Implement API to auto-select identity based on known principal #2563

frederikrothenberger · 2024-08-20T14:43:31Z

This adds the option to specify a principal when requesting a session such that II auto-select the identity if the principal is known.

If the principal is not known, II will fall back to default behaviour (same as now) with manual identity selection.

🟡 Some screens were changed

This adds the option to specify a principal when requesting a session such that II auto-select the identity if the principal is known. If the principal is not known, II will fall back to default behaviour (same as now) with manual identity selection.

lmuntaner

Why do you call it auto, it sounds like a boolean to me? Why not only selectedIdentity?

Using the matching part, it seems as if one could pass a regex.

I also added some minor comments.

lmuntaner · 2024-08-23T10:43:45Z

docs/ii-spec.mdx

@@ -172,6 +173,8 @@ This section describes the Internet Identity Service from the point of view of a

    -   the `derivationOrigin`, if present, indicates an origin that should be used for principal derivation instead of the client origin. Internet Identity will only accept values that are also listed in the HTTP resource `/.well-known/ii-alternative-origins` of the corresponding canister (see [Alternative Frontend Origins](#alternative-frontend-origins)).

+    -   the `autoSelectMatchingIdentity`, if present, indicates the textual representation of this dapp's principal for which the delegation is requested. If it is known to Internet Identity, it will skip the identity selection and immediately prompt for authentication. This feature can be used to streamline re-authentication after a session expiry.


Do you have a list of changes downstream for this?

First thoughts are auth-client and II docs

Anything else?

As discussed, we only need to have the docs rebuilt after merging.

lmuntaner · 2024-08-23T10:47:27Z

src/frontend/src/components/authenticateBox.ts

-    pick: (pickProps: { anchors: NonEmptyArray<bigint> }) =>
+    pick: (pickProps: {
+      anchors: NonEmptyArray<bigint>;
+      autoSelect?: bigint;


autoSelect seems like a boolean type of parameter. How about selectedIdentity?

As discussed, it is only automatically selected on the initial picker screen, but the user can still override that by cancelling the passkey interaction and picking something else.

lmuntaner · 2024-08-23T10:48:55Z

src/frontend/src/components/authenticateBox.ts

      new Promise<
        { tag: "more_options" } | { tag: "pick"; userNumber: bigint }
-      >((resolve) =>
+      >((resolve) => {
+        // render page first so that when the identity is picked and the passkey


What is it that we need to wait? Couldn't we show a spinner while we wait for it and then resolve?

Well, normally we wait for the user to chose. But if we have an a autoSelect identity, then the action completes immediately. I am just threading it through here, because the identity picker should still be rendered, before automatically selecting something. Otherwise you have the passkey interaction from a completely blank page, which is pretty weird. This way, you have at least a (albeit blurred out) version of the II page in the background.

We could render something else if we want to improve it I guess. But definitely not a priority.

lmuntaner · 2024-08-23T10:49:43Z

src/frontend/src/flows/authorize/index.ts

@@ -188,6 +188,14 @@ const authenticate = async (
    };
  }

+  let autoSelectIdentity = undefined;
+  if (nonNullish(authContext.authRequest.autoSelectMatchingIdentity)) {
+    autoSelectIdentity = await getAnchorByPrincipal({


Same here, this is an identity, now? Why call it auto?

Well, yes. getAnchorByPrincipal resolves the supplied Principal to an identity (number).

lmuntaner · 2024-08-23T10:51:42Z

src/frontend/src/flows/authorize/postMessageInterface.ts

@@ -1,5 +1,6 @@
 // Types and functions related to the window post message interface used by
 // applications that want to authenticate the user using Internet Identity
+import { zodPrincipal } from "@dfinity/internet-identity-vc-api";


Should we put it somewhere else? zodPrincipal doesn't seem related to internet-identity-vc-api to me. I don't think I would remember to import it from here.

Maybe not in this PR though.

Yeah, I thought about it. But then we need to have yet another package that only provides the zodPrincipal. Maybe we could put that into ic-js? AFAIK @peterpeterparker also needs this definition in the signer library.

Seems weird there as well. I was thinking more in II directly. I think that repeating this code in multiple places is also ok.

frederikrothenberger · 2024-08-23T14:35:58Z

Why do you call it auto, it sounds like a boolean to me? Why not only selectedIdentity?

Because it automatically selects the identity when loading the page (in the future). And it is not guaranteed that it finds the apropriate identity to select. Also, the user can override that selection.

Using the matching part, it seems as if one could pass a regex.

The rp can only supply a principal (that we then need to match against known values). We can also call it autoSelectionPrincipal?

lmuntaner

LGTM! Thanks for the answers. I don't have a better name, so let's not wait and merge this.

frederikrothenberger · 2024-08-26T13:42:27Z

LGTM! Thanks for the answers. I don't have a better name, so let's not wait and merge this.

After some consideration I like autoSelectionPrincipal better. I have renamed the field and duplicated the zodPrincipal. The rest is still the same.

Thanks for the feedback!

This is an enhancement to the auto-selection feature introduced in #2563: In order to not confuse users, only the most recently used identity can be auto-selected (i.e. when refreshing sessions). This way, a dapp cannot make a user _switch_ identities without them having the identity selected explicitly.

* Only allow the most recently used identity to be auto-selected This is an enhancement to the auto-selection feature introduced in #2563: In order to not confuse users, only the most recently used identity can be auto-selected (i.e. when refreshing sessions). This way, a dapp cannot make a user _switch_ identities without them having the identity selected explicitly. * Address review input

frederikrothenberger requested a review from a team as a code owner August 20, 2024 14:43

frederikrothenberger requested a review from lmuntaner August 20, 2024 14:43

lmuntaner reviewed Aug 23, 2024

View reviewed changes

lmuntaner approved these changes Aug 26, 2024

View reviewed changes

Frederik Rothenberger added 2 commits August 26, 2024 15:30

Rename new field to autoSelectionPrincipal

c128bd4

Copy zodPrincipal definition

775eb27

frederikrothenberger enabled auto-merge August 26, 2024 13:50

frederikrothenberger added this pull request to the merge queue Aug 26, 2024

Merged via the queue into main with commit 1bd233a Aug 26, 2024
65 checks passed

frederikrothenberger deleted the frederik/bypass-identity-selection branch August 26, 2024 14:07

frederikrothenberger mentioned this pull request Aug 29, 2024

Only allow the most recently used identity to be auto-selected #2579

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement API to auto-select identity based on known principal #2563

Implement API to auto-select identity based on known principal #2563

frederikrothenberger commented Aug 20, 2024 •

edited by github-actions bot

Loading

lmuntaner left a comment

lmuntaner Aug 23, 2024

frederikrothenberger Aug 23, 2024

lmuntaner Aug 23, 2024

frederikrothenberger Aug 23, 2024

lmuntaner Aug 23, 2024

frederikrothenberger Aug 23, 2024

lmuntaner Aug 26, 2024

lmuntaner Aug 23, 2024

frederikrothenberger Aug 23, 2024

lmuntaner Aug 23, 2024

frederikrothenberger Aug 23, 2024 •

edited

Loading

lmuntaner Aug 26, 2024

frederikrothenberger commented Aug 23, 2024

lmuntaner left a comment

frederikrothenberger commented Aug 26, 2024

		@@ -172,6 +173,8 @@ This section describes the Internet Identity Service from the point of view of a

		- the `derivationOrigin`, if present, indicates an origin that should be used for principal derivation instead of the client origin. Internet Identity will only accept values that are also listed in the HTTP resource `/.well-known/ii-alternative-origins` of the corresponding canister (see [Alternative Frontend Origins](#alternative-frontend-origins)).

		- the `autoSelectMatchingIdentity`, if present, indicates the textual representation of this dapp's principal for which the delegation is requested. If it is known to Internet Identity, it will skip the identity selection and immediately prompt for authentication. This feature can be used to streamline re-authentication after a session expiry.

Implement API to auto-select identity based on known principal #2563

Implement API to auto-select identity based on known principal #2563

Conversation

frederikrothenberger commented Aug 20, 2024 • edited by github-actions bot Loading

lmuntaner left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

frederikrothenberger Aug 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

frederikrothenberger commented Aug 23, 2024

lmuntaner left a comment

Choose a reason for hiding this comment

frederikrothenberger commented Aug 26, 2024

frederikrothenberger commented Aug 20, 2024 •

edited by github-actions bot

Loading

frederikrothenberger Aug 23, 2024 •

edited

Loading