feat(be): register the browser a session was created from

Sessions are per account, so a user who wants to sign one browser out has
nothing to name it by. Anchors gain a device registry: `{id, name, created_at}`
per browser, capped at 20 because the anchor blob is read on nearly every
authenticated path, with a monotonic per-anchor allocator so ids are never
reused.

There is no registration method. The client passes the name it would have
registered with plus whatever id it has cached, and the canister resolves the
rest, so an id the client does not own resolves to a fresh registration rather
than to somebody else's device. At the cap the oldest record is dropped rather
than the registration failing, which costs that browser its name in the session
list and never costs anyone a sign-in.

Devices live on the anchor, so they ride on `identity_info` alongside
`mcp_config` rather than needing a call of their own.

Implements docs/ongoing/revocable-app-sessions.md §9.1, §9.2 (S18, S19, S22).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: sea-snake

src/frontend/src/lib/generated/internet_identity_idl.js

@@ -559,6 +559,11 @@ export const idlFactory = ({ IDL }) => {
     'address' : IDL.Text,
     'last_used' : IDL.Opt(Timestamp),
   });
+  const SessionDeviceInfo = IDL.Record({
+    'id' : IDL.Nat32,
+    'name' : IDL.Text,
+    'created_at' : Timestamp,
+  });
   const McpConfig = IDL.Record({
     'url' : IDL.Opt(IDL.Text),
     'enabled' : IDL.Bool,
@@ -575,6 +580,7 @@ export const idlFactory = ({ IDL }) => {
     'name' : IDL.Opt(IDL.Text),
     'email_recovery' : IDL.Opt(IDL.Vec(EmailRecoveryCredential)),
     'created_at' : IDL.Opt(Timestamp),
+    'session_devices' : IDL.Opt(IDL.Vec(SessionDeviceInfo)),
     'mcp_config' : IDL.Opt(McpConfig),
     'authn_method_registration' : IDL.Opt(AuthnMethodRegistrationInfo),
     'openid_credentials' : IDL.Opt(IDL.Vec(OpenIdCredential)),

src/frontend/src/lib/generated/internet_identity_types.d.ts

@@ -942,6 +942,12 @@ export interface IdentityInfo {
    * The timestamp at which the anchor was created
    */
   'created_at' : [] | [Timestamp],
+  /**
+   * Browsers this anchor has signed in from (absent when it has never
+   * created a session), so the Settings UI can offer "sign this browser
+   * out" without a separate call.
+   */
+  'session_devices' : [] | [Array<SessionDeviceInfo>],
   /**
    * The anchor's synced trusted-MCP-server config (absent when the
    * anchor never wrote one). Carried here rather than read from the
@@ -1528,6 +1534,16 @@ export type Salt = Uint8Array | number[];
 export type SessionDelegationError = { 'NoSuchDelegation' : null } |
   { 'InternalCanisterError' : string } |
   { 'Unauthorized' : Principal };
+/**
+ * A browser an anchor has signed in from. The name is self-reported by the
+ * client, so it is a label for the user rather than evidence about where a
+ * session came from.
+ */
+export interface SessionDeviceInfo {
+  'id' : number,
+  'name' : string,
+  'created_at' : Timestamp,
+}
 export type SessionKey = PublicKey;
 export type SetDefaultAccountError = {
     'NoSuchOrigin' : { 'anchor_number' : UserNumber }

src/frontend/src/routes/(new-styling)/manage/(authenticated)/(home)/smartActions.test.ts

@@ -40,6 +40,7 @@ const baseIdentityInfo: IdentityInfo = {
   created_at: [],
   authn_method_registration: [],
   openid_credentials: [],
+  session_devices: [],
   mcp_config: [],
 };
 

src/internet_identity/internet_identity.did

@@ -1006,6 +1006,15 @@ type IdentityAuthnInfo = record {
     recovery_authn_methods : vec AuthnMethod;
 };
 
+// A browser an anchor has signed in from. The name is self-reported by the
+// client, so it is a label for the user rather than evidence about where a
+// session came from.
+type SessionDeviceInfo = record {
+    id : nat32;
+    name : text;
+    created_at : Timestamp;
+};
+
 type IdentityInfo = record {
     authn_methods : vec AuthnMethodData;
     authn_method_registration : opt AuthnMethodRegistrationInfo;
@@ -1026,6 +1035,10 @@ type IdentityInfo = record {
     // shows a "limit reached" notice in the wizard when adding
     // beyond the cap.
     verified_emails : opt vec VerifiedEmail;
+    // Browsers this anchor has signed in from (absent when it has never
+    // created a session), so the Settings UI can offer "sign this browser
+    // out" without a separate call.
+    session_devices : opt vec SessionDeviceInfo;
     // The anchor's synced trusted-MCP-server config (absent when the
     // anchor never wrote one). Carried here rather than read from the
     // mcp_get_config query so the Settings UI has a certified value to

src/internet_identity/src/email_recovery/remove.rs

@@ -75,6 +75,8 @@ mod tests {
 
     fn anchor_with(address: Option<&str>) -> Anchor {
         let mut a = Anchor {
+            session_devices: vec![],
+            next_session_device_id: 0,
             anchor_number: 1,
             devices: vec![],
             openid_credentials: vec![],

src/internet_identity/src/main.rs

@@ -1168,6 +1168,21 @@ mod v2_api {
             Some(stored_verified_emails)
         };
 
+        let stored_session_devices: Vec<SessionDeviceInfo> = state::anchor(identity_number)
+            .session_devices()
+            .iter()
+            .map(|device| SessionDeviceInfo {
+                id: device.id,
+                name: device.name.clone(),
+                created_at: device.created_at,
+            })
+            .collect();
+        let session_devices = if stored_session_devices.is_empty() {
+            None
+        } else {
+            Some(stored_session_devices)
+        };
+
         let identity_info = IdentityInfo {
             authn_methods: anchor_info
                 .devices
@@ -1183,6 +1198,7 @@ mod v2_api {
             created_at: anchor_info.created_at,
             email_recovery,
             verified_emails,
+            session_devices,
             // The same config `mcp_get_config` serves, but certified: this is
             // an update call, so the Settings UI can render the trusted server
             // — and base the config it writes back — on a value no single node

src/internet_identity/src/storage.rs

@@ -897,6 +897,8 @@ impl<M: Memory + Clone> Storage<M> {
             created_at_ns: _,
             name: _,
             verified_emails: _,
+            session_devices: _,
+            next_session_device_id: _,
         }) = previous_anchor_maybe
         {
             (

src/internet_identity/src/storage/anchor.rs

@@ -6,6 +6,7 @@ use crate::storage::storable::email_recovery_credential::StorableEmailRecoveryCr
 use crate::storage::storable::fixed_anchor::StorableFixedAnchor;
 use crate::storage::storable::passkey_credential::StorablePasskeyCredential;
 use crate::storage::storable::recovery_key::StorableRecoveryKey;
+use crate::storage::storable::session_device::StorableSessionDevice;
 use crate::storage::storable::special_device_migration::SpecialDeviceMigration;
 use crate::storage::storable::verified_email::StorableVerifiedEmail;
 use crate::{IC0_APP_ORIGIN, ID_AI_ORIGIN, INTERNETCOMPUTER_ORG_ORIGIN};
@@ -38,11 +39,47 @@ pub struct Anchor {
     pub(crate) email_recovery: Vec<EmailRecoveryCredential>,
     /// Capped by `MAX_VERIFIED_EMAILS_PER_ANCHOR`.
     pub(crate) verified_emails: Vec<VerifiedEmail>,
+    /// Capped by `MAX_SESSION_DEVICES`.
+    pub(crate) session_devices: Vec<SessionDevice>,
+    pub(crate) next_session_device_id: SessionDeviceId,
     pub(crate) metadata: Option<HashMap<String, MetadataEntry>>,
     pub(crate) name: Option<String>,
     pub(crate) created_at: Option<Timestamp>,
 }
 
+/// Bounds the device list, because the anchor blob is read on nearly every
+/// authenticated path.
+pub const MAX_SESSION_DEVICES: usize = 20;
+
+/// A browser this anchor has signed in from. The name is self-reported by the client,
+/// so it is a label for the user rather than evidence about where a session came from.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct SessionDevice {
+    pub id: SessionDeviceId,
+    pub name: String,
+    pub created_at: Timestamp,
+}
+
+impl From<StorableSessionDevice> for SessionDevice {
+    fn from(value: StorableSessionDevice) -> Self {
+        SessionDevice {
+            id: value.id,
+            name: value.name,
+            created_at: value.created_at,
+        }
+    }
+}
+
+impl From<SessionDevice> for StorableSessionDevice {
+    fn from(value: SessionDevice) -> Self {
+        StorableSessionDevice {
+            id: value.id,
+            name: value.name,
+            created_at: value.created_at,
+        }
+    }
+}
+
 impl Device {
     /// Applies the values of `device_data` to self while leaving the other fields intact.
     pub fn apply_device_data(&mut self, device_data: DeviceData) {
@@ -175,6 +212,8 @@ impl From<Anchor> for (StorableFixedAnchor, StorableAnchor) {
             openid_credentials,
             email_recovery,
             verified_emails,
+            session_devices,
+            next_session_device_id,
             metadata,
             name,
             created_at,
@@ -194,6 +233,13 @@ impl From<Anchor> for (StorableFixedAnchor, StorableAnchor) {
                 .map(StorableVerifiedEmail::from)
                 .collect(),
         );
+        let next_session_device_id = Some(next_session_device_id);
+        let session_devices = Some(
+            session_devices
+                .into_iter()
+                .map(StorableSessionDevice::from)
+                .collect(),
+        );
 
         let (mut passkey_credentials, mut recovery_keys, mut recovery_devices) =
             (vec![], vec![], vec![]);
@@ -433,6 +479,8 @@ impl From<Anchor> for (StorableFixedAnchor, StorableAnchor) {
                 recovery_keys,
                 email_recovery,
                 verified_emails,
+                session_devices,
+                next_session_device_id,
             },
         )
     }
@@ -448,6 +496,8 @@ impl From<(AnchorNumber, StorableAnchor)> for Anchor {
             recovery_keys,
             email_recovery,
             verified_emails,
+            session_devices,
+            next_session_device_id,
         } = storable_anchor;
 
         let name = name.clone();
@@ -466,6 +516,12 @@ impl From<(AnchorNumber, StorableAnchor)> for Anchor {
             .into_iter()
             .map(VerifiedEmail::from)
             .collect();
+        let session_devices = session_devices
+            .unwrap_or_default()
+            .into_iter()
+            .map(SessionDevice::from)
+            .collect();
+        let next_session_device_id = next_session_device_id.unwrap_or_default();
 
         let mut devices = passkey_credentials
             .unwrap_or_default()
@@ -560,6 +616,8 @@ impl From<(AnchorNumber, StorableAnchor)> for Anchor {
             openid_credentials,
             email_recovery,
             verified_emails,
+            session_devices,
+            next_session_device_id,
             devices,
             metadata,
         }
@@ -586,6 +644,8 @@ impl From<(AnchorNumber, StorableFixedAnchor, Option<StorableAnchor>)> for Ancho
                 openid_credentials: vec![],
                 email_recovery: vec![],
                 verified_emails: vec![],
+                session_devices: vec![],
+                next_session_device_id: 0,
                 anchor_number,
                 devices,
                 metadata,
@@ -612,13 +672,21 @@ impl From<(AnchorNumber, StorableFixedAnchor, Option<StorableAnchor>)> for Ancho
             .into_iter()
             .map(VerifiedEmail::from)
             .collect();
+        let session_devices = storable_anchor
+            .session_devices
+            .unwrap_or_default()
+            .into_iter()
+            .map(SessionDevice::from)
+            .collect();
 
         Anchor {
             anchor_number,
             devices,
             openid_credentials,
             email_recovery,
             verified_emails,
+            session_devices,
+            next_session_device_id: storable_anchor.next_session_device_id.unwrap_or_default(),
             metadata,
             name,
             created_at,
@@ -627,6 +695,61 @@ impl From<(AnchorNumber, StorableFixedAnchor, Option<StorableAnchor>)> for Ancho
 }
 
 impl Anchor {
+    pub fn session_devices(&self) -> &[SessionDevice] {
+        &self.session_devices
+    }
+
+    /// Resolves the browser a sign-in came from, registering it when the client has no
+    /// id yet or presents one this anchor does not know.
+    ///
+    /// The client never chooses the id: an id it does not own resolves to a fresh
+    /// registration rather than to somebody else's device. At the cap the oldest records
+    /// are dropped rather than the registration failing, which never costs anyone a
+    /// sign-in. Their ids are returned so the caller can end their sessions too: a
+    /// session whose device is no longer listed could not be signed out from settings.
+    pub fn resolve_session_device(
+        &mut self,
+        device_id: Option<SessionDeviceId>,
+        name: String,
+        now: Timestamp,
+    ) -> (SessionDeviceId, Vec<SessionDeviceId>) {
+        if let Some(device_id) = device_id {
+            if self
+                .session_devices
+                .iter()
+                .any(|device| device.id == device_id)
+            {
+                return (device_id, vec![]);
+            }
+        }
+
+        let id = self.next_session_device_id;
+        self.next_session_device_id = self.next_session_device_id.saturating_add(1);
+        self.session_devices.push(SessionDevice {
+            id,
+            name,
+            created_at: now,
+        });
+
+        let mut dropped = vec![];
+        while self.session_devices.len() > MAX_SESSION_DEVICES {
+            let oldest = self
+                .session_devices
+                .iter()
+                .enumerate()
+                .min_by_key(|(_, device)| (device.created_at, device.id))
+                .map(|(index, _)| index);
+            match oldest {
+                Some(index) => {
+                    dropped.push(self.session_devices.remove(index).id);
+                }
+                None => break,
+            }
+        }
+
+        (id, dropped)
+    }
+
     /// Creation of new anchors is restricted in order to make sure that the device checks are
     /// not accidentally bypassed.
     pub fn new(anchor_number: AnchorNumber, created_at: Timestamp) -> Anchor {
@@ -637,6 +760,8 @@ impl Anchor {
             openid_credentials: vec![],
             email_recovery: vec![],
             verified_emails: vec![],
+            session_devices: vec![],
+            next_session_device_id: 0,
             metadata: None,
             name: None,
         }