Add verified OIDC self-service identity linking

app/account_step_up_routes.py

@@ -6,7 +6,7 @@
 import secrets
 from threading import Lock
 
-from flask import Blueprint, jsonify, request, session
+from flask import Blueprint, jsonify, request, session, url_for
 from flask_login import current_user, login_required
 from webauthn import (
     base64url_to_bytes,
@@ -95,6 +95,7 @@ def _action_target(action, data):
         "totp.enroll": "totp",
         "totp.delete": "totp",
         "recovery.rotate": "recovery",
+        "oidc.self_link": "oidc",
     }.get(action)
     if feature is not None and not feature_is_active(feature):
         raise StepUpError("step-up request is invalid")
@@ -553,15 +554,13 @@ def oidc_step_up_start():
     from .oidc_routes import begin_oidc_account_step_up
 
     try:
-        response = begin_oidc_account_step_up(
+        return begin_oidc_account_step_up(
             intent=intent,
-            continuation=data.get("continuation") or "/security",
+            continuation=url_for("security_center"),
+            return_authorization_url=True,
         )
     except (OIDCStateError, StepUpError):
         return _error("step_up_failed", 403)
-    if isinstance(response, tuple):
-        return response
-    return jsonify({"authorization_url": response.headers["Location"]})
 
 
 @account_step_up_blueprint.post("/api/account/step-up/status")

app/auth_assurance.py

@@ -347,6 +347,9 @@ def invalidate_user_authentication(
     GitHubOAuthState.query.filter_by(user_id=user.id).delete(
         synchronize_session=False
     )
+    OIDCLoginState.query.filter_by(user_id=user.id).delete(
+        synchronize_session=False
+    )
     if step_up_intent_ids:
         GitHubOAuthState.query.filter(
             GitHubOAuthState.step_up_intent_id.in_(step_up_intent_ids)

app/models.py

@@ -231,6 +231,19 @@ def ensure_security_columns():
             "ALTER TABLE oidc_login_states ADD COLUMN step_up_intent_id "
             "INTEGER"
         )
+    if 'user_id' not in existing:
+        additions.append(
+            "ALTER TABLE oidc_login_states ADD COLUMN user_id INTEGER"
+        )
+    if 'auth_generation' not in existing:
+        additions.append(
+            "ALTER TABLE oidc_login_states ADD COLUMN auth_generation INTEGER"
+        )
+    if 'authentication_session_id' not in existing:
+        additions.append(
+            "ALTER TABLE oidc_login_states ADD COLUMN "
+            "authentication_session_id INTEGER"
+        )
     for statement in additions:
         db.session.execute(text(statement))
     if additions:
@@ -669,7 +682,7 @@ def cleanup_expired_security_rows(limit=500, now=None):
 
 
 class OIDCIdentity(db.Model):
-    """Administrator-approved stable external identity mapping."""
+    """Verified stable external identity mapping to a WebSSH account."""
 
     __tablename__ = 'oidc_identities'
     __table_args__ = (
@@ -712,6 +725,15 @@ class OIDCLoginState(db.Model):
         default='login',
         server_default='login',
     )
+    user_id = db.Column(
+        db.Integer,
+        db.ForeignKey('users.id'),
+        nullable=True,
+    )
+    auth_generation = db.Column(db.Integer, nullable=True)
+    # No foreign key: an in-flight provider redirect must never block logout
+    # or deletion of the server-side authentication session it references.
+    authentication_session_id = db.Column(db.Integer, nullable=True)
     continuation = db.Column(
         db.String(512),
         nullable=False,