replace Inrupt by Uvdsl OIDC client

[bourgeoa]

Commit Notes - solid-logic (uvdsl migration)

Scope

Replace browser OIDC client usage from Inrupt to @uvdsl/solid-oidc-client-browser while keeping compatibility during transition.

Current migration status

Fully migrated

• No direct source import of @inrupt/solid-client-authn-browser remains in src.
• Runtime dependency switched to @uvdsl/solid-oidc-client-browser in package.json.
• Auth session construction now uses the uvdsl Session implementation.

Compatibility retained intentionally

• src/authn/SolidAuthnLogic.ts
  • Reads either session.info.webId/isLoggedIn or session.webId/isActive.
  • Supports both redirect flows:
    • handleIncomingRedirect({ restorePreviousSession, url })
    • restore() + handleRedirectFromLogin()
  • Treats No session to restore as a normal first-load condition instead of surfacing an uncaught rejection.
• src/logic/solidLogicSingleton.ts
  • Fetch bridge prefers session.fetch if present, otherwise session.authFetch.
  • Reads session.info.webId fallback to session.webId.
• src/authSession/authSession.ts
  • Provides a minimal authSession.events.on/off/emit shim for older consumers.
  • Registers sessionStateChange only when the session instance exposes addEventListener.

These are migration-compatibility paths for downstream packages, not leftover Inrupt dependencies.

Validation notes

• Browser login succeeded in integrated Pivot usage.
• First-load restore no longer needs to fail noisily when no cached session exists.

Recommendation after integrated test passes

Create a follow-up hardening commit that removes compatibility branches and keeps only native uvdsl contract:

• session state: webId + isActive
• login redirect flow: restore() + handleRedirectFromLogin()
• authenticated fetch: one stable session-bound fetch path
• events: sessionStateChange EventTarget flow

Suggested commit message (current migration)

Title

feat(auth): migrate solid-logic OIDC client to @uvdsl/solid-oidc-client-browser

Body

• Replace Inrupt browser auth client dependency with uvdsl client
• Update auth session creation and session typing to the uvdsl client
• Preserve downstream behavior with legacy session event and state compatibility
• Support both redirect handling paths during transition
• Ignore the expected no-session restore case on first load
• Keep compatibility branches temporarily pending full integrated validation

Suggested follow-up commit message (cleanup only, later)

Title

refactor(auth): drop legacy session compatibility paths after uvdsl validation

Body

• Remove legacy session.info/isLoggedIn branches
• Remove handleIncomingRedirect compatibility branch
• Remove EventEmitter-style auth session hooks
• Standardize on uvdsl webId, isActive, and sessionStateChange

[Copilot]

Pull request overview

This PR migrates SolidOS solid-logic browser authentication from the Inrupt OIDC client to @uvdsl/solid-oidc-client-browser, while keeping temporary compatibility paths for downstream consumers during the transition.

Changes:

• Replace the runtime dependency and session construction to use @uvdsl/solid-oidc-client-browser instead of Inrupt.
• Add a legacy authSession.events shim and broaden session-state handling (info.webId/isLoggedIn vs webId/isActive) plus dual redirect flows.
• Update Jest setup to mock the new OIDC client module for tests.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
test/solidAuthLogic.test.ts	Adds an authSession mock to keep SolidAuthnLogic tests working with the new session shape.
test/mocks/solid-oidc-client-browser.ts	Provides a Jest-mapped mock implementation of the uvdsl Session API.
src/types.ts	Updates exported AuthnLogic typing to use the new session type alias.
src/logic/solidLogicSingleton.ts	Adds compatibility logic for authenticated fetch (fetch vs authFetch) and webId detection.
src/logic/solidLogic.ts	Updates createSolidLogic signature to accept the new session type.
src/authSession/authSession.ts	Switches to uvdsl Session and adds a minimal legacy events shim + logout bridging.
src/authn/SolidAuthnLogic.ts	Updates session handling to support both legacy and new contracts and redirect flows.
package.json	Swaps dependency from Inrupt authn browser package to uvdsl client.
package-lock.json	Locks updated dependency graph after migration.
jest.config.mjs	Maps @uvdsl/solid-oidc-client-browser to a local mock for tests.

Comments suppressed due to low confidence (1)

src/authn/SolidAuthnLogic.ts:90

• The new restore/redirect compatibility path adds non-trivial behavior (swallowing only the expected "no session to restore" error, rethrowing others, and emitting legacy sessionRestore/login events based on session activation), but the existing tests only assert that checkUser() returns null. Add unit tests that cover: (1) restore() throwing the expected no-session error is ignored, (2) other errors are propagated, and (3) the legacy events are emitted when isActive transitions from false to true.

      if (typeof sessionAny?.restore === 'function') {
        const wasActive = sessionAny?.isActive ?? Boolean(sessionAny?.webId)
        try {
          await sessionAny.restore()
        } catch (error) {
          const message = error instanceof Error ? error.message : String(error)
          if (!/no session to restore/i.test(message)) {
            throw error
          }
          debug.log('No previous session to restore')
        }
        const isNowActive = sessionAny?.isActive ?? Boolean(sessionAny?.webId)
        if (!wasActive && isNowActive) {
          sessionAny.events?.emit('sessionRestore', window.location.href)
        }
      }
      if (typeof sessionAny?.handleRedirectFromLogin === 'function') {
        const wasActive = sessionAny?.isActive ?? Boolean(sessionAny?.webId)
        await sessionAny.handleRedirectFromLogin()
        const isNowActive = sessionAny?.isActive ?? Boolean(sessionAny?.webId)
        if (!wasActive && isNowActive) {
          sessionAny.events?.emit('login')
        }
      }
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[timea-solid]

What was your experience so far with the new authentication lib, is there any visible chnage to the user?

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

[timea-solid]

@bourgeoa check the copilot review feedback, see if it is valid to harden the code.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 17 changed files in this pull request and generated 3 comments.

[NoelDeMartin]

Following up from my comments in this week's meeting, looking at the current PR it seems like src/authn/SolidAuthnLogic.ts is attempting to handle both Inrupt and Uvdsl libraries? If so, that's is good, here's a couple of comments:

• I see that the Inrupt library was removed from the dependencies, but it's still used in some places using the "sessionAny". I'd strongly suggest to keep the dependency installed, and cast the variable to its actual type, rather than using any. Any should be avoided as much as possible.
• The current implementation seems to rely on if/else logic inside of the same file. That is ok for now, specially if we can keep the external API for consumers the same. But ideally, we would have two different implementations of an interface, one for Inrupt and one for Uvdsl, and resolve the proper instance to use at runtime. This would also allow to add more adapters in the future. Even if that's not a goal right, it's also good for code organization. As Aad mentioned in the call, this is called the Adapter pattern. Though if that confuses you more than it helps, just take a look at how I've done it for my apps (each authentication library has its own class).
• Another additional improvement is to make sure to lazy-load the authentication libraries. Basically, if someone is logging in with uvdsl, they don't need to download all the javascript of Inrupt's library. I also do that in my apps, in particular using dynamic imports (see the .lazy files).
• I haven't looked at all the code in the PR, but it's not immediately clear to me how consumers of this library choose which authentication library to use. Ideally, we could have a login() function that takes an "authenticationLibrary" parameter (or "authenticator", as I call them in my code, etc.). That could default to uvdsl, but should be easy to replace with Inrupt.