegation would carry on working long past it, with only attribute verification failing.

Changes

• The sign-in flow carries the organization's session length from the discovery result onto the authenticated session, for both the fresh-sign-in and last-used paths.
• The delegation handler bounds the maxTimeToLive it requests for the account delegation by that value, via cappedMaxTimeToLive. An app asking for 30 days on an eight-hour domain gets eight hours; a shorter request is left alone.

This is a UX cap, not a security boundary, and it is applied in the frontend deliberately: a delegation identifies the identity rather than the SSO session, so any other access method on the anchor can mint a fresh one regardless. The organization's deadline is enforced by the expiry inside the certified attribute bundle (#4189).

Tests

• New unit tests for the clamp: non-SSO sessions pass through, a longer request is capped, a shorter request is untouched, and the organization's value applies when nothing was requested.
• tsc --project tsconfig.all.json: clean. eslint: clean. Frontend unit tests pass.

Administrator-facing documentation is in dfinity/developer-docs#340.

🤖 Generated with Claude Code

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 793862f.

Security Overview

• 🔎 Scanned files: 3 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=f0fad1cb-5a8b-439a-be66-5992fde97439&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► src/frontend/src/lib/flows/authFlow.svelte.ts     Modify to extract and propagate ssoSessionMaxAgeNs from ssoResult, pass it to openIdJwtSignIn, and store it in authentication
Enhancement	► src/frontend/src/lib/stores/authentication.store.ts     Update Authenticated.authMethod.openid to include ssoSessionMaxAgeNs (optional)
Enhancement	► src/frontend/src/lib/stores/channelHandlers/delegation.ts     Read authMethod to obtain ssoSessionMaxAgeNs and adjust maxTimeToLive accordingly

[Copilot]

Pull request overview

This PR updates the frontend delegation flow to ensure the requested account delegation TTL cannot exceed an SSO organization’s configured session length, keeping delegation-expiry behavior aligned with SSO session validity.

Changes:

• Introduce cappedMaxTimeToLive utility to bound delegation TTL by SSO session max age.
• Plumb SSO session max age (sessionMaxAgeNs) from SSO discovery into the authenticated session state.
• Apply the cap when preparing account delegations, and add unit tests for the new utility.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/frontend/src/lib/utils/sessionDuration.ts	Adds cappedMaxTimeToLive helper to cap delegation TTL using SSO session max age.
src/frontend/src/lib/utils/sessionDuration.test.ts	Adds unit tests covering cappedMaxTimeToLive behavior.
src/frontend/src/lib/stores/channelHandlers/delegation.ts	Uses cappedMaxTimeToLive when computing maxTimeToLive for account delegations.
src/frontend/src/lib/stores/authentication.store.ts	Extends authenticated session state with optional ssoSessionMaxAgeNs.
src/frontend/src/lib/flows/authLastUsedFlow.svelte.ts	Persists SSO session max age from discovery for “last used” SSO sign-ins.
src/frontend/src/lib/flows/authFlow.svelte.ts	Threads SSO session max age through SSO sign-in flow into authenticationStore.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/frontend/src/lib/utils/sessionDuration.ts:123

• cappedMaxTimeToLive can return a non-positive requestedNanos unchanged. Since params.maxTimeToLive is decoded via BigInt(...) and can be 0/negative, this can later be passed to prepare_account_delegation whose candid arg is Nat64 (see src/frontend/src/lib/generated/internet_identity_idl.js:1287), causing a serialization/runtime error. Consider treating non-positive requestedNanos (and defensively non-positive ssoSessionMaxAgeNanos) as undefined, consistent with how sessionDurationCeilingSeconds treats malformed requests.

export const cappedMaxTimeToLive = (
  requestedNanos: bigint | undefined,
  ssoSessionMaxAgeNanos: bigint | undefined,
): bigint | undefined => {
  if (ssoSessionMaxAgeNanos === undefined) {
    return requestedNanos;
  }
  if (requestedNanos === undefined) {
    return ssoSessionMaxAgeNanos;
  }
  return requestedNanos > ssoSessionMaxAgeNanos
    ? ssoSessionMaxAgeNanos
    : requestedNanos;
};