fix(auth-ui): mint fingerprintId cookie so it's set for all sessions

The prior commit READ the fingerprintId cookie but nothing SET it, so a browser
without the old app's cookie still got fingerprintID: null. Add
getOrCreateFingerprintId(request) — mirroring getCsrfToken's [value, setCookie]
seam: reuse the cookie when present, else mint crypto.randomUUID() + a Set-Cookie
(httpOnly, Path=/, Max-Age=1y, SameSite=Lax, Secure in production), matching the
old app's attributes with a bare-UUID value for round-trip parity. The login and
SSO createSession paths pass the minted id to userAgentFromRequest and append the
Set-Cookie to their response, so even the first login already carries it.

datum-cloud/enhancements#755

Author: yahyafakhroji

app/modules/i18n/locales/en.po

@@ -19,7 +19,7 @@ msgstr "{0, plural, one {# attempt remaining.} other {# attempts remaining.}}"
 
 #. placeholder {0}: idp.name
 #. placeholder {0}: r.label
-#: app/routes/login/index.tsx:287
+#: app/routes/login/index.tsx:296
 #: app/routes/setup/mfa.tsx:183
 #: app/routes/signup/index.tsx:237
 msgid "{0}"
@@ -65,7 +65,7 @@ msgstr "Additional verification is required to continue."
 msgid "Already have an account?"
 msgstr "Already have an account?"
 
-#: app/routes/login/index.tsx:253
+#: app/routes/login/index.tsx:262
 msgid "An account with this email already exists — sign in to continue."
 msgstr "An account with this email already exists — sign in to continue."
 
@@ -157,7 +157,7 @@ msgstr "Choose how to sign in"
 msgid "Choose how you want to verify your identity."
 msgstr "Choose how you want to verify your identity."
 
-#: app/routes/login/index.tsx:249
+#: app/routes/login/index.tsx:258
 msgid "Choose your login method"
 msgstr "Choose your login method"
 
@@ -179,7 +179,7 @@ msgid "Connected accounts"
 msgstr "Connected accounts"
 
 #: app/routes/device/index.tsx:74
-#: app/routes/login/index.tsx:381
+#: app/routes/login/index.tsx:390
 #: app/routes/signup/index.tsx:305
 msgid "Continue"
 msgstr "Continue"
@@ -204,7 +204,7 @@ msgstr "Couldn't sign in"
 msgid "Create a new account"
 msgstr "Create a new account"
 
-#: app/routes/login/index.tsx:412
+#: app/routes/login/index.tsx:421
 #: app/routes/signup/password.tsx:191
 msgid "Create account"
 msgstr "Create account"
@@ -225,8 +225,8 @@ msgstr "Device code"
 msgid "Device denied"
 msgstr "Device denied"
 
-#: app/routes/login/index.tsx:206
-#: app/routes/login/index.tsx:347
+#: app/routes/login/index.tsx:215
+#: app/routes/login/index.tsx:356
 #: app/routes/signup/index.tsx:266
 #: app/routes/signup/index.tsx:291
 msgid "Email"
@@ -236,7 +236,7 @@ msgstr "Email"
 msgid "Email code"
 msgstr "Email code"
 
-#: app/routes/login/index.tsx:390
+#: app/routes/login/index.tsx:399
 #: app/routes/login/method.tsx:125
 #: app/routes/signup/method.tsx:265
 msgid "Email me a sign-in link"
@@ -258,7 +258,7 @@ msgstr "Email OTP"
 msgid "Email sign-in isn't available — use your username."
 msgstr "Email sign-in isn't available — use your username."
 
-#: app/routes/login/index.tsx:205
+#: app/routes/login/index.tsx:214
 msgid "Email, phone, or username"
 msgstr "Email, phone, or username"
 
@@ -324,9 +324,9 @@ msgid "Incorrect credentials. Please try again."
 msgstr "Incorrect credentials. Please try again."
 
 #: app/components/auth-form/last-used-badge.tsx:14
-#: app/routes/login/index.tsx:293
-#: app/routes/login/index.tsx:319
-#: app/routes/login/index.tsx:353
+#: app/routes/login/index.tsx:302
+#: app/routes/login/index.tsx:328
+#: app/routes/login/index.tsx:362
 msgid "Last used"
 msgstr "Last used"
 
@@ -367,7 +367,7 @@ msgstr "No sign-in method is available for this account."
 msgid "No signed-in accounts."
 msgstr "No signed-in accounts."
 
-#: app/routes/login/index.tsx:410
+#: app/routes/login/index.tsx:419
 msgid "Not registered?"
 msgstr "Not registered?"
 
@@ -379,7 +379,7 @@ msgstr "Not you?"
 msgid "Open your authenticator app and enter the 6-digit code."
 msgstr "Open your authenticator app and enter the 6-digit code."
 
-#: app/routes/login/index.tsx:329
+#: app/routes/login/index.tsx:338
 #: app/routes/signup/index.tsx:248
 msgid "or"
 msgstr "or"
@@ -388,7 +388,7 @@ msgstr "or"
 msgid "Or import this URI in your authenticator app"
 msgstr "Or import this URI in your authenticator app"
 
-#: app/routes/login/index.tsx:313
+#: app/routes/login/index.tsx:322
 #: app/routes/login/method.tsx:110
 #: app/routes/setup/mfa.tsx:45
 msgid "Passkey"
@@ -424,7 +424,7 @@ msgstr "Password must contain an uppercase letter."
 msgid "Password sign-in isn't available for this account."
 msgstr "Password sign-in isn't available for this account."
 
-#: app/routes/login/index.tsx:208
+#: app/routes/login/index.tsx:217
 msgid "Phone"
 msgstr "Phone"
 
@@ -557,7 +557,7 @@ msgstr "Sign in with LDAP"
 msgid "Sign out"
 msgstr "Sign out"
 
-#: app/routes/login/index.tsx:400
+#: app/routes/login/index.tsx:409
 msgid "Sign-in is currently unavailable for this account. Please contact your administrator."
 msgstr "Sign-in is currently unavailable for this account. Please contact your administrator."
 
@@ -675,7 +675,7 @@ msgstr "Use your passkey to verify your identity."
 msgid "Use your security key to verify your identity."
 msgstr "Use your security key to verify your identity."
 
-#: app/routes/login/index.tsx:209
+#: app/routes/login/index.tsx:218
 #: app/routes/sso/ldap.tsx:75
 msgid "Username"
 msgstr "Username"
@@ -749,7 +749,7 @@ msgstr "We've sent a password reset link to <0>{0}</0>"
 msgid "We've sent a verification link to <0>{0}</0>"
 msgstr "We've sent a verification link to <0>{0}</0>"
 
-#: app/routes/login/index.tsx:246
+#: app/routes/login/index.tsx:255
 msgid "Welcome"
 msgstr "Welcome"
 

app/resources/sso/__tests__/fingerprint.service.test.ts

@@ -0,0 +1,87 @@
+// End-to-end thread test: the fingerprintId minted/ensured in processIdpCallback must
+// (a) ride out on the finalizing redirect's Set-Cookie when the browser lacked the
+//     cookie (closing the first-session gap), and
+// (b) be the SAME id handed to createSession's userAgent — so the very first session
+//     in cloud-portal Active Sessions carries a non-null fingerprintID.
+// When the cookie is already present it is reused: no new fingerprintId Set-Cookie and
+// the session's userAgent carries the EXISTING id.
+//
+// @vitest-environment node
+// node env: happy-dom forbids setting the Cookie request header.
+import { FakeAuthProvider } from '@/modules/auth/providers/fake/fake-provider';
+import type { IdpIntentResult } from '@/modules/auth/types';
+import { processIdpCallback, outcomeToResponse } from '@/resources/sso';
+import { describe, it, expect } from 'vitest';
+
+const REGISTER_INTENT_VERIFIED: IdpIntentResult = {
+  userId: null,
+  information: { idpId: 'idp-g', idpUserId: 'g-1', idpUserName: 'you@gmail.com' },
+  draft: { email: 'you@gmail.com', firstName: 'You', lastName: 'User', emailVerified: true },
+};
+
+/** All set-cookie header values as a proper array (undici exposes getSetCookie). */
+function setCookies(res: Response): string[] {
+  return res.headers.getSetCookie();
+}
+
+/** The fingerprintId cookie's value, or null if no fingerprintId Set-Cookie was emitted. */
+function fingerprintCookieValue(res: Response): string | null {
+  for (const c of setCookies(res)) {
+    const first = c.split(';')[0];
+    if (first.startsWith('fingerprintId=')) {
+      return decodeURIComponent(first.slice('fingerprintId='.length));
+    }
+  }
+  return null;
+}
+
+async function runAutoCreate(cookieHeader?: string): Promise<{
+  res: Response;
+  provider: FakeAuthProvider;
+}> {
+  const provider = new FakeAuthProvider({});
+  const headers: Record<string, string> = {};
+  if (cookieHeader) headers['cookie'] = cookieHeader;
+  const request = new Request(
+    'https://auth.localtest.me/sso/google/callback?id=intent-1&token=tok-1',
+    { headers }
+  );
+  const outcome = await processIdpCallback(provider, request, 'google', {
+    retrieveIdpIntent: async () => REGISTER_INTENT_VERIFIED,
+    onAuthEvent: () => {},
+  });
+  return { res: outcomeToResponse(outcome) as Response, provider };
+}
+
+describe('fingerprintId end-to-end through the SSO auto-create createSession', () => {
+  it('cookie ABSENT: mints + Set-Cookie, and the SAME id reaches createSession userAgent', async () => {
+    const { res, provider } = await runAutoCreate();
+
+    // The finalizing redirect carries a fingerprintId Set-Cookie...
+    const minted = fingerprintCookieValue(res);
+    expect(minted).toBeTruthy();
+    expect(minted).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/);
+
+    // ...with the OLD-app attributes preserved.
+    const fpCookie = setCookies(res).find((c) => c.startsWith('fingerprintId='))!;
+    expect(fpCookie).toContain('Max-Age=31536000');
+    expect(fpCookie).toContain('Path=/');
+    expect(fpCookie).toContain('HttpOnly');
+
+    // ...and the created session's userAgent carries that EXACT id (no first-session gap).
+    expect(provider.lastCreateSessionOpts?.userAgent?.fingerprintId).toBe(minted);
+
+    // The session cookie is still set alongside it (multiple Set-Cookie headers).
+    expect(setCookies(res).some((c) => c.startsWith('sessions='))).toBe(true);
+  });
+
+  it('cookie PRESENT: reused — no new fingerprintId Set-Cookie, session carries the existing id', async () => {
+    const { res, provider } = await runAutoCreate('fingerprintId=existing-fp-xyz');
+
+    // No fresh fingerprintId Set-Cookie is emitted on reuse.
+    expect(fingerprintCookieValue(res)).toBeNull();
+
+    // The created session's userAgent carries the EXISTING cookie value.
+    expect(provider.lastCreateSessionOpts?.userAgent?.fingerprintId).toBe('existing-fp-xyz');
+  });
+});

app/resources/sso/sso-callback.ts

@@ -19,7 +19,7 @@ import { decideIdpCallback } from '@/resources/sso/idp-callback';
 import { signInWithIdpIntent, requestScopedProviderReads } from '@/resources/sso/idp-session';
 import type { SsoOutcome } from '@/resources/sso/sso-outcome';
 import { logAuthEvent } from '@/server/observability';
-import { userAgentFromRequest } from '@/server/user-agent';
+import { getOrCreateFingerprintId, userAgentFromRequest } from '@/server/user-agent';
 import { providerErrorCode } from '@/utils/errors/auth-error';
 import { z } from 'zod';
 
@@ -71,6 +71,11 @@ export async function processIdpCallback(
 
   const { id, token, link, requestId, organization } = parsed.data;
 
+  // Ensure the fingerprintId cookie exists for this browser. The SAME minted id feeds
+  // every createSession userAgent below (no first-session gap); fingerprintCookie is
+  // null on reuse and rides out on the redirect that finalizes the sign-in.
+  const [fingerprintId, fingerprintCookie] = getOrCreateFingerprintId(request);
+
   // Wrap the intent-fetch + session-resolution + decision block so a transient
   // ProviderError redirects to the branded error page and emits a failure audit event instead
   // of producing a raw 500. Unknown errors (non-ProviderError) re-throw so the root
@@ -158,7 +163,7 @@ export async function processIdpCallback(
           requestId,
           organization,
           fallbackLoginName: intent.information.idpUserName,
-          userAgent: userAgentFromRequest(request),
+          userAgent: userAgentFromRequest(request, fingerprintId),
         }));
       } catch (err) {
         const reason = err instanceof Error ? err.message : 'unknown';
@@ -176,7 +181,13 @@ export async function processIdpCallback(
         requestId,
       });
       const lastUsedCookie = await serializeLastUsedLogin(`idp:${intent.information.idpId}`);
-      return { kind: 'redirect', location: target, setCookie, lastUsedCookie };
+      return {
+        kind: 'redirect',
+        location: target,
+        setCookie,
+        lastUsedCookie,
+        fingerprintCookie: fingerprintCookie ?? undefined,
+      };
     }
 
     case 'link':
@@ -204,7 +215,7 @@ export async function processIdpCallback(
             requestId,
             orgId: organization,
             userId: decision.userId,
-            userAgent: userAgentFromRequest(request),
+            userAgent: userAgentFromRequest(request, fingerprintId),
           }
         );
         // Elide the post-create getUser(decision.userId) lookup — the cookie's
@@ -236,6 +247,7 @@ export async function processIdpCallback(
           location: target,
           setCookie: await serializeSessions(next),
           lastUsedCookie,
+          fingerprintCookie: fingerprintCookie ?? undefined,
         };
       } catch (err) {
         if (err instanceof ProviderError) {
@@ -287,14 +299,15 @@ export async function processIdpCallback(
           idpIntentId: id,
           idpIntentToken: token,
           emailVerified: intent.draft?.emailVerified ?? false,
-          userAgent: userAgentFromRequest(request),
+          userAgent: userAgentFromRequest(request, fingerprintId),
         });
         const lastUsedCookie = await serializeLastUsedLogin(`idp:${decision.link.idpId}`);
         return {
           kind: 'redirect',
           location: result.target,
           setCookie: await serializeSessions(result.sessions),
           lastUsedCookie,
+          fingerprintCookie: fingerprintCookie ?? undefined,
         };
       } catch (err) {
         if (err instanceof ProviderError) {

app/resources/sso/sso-outcome.ts

@@ -12,7 +12,14 @@ import { data, redirect } from 'react-router';
 // (used for plain 400 Bad Request and 502 data responses).
 
 export type SsoOutcome =
-  | { kind: 'redirect'; location: string; setCookie?: string; lastUsedCookie?: string }
+  | {
+      kind: 'redirect';
+      location: string;
+      setCookie?: string;
+      lastUsedCookie?: string;
+      // fingerprintId Set-Cookie minted for a browser that lacked it (null/absent on reuse).
+      fingerprintCookie?: string;
+    }
   | { kind: 'data'; payload: unknown; status?: number; headers?: Record<string, string> }
   | { kind: 'response'; response: Response };
 
@@ -24,10 +31,11 @@ export type SsoOutcome =
 export function outcomeToResponse(outcome: SsoOutcome): Response | ReturnType<typeof data> {
   switch (outcome.kind) {
     case 'redirect':
-      if (outcome.setCookie || outcome.lastUsedCookie) {
+      if (outcome.setCookie || outcome.lastUsedCookie || outcome.fingerprintCookie) {
         const h = new Headers();
         if (outcome.setCookie) h.append('set-cookie', outcome.setCookie);
         if (outcome.lastUsedCookie) h.append('set-cookie', outcome.lastUsedCookie);
+        if (outcome.fingerprintCookie) h.append('set-cookie', outcome.fingerprintCookie);
         return redirect(outcome.location, { headers: h });
       }
       return redirect(outcome.location);