feat(be): OpenIdCredentialKey with data migration — add aud for SSO security

[timothyaterton]

Summary

Add the aud (audience / client_id) field to OpenIdCredentialKey, changing it from (iss, sub) to (iss, sub, aud). This is a security prerequisite for SSO: since SSO allows anyone to provide a client_id via their ii-openid-configuration endpoint, without aud in the key two different OIDC clients at the same provider with the same user sub would collide, enabling impersonation.

Changes

• Type update: OpenIdCredentialKey type alias changed from (Iss, Sub) to (Iss, Sub, Aud) in both internet_identity_interface and the openid module
• CBOR encoding: StorableOpenIdCredentialKey rewritten with manual Encode/Decode impls — new entries use CBOR map format {0:iss, 1:sub, 2:aud}; the decoder also handles legacy CBOR array format [iss, sub] for backward compatibility
• Migration: post_upgrade drains the credential key index via pop_first, resolves aud from each anchor's StorableOpenIdCredential (which already stores aud at CBOR index #[n(2)]), and re-inserts with the complete (iss, sub, aud) key. Unresolvable entries are preserved with empty aud for retry on next upgrade.
• Key construction: Updated OpenIdCredential::key(), StorableOpenIdCredential::key(), calculate_delegation_seed(), and all call sites
• Candid interface: Updated .did file and generated JS/TS declarations
• Frontend: Updated credential removal call to pass aud
• Tests: Added unit tests for new CBOR map encoding, legacy array decoding, and round-trip serialization. Updated existing test assertions to use 3-tuple keys.

Delegation seed backward compatibility

The calculate_delegation_seed function already receives client_id (which equals aud) as a separate parameter. The seed calculation is unchanged — aud from the key tuple is ignored (_aud) in the destructuring, preserving identical Principal derivation for existing credentials.

Migration safety

• Uses pop_first() to drain the BTreeMap, avoiding byte-level encoding mismatches between legacy array-encoded keys and new map-encoded keys
• Resolves aud from the anchor's stored StorableOpenIdCredential which already has aud at CBOR index 2
• Falls back to re-inserting with empty aud if resolution fails, with a logged warning — the entry is preserved for retry on next upgrade
• Idempotent: safe to run on every upgrade; entries already in the new format are preserved unchanged

Test plan

• All 209 unit tests pass (including Candid interface compatibility)
• Integration tests (require canister WASM build — pass in CI)
• Deploy to testnet and verify migration of existing credentials
• Verify credential lookup works after migration
• Verify new credential registration includes aud in key

---

< Previous PR | Next PR >

[Copilot]

Pull request overview

This PR strengthens OpenID credential indexing by including aud (client_id) in OpenIdCredentialKey, preventing key collisions across multiple OIDC clients at the same issuer—an important prerequisite for safely enabling SSO/discoverable client configurations.

Changes:

• Expand OpenIdCredentialKey from (iss, sub) to (iss, sub, aud) across the backend, interface crate, Candid, tests, and frontend call sites.
• Update stable-storage encoding for StorableOpenIdCredentialKey (new CBOR map format) with legacy decoding support and add a post-upgrade migration to re-key existing index entries.
• Regenerate Candid JS/TS bindings and adjust frontend removal flow to pass aud.

Reviewed changes

Copilot reviewed 12 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/internet_identity_interface/src/internet_identity/types/openid.rs	Extends public interface type alias to include aud.
src/internet_identity/tests/integration/openid.rs	Updates integration test helper key construction to include aud.
src/internet_identity/src/storage/storable/openid_credential_key.rs	Implements new CBOR map encoding + legacy array decoding and adds unit tests.
src/internet_identity/src/storage/storable/openid_credential.rs	Updates stored credential key derivation to include aud.
src/internet_identity/src/storage.rs	Adds post_upgrade migration to re-key OpenID credential index entries with aud.
src/internet_identity/src/openid.rs	Updates core key type and key construction; keeps delegation seed behavior unchanged.
src/internet_identity/src/main.rs	Runs OpenID credential key migration during post_upgrade.
src/internet_identity/src/attributes.rs	Adjusts tests/maps keyed by OpenID credential key to use 3-tuple.
src/internet_identity/src/anchor_management.rs	Updates key destructuring to match 3-tuple.
src/internet_identity/internet_identity.did	Updates Candid OpenIdCredentialKey to include Aud.
src/frontend/src/routes/(new-styling)/manage/(authenticated)/(access-and-recovery)/access/utils.ts	Updates OpenID access-method key generation to include aud.
src/frontend/src/routes/(new-styling)/manage/(authenticated)/(access-and-recovery)/access/+page.svelte	Updates credential removal call to pass aud.
src/frontend/src/lib/generated/internet_identity_types.d.ts	Regenerates TS types to reflect 3-tuple key.
src/frontend/src/lib/generated/internet_identity_idl.js	Regenerates IDL to reflect 3-tuple key.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.