feat(be): register the browser a session was created from

Sessions are per account, so a user who wants to sign one browser out has
nothing to name it by. Anchors gain a device registry:
`{id, name, created_at, last_used}` per browser, capped at 20 because the anchor
blob is read on nearly every authenticated path, with a monotonic per-anchor
allocator so ids are never reused.

There is no registration method. The client passes the name it would have
registered with plus whatever id it has cached, and the canister resolves the
rest, so an id the client does not own resolves to a fresh registration rather
than to somebody else's device. At the cap the least recently used record is
dropped rather than the registration failing, which costs that browser its name
in the session list and never costs anyone a sign-in.

Eviction orders on `last_used`, not on `created_at`. Clearing browser storage
loses the cached id, so each wipe enrols a fresh record; ordering by enrolment
would spend the cap evicting the browsers a user actually signs in from while
the churn survives, and since eviction ends the dropped browser's sessions,
that signs them out on a device they never touched. Ordering on use makes each
wipe's throwaway records evict each other instead.

`last_used` is also what the settings list wants to read: "last used" is the
question someone deciding what to sign out is asking, and enrolment does not
answer it.

Devices live on the anchor, so they ride on `identity_info` alongside
`mcp_config` rather than needing a call of their own.

Implements docs/ongoing/revocable-app-sessions.md §9.1, §9.2 (S18, S19, S22).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: sea-snake

src/frontend/src/lib/generated/internet_identity_idl.js

@@ -559,6 +559,12 @@ export const idlFactory = ({ IDL }) => {
     'address' : IDL.Text,
     'last_used' : IDL.Opt(Timestamp),
   });
+  const SessionDeviceInfo = IDL.Record({
+    'id' : IDL.Nat32,
+    'name' : IDL.Text,
+    'created_at' : Timestamp,
+    'last_used' : Timestamp,
+  });
   const McpConfig = IDL.Record({
     'url' : IDL.Opt(IDL.Text),
     'enabled' : IDL.Bool,
@@ -575,6 +581,7 @@ export const idlFactory = ({ IDL }) => {
     'name' : IDL.Opt(IDL.Text),
     'email_recovery' : IDL.Opt(IDL.Vec(EmailRecoveryCredential)),
     'created_at' : IDL.Opt(Timestamp),
+    'session_devices' : IDL.Opt(IDL.Vec(SessionDeviceInfo)),
     'mcp_config' : IDL.Opt(McpConfig),
     'authn_method_registration' : IDL.Opt(AuthnMethodRegistrationInfo),
     'openid_credentials' : IDL.Opt(IDL.Vec(OpenIdCredential)),

src/frontend/src/lib/generated/internet_identity_types.d.ts

@@ -942,6 +942,12 @@ export interface IdentityInfo {
    * The timestamp at which the anchor was created
    */
   'created_at' : [] | [Timestamp],
+  /**
+   * Browsers this anchor has signed in from (absent when it has never
+   * created a session), so the Settings UI can offer "sign this browser
+   * out" without a separate call.
+   */
+  'session_devices' : [] | [Array<SessionDeviceInfo>],
   /**
    * The anchor's synced trusted-MCP-server config (absent when the
    * anchor never wrote one). Carried here rather than read from the
@@ -1528,6 +1534,21 @@ export type Salt = Uint8Array | number[];
 export type SessionDelegationError = { 'NoSuchDelegation' : null } |
   { 'InternalCanisterError' : string } |
   { 'Unauthorized' : Principal };
+/**
+ * A browser an anchor has signed in from. The name is self-reported by the
+ * client, so it is a label for the user rather than evidence about where a
+ * session came from.
+ */
+export interface SessionDeviceInfo {
+  'id' : number,
+  'name' : string,
+  'created_at' : Timestamp,
+  /**
+   * Advanced by a sign-in from this browser and by every session refresh it
+   * drives, so the Settings UI can show actual use rather than only enrolment.
+   */
+  'last_used' : Timestamp,
+}
 export type SessionKey = PublicKey;
 export type SetDefaultAccountError = {
     'NoSuchOrigin' : { 'anchor_number' : UserNumber }

src/frontend/src/routes/(new-styling)/manage/(authenticated)/(home)/smartActions.test.ts

@@ -40,6 +40,7 @@ const baseIdentityInfo: IdentityInfo = {
   created_at: [],
   authn_method_registration: [],
   openid_credentials: [],
+  session_devices: [],
   mcp_config: [],
 };
 

src/internet_identity/internet_identity.did

@@ -1006,6 +1006,18 @@ type IdentityAuthnInfo = record {
     recovery_authn_methods : vec AuthnMethod;
 };
 
+// A browser an anchor has signed in from. The name is self-reported by the
+// client, so it is a label for the user rather than evidence about where a
+// session came from.
+type SessionDeviceInfo = record {
+    id : nat32;
+    name : text;
+    created_at : Timestamp;
+    // Advanced by a sign-in from this browser and by every session refresh it
+    // drives, so the Settings UI can show actual use rather than only enrolment.
+    last_used : Timestamp;
+};
+
 type IdentityInfo = record {
     authn_methods : vec AuthnMethodData;
     authn_method_registration : opt AuthnMethodRegistrationInfo;
@@ -1026,6 +1038,10 @@ type IdentityInfo = record {
     // shows a "limit reached" notice in the wizard when adding
     // beyond the cap.
     verified_emails : opt vec VerifiedEmail;
+    // Browsers this anchor has signed in from (absent when it has never
+    // created a session), so the Settings UI can offer "sign this browser
+    // out" without a separate call.
+    session_devices : opt vec SessionDeviceInfo;
     // The anchor's synced trusted-MCP-server config (absent when the
     // anchor never wrote one). Carried here rather than read from the
     // mcp_get_config query so the Settings UI has a certified value to

src/internet_identity/src/email_recovery/remove.rs

@@ -75,6 +75,8 @@ mod tests {
 
     fn anchor_with(address: Option<&str>) -> Anchor {
         let mut a = Anchor {
+            session_devices: vec![],
+            next_session_device_id: 0,
             anchor_number: 1,
             devices: vec![],
             openid_credentials: vec![],

src/internet_identity/src/main.rs

@@ -1168,6 +1168,22 @@ mod v2_api {
             Some(stored_verified_emails)
         };
 
+        let stored_session_devices: Vec<SessionDeviceInfo> = state::anchor(identity_number)
+            .session_devices()
+            .iter()
+            .map(|device| SessionDeviceInfo {
+                id: device.id,
+                name: device.name.clone(),
+                created_at: device.created_at,
+                last_used: device.last_used,
+            })
+            .collect();
+        let session_devices = if stored_session_devices.is_empty() {
+            None
+        } else {
+            Some(stored_session_devices)
+        };
+
         let identity_info = IdentityInfo {
             authn_methods: anchor_info
                 .devices
@@ -1183,6 +1199,7 @@ mod v2_api {
             created_at: anchor_info.created_at,
             email_recovery,
             verified_emails,
+            session_devices,
             // The same config `mcp_get_config` serves, but certified: this is
             // an update call, so the Settings UI can render the trusted server
             // — and base the config it writes back — on a value no single node

src/internet_identity/src/storage.rs

@@ -897,6 +897,8 @@ impl<M: Memory + Clone> Storage<M> {
             created_at_ns: _,
             name: _,
             verified_emails: _,
+            session_devices: _,
+            next_session_device_id: _,
         }) = previous_anchor_maybe
         {
             (

src/internet_identity/src/storage/anchor.rs

@@ -6,6 +6,7 @@ use crate::storage::storable::email_recovery_credential::StorableEmailRecoveryCr
 use crate::storage::storable::fixed_anchor::StorableFixedAnchor;
 use crate::storage::storable::passkey_credential::StorablePasskeyCredential;
 use crate::storage::storable::recovery_key::StorableRecoveryKey;
+use crate::storage::storable::session_device::StorableSessionDevice;
 use crate::storage::storable::special_device_migration::SpecialDeviceMigration;
 use crate::storage::storable::verified_email::StorableVerifiedEmail;
 use crate::{IC0_APP_ORIGIN, ID_AI_ORIGIN, INTERNETCOMPUTER_ORG_ORIGIN};
@@ -38,11 +39,50 @@ pub struct Anchor {
     pub(crate) email_recovery: Vec<EmailRecoveryCredential>,
     /// Capped by `MAX_VERIFIED_EMAILS_PER_ANCHOR`.
     pub(crate) verified_emails: Vec<VerifiedEmail>,
+    /// Capped by `MAX_SESSION_DEVICES`.
+    pub(crate) session_devices: Vec<SessionDevice>,
+    pub(crate) next_session_device_id: SessionDeviceId,
     pub(crate) metadata: Option<HashMap<String, MetadataEntry>>,
     pub(crate) name: Option<String>,
     pub(crate) created_at: Option<Timestamp>,
 }
 
+/// Bounds the device list, because the anchor blob is read on nearly every
+/// authenticated path.
+pub const MAX_SESSION_DEVICES: usize = 20;
+
+/// A browser this anchor has signed in from. The name is self-reported by the client,
+/// so it is a label for the user rather than evidence about where a session came from.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct SessionDevice {
+    pub id: SessionDeviceId,
+    pub name: String,
+    pub created_at: Timestamp,
+    pub last_used: Timestamp,
+}
+
+impl From<StorableSessionDevice> for SessionDevice {
+    fn from(value: StorableSessionDevice) -> Self {
+        SessionDevice {
+            id: value.id,
+            name: value.name,
+            created_at: value.created_at,
+            last_used: value.last_used,
+        }
+    }
+}
+
+impl From<SessionDevice> for StorableSessionDevice {
+    fn from(value: SessionDevice) -> Self {
+        StorableSessionDevice {
+            id: value.id,
+            name: value.name,
+            created_at: value.created_at,
+            last_used: value.last_used,
+        }
+    }
+}
+
 impl Device {
     /// Applies the values of `device_data` to self while leaving the other fields intact.
     pub fn apply_device_data(&mut self, device_data: DeviceData) {
@@ -175,6 +215,8 @@ impl From<Anchor> for (StorableFixedAnchor, StorableAnchor) {
             openid_credentials,
             email_recovery,
             verified_emails,
+            session_devices,
+            next_session_device_id,
             metadata,
             name,
             created_at,
@@ -194,6 +236,13 @@ impl From<Anchor> for (StorableFixedAnchor, StorableAnchor) {
                 .map(StorableVerifiedEmail::from)
                 .collect(),
         );
+        let next_session_device_id = Some(next_session_device_id);
+        let session_devices = Some(
+            session_devices
+                .into_iter()
+                .map(StorableSessionDevice::from)
+                .collect(),
+        );
 
         let (mut passkey_credentials, mut recovery_keys, mut recovery_devices) =
             (vec![], vec![], vec![]);
@@ -433,6 +482,8 @@ impl From<Anchor> for (StorableFixedAnchor, StorableAnchor) {
                 recovery_keys,
                 email_recovery,
                 verified_emails,
+                session_devices,
+                next_session_device_id,
             },
         )
     }
@@ -448,6 +499,8 @@ impl From<(AnchorNumber, StorableAnchor)> for Anchor {
             recovery_keys,
             email_recovery,
             verified_emails,
+            session_devices,
+            next_session_device_id,
         } = storable_anchor;
 
         let name = name.clone();
@@ -466,6 +519,12 @@ impl From<(AnchorNumber, StorableAnchor)> for Anchor {
             .into_iter()
             .map(VerifiedEmail::from)
             .collect();
+        let session_devices = session_devices
+            .unwrap_or_default()
+            .into_iter()
+            .map(SessionDevice::from)
+            .collect();
+        let next_session_device_id = next_session_device_id.unwrap_or_default();
 
         let mut devices = passkey_credentials
             .unwrap_or_default()
@@ -560,6 +619,8 @@ impl From<(AnchorNumber, StorableAnchor)> for Anchor {
             openid_credentials,
             email_recovery,
             verified_emails,
+            session_devices,
+            next_session_device_id,
             devices,
             metadata,
         }
@@ -586,6 +647,8 @@ impl From<(AnchorNumber, StorableFixedAnchor, Option<StorableAnchor>)> for Ancho
                 openid_credentials: vec![],
                 email_recovery: vec![],
                 verified_emails: vec![],
+                session_devices: vec![],
+                next_session_device_id: 0,
                 anchor_number,
                 devices,
                 metadata,
@@ -612,13 +675,21 @@ impl From<(AnchorNumber, StorableFixedAnchor, Option<StorableAnchor>)> for Ancho
             .into_iter()
             .map(VerifiedEmail::from)
             .collect();
+        let session_devices = storable_anchor
+            .session_devices
+            .unwrap_or_default()
+            .into_iter()
+            .map(SessionDevice::from)
+            .collect();
 
         Anchor {
             anchor_number,
             devices,
             openid_credentials,
             email_recovery,
             verified_emails,
+            session_devices,
+            next_session_device_id: storable_anchor.next_session_device_id.unwrap_or_default(),
             metadata,
             name,
             created_at,
@@ -627,6 +698,63 @@ impl From<(AnchorNumber, StorableFixedAnchor, Option<StorableAnchor>)> for Ancho
 }
 
 impl Anchor {
+    pub fn session_devices(&self) -> &[SessionDevice] {
+        &self.session_devices
+    }
+
+    /// Resolves the browser a sign-in came from, registering it when the client has no
+    /// id yet or presents one this anchor does not know.
+    ///
+    /// The client never chooses the id: an id it does not own resolves to a fresh
+    /// registration rather than to somebody else's device. At the cap the least recently
+    /// used records are dropped rather than the registration failing, which never costs
+    /// anyone a sign-in. Their ids are returned so the caller can end their sessions too:
+    /// a session whose device is no longer listed could not be signed out from settings.
+    pub fn resolve_session_device(
+        &mut self,
+        device_id: Option<SessionDeviceId>,
+        name: String,
+        now: Timestamp,
+    ) -> (SessionDeviceId, Vec<SessionDeviceId>) {
+        if let Some(device_id) = device_id {
+            if let Some(device) = self
+                .session_devices
+                .iter_mut()
+                .find(|device| device.id == device_id)
+            {
+                device.last_used = now;
+                return (device_id, vec![]);
+            }
+        }
+
+        let id = self.next_session_device_id;
+        self.next_session_device_id = self.next_session_device_id.saturating_add(1);
+        self.session_devices.push(SessionDevice {
+            id,
+            name,
+            created_at: now,
+            last_used: now,
+        });
+
+        let mut dropped = vec![];
+        while self.session_devices.len() > MAX_SESSION_DEVICES {
+            let least_recently_used = self
+                .session_devices
+                .iter()
+                .enumerate()
+                .min_by_key(|(_, device)| (device.last_used, device.id))
+                .map(|(index, _)| index);
+            match least_recently_used {
+                Some(index) => {
+                    dropped.push(self.session_devices.remove(index).id);
+                }
+                None => break,
+            }
+        }
+
+        (id, dropped)
+    }
+
     /// Creation of new anchors is restricted in order to make sure that the device checks are
     /// not accidentally bypassed.
     pub fn new(anchor_number: AnchorNumber, created_at: Timestamp) -> Anchor {
@@ -637,6 +765,8 @@ impl Anchor {
             openid_credentials: vec![],
             email_recovery: vec![],
             verified_emails: vec![],
+            session_devices: vec![],
+            next_session_device_id: 0,
             metadata: None,
             name: None,
         }