OAuth SSO infrastructure + account app support

- OAuthCode model + migration for authorization code flow
- OAuth client blueprint (auto-registered for non-federation apps)
- Per-app first-party session cookies (fixes Safari ITP)
- /oauth/authorize endpoint support in URL helpers
- account_url() helper + Jinja global
- Templates: federation_url('/auth/...') → account_url('/...')
- Widget registry: account page links use account_url

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/factory.py

@@ -11,7 +11,7 @@ from shared.config import init_config, config, pretty
 from shared.models import KV  # ensure shared models imported
 # Register all app model classes with SQLAlchemy so cross-domain
 # relationship() string references resolve correctly.
-for _mod in ("blog.models", "market.models", "cart.models", "events.models", "federation.models"):
+for _mod in ("blog.models", "market.models", "cart.models", "events.models", "federation.models", "account.models"):
     try:
         __import__(_mod)
     except ImportError:
@@ -80,11 +80,10 @@ def create_base_app(
 
     app.secret_key = os.getenv("SECRET_KEY", "dev-secret-key-change-me-777")
 
-    # Session cookie shared across subdomains
-    cookie_domain = os.getenv("SESSION_COOKIE_DOMAIN")  # e.g. ".rose-ash.com"
-    if cookie_domain:
-        app.config["SESSION_COOKIE_DOMAIN"] = cookie_domain
-    app.config["SESSION_COOKIE_NAME"] = "blog_session"
+    # Per-app first-party session cookie (no shared domain — avoids Safari ITP)
+    app.config["SESSION_COOKIE_NAME"] = f"{name}_session"
+    app.config["SESSION_COOKIE_SAMESITE"] = "Lax"
+    app.config["SESSION_COOKIE_SECURE"] = True
 
     # Ghost / Redis config
     app.config["GHOST_API_URL"] = os.getenv("GHOST_API_URL")
@@ -102,6 +101,11 @@ def create_base_app(
     setup_jinja(app)
     errors(app)
 
+    # Auto-register OAuth client blueprint for non-federation apps
+    if name != "federation":
+        from shared.infrastructure.oauth import create_oauth_blueprint
+        app.register_blueprint(create_oauth_blueprint(name))
+
     # --- before-request hooks ---
     @app.before_request
     async def _route_log():

infrastructure/jinja_setup.py

@@ -13,7 +13,7 @@ from shared.browser.app.csrf import generate_csrf_token
 from shared.browser.app.authz import has_access
 from shared.browser.app.filters import register as register_filters
 
-from .urls import blog_url, market_url, cart_url, events_url, federation_url, login_url, page_cart_url, market_product_url
+from .urls import blog_url, market_url, cart_url, events_url, federation_url, account_url, login_url, page_cart_url, market_product_url
 
 
 def setup_jinja(app: Quart) -> None:
@@ -98,6 +98,7 @@ def setup_jinja(app: Quart) -> None:
     app.jinja_env.globals["cart_url"] = cart_url
     app.jinja_env.globals["events_url"] = events_url
     app.jinja_env.globals["federation_url"] = federation_url
+    app.jinja_env.globals["account_url"] = account_url
     app.jinja_env.globals["login_url"] = login_url
     app.jinja_env.globals["page_cart_url"] = page_cart_url
     app.jinja_env.globals["market_product_url"] = market_product_url

infrastructure/oauth.py

@@ -0,0 +1,130 @@
+"""OAuth2 client blueprint for non-federation apps.
+
+Each client app gets /auth/login, /auth/callback, /auth/logout.
+Federation is the OAuth authorization server.
+"""
+from __future__ import annotations
+
+import secrets
+from datetime import datetime, timezone
+
+from quart import (
+    Blueprint,
+    redirect,
+    request,
+    session as qsession,
+    g,
+    current_app,
+)
+from sqlalchemy import select
+
+from shared.db.session import get_session
+from shared.models import User
+from shared.models.oauth_code import OAuthCode
+from shared.infrastructure.urls import federation_url, app_url
+from shared.infrastructure.cart_identity import current_cart_identity
+from shared.events import emit_activity
+
+SESSION_USER_KEY = "uid"
+
+
+def create_oauth_blueprint(app_name: str) -> Blueprint:
+    """Return an OAuth client blueprint for *app_name*."""
+    bp = Blueprint("oauth_auth", __name__, url_prefix="/auth")
+
+    @bp.get("/login")
+    @bp.get("/login/")
+    async def login():
+        next_url = request.args.get("next", "/")
+        state = secrets.token_urlsafe(32)
+        qsession["oauth_state"] = state
+        qsession["oauth_next"] = next_url
+
+        redirect_uri = app_url(app_name, "/auth/callback")
+        authorize_url = federation_url(
+            f"/oauth/authorize?client_id={app_name}"
+            f"&redirect_uri={redirect_uri}"
+            f"&state={state}"
+        )
+        return redirect(authorize_url)
+
+    @bp.get("/callback")
+    @bp.get("/callback/")
+    async def callback():
+        code = request.args.get("code")
+        state = request.args.get("state")
+        expected_state = qsession.pop("oauth_state", None)
+        next_url = qsession.pop("oauth_next", "/")
+
+        if not code or not state or state != expected_state:
+            current_app.logger.warning("OAuth callback: bad state or missing code")
+            return redirect("/")
+
+        expected_redirect = app_url(app_name, "/auth/callback")
+        now = datetime.now(timezone.utc)
+
+        async with get_session() as s:
+            async with s.begin():
+                result = await s.execute(
+                    select(OAuthCode)
+                    .where(OAuthCode.code == code)
+                    .with_for_update()
+                )
+                oauth_code = result.scalar_one_or_none()
+
+                if not oauth_code:
+                    current_app.logger.warning("OAuth callback: code not found")
+                    return redirect("/")
+
+                if oauth_code.used_at is not None:
+                    current_app.logger.warning("OAuth callback: code already used")
+                    return redirect("/")
+
+                if oauth_code.expires_at < now:
+                    current_app.logger.warning("OAuth callback: code expired")
+                    return redirect("/")
+
+                if oauth_code.client_id != app_name:
+                    current_app.logger.warning("OAuth callback: client_id mismatch")
+                    return redirect("/")
+
+                if oauth_code.redirect_uri != expected_redirect:
+                    current_app.logger.warning("OAuth callback: redirect_uri mismatch")
+                    return redirect("/")
+
+                oauth_code.used_at = now
+                user_id = oauth_code.user_id
+
+        # Set local session
+        qsession[SESSION_USER_KEY] = user_id
+
+        # Emit login activity for cart adoption
+        ident = current_cart_identity()
+        anon_session_id = ident.get("session_id")
+        if anon_session_id:
+            try:
+                async with get_session() as s:
+                    async with s.begin():
+                        await emit_activity(
+                            s,
+                            activity_type="rose:Login",
+                            actor_uri="internal:system",
+                            object_type="Person",
+                            object_data={
+                                "user_id": user_id,
+                                "session_id": anon_session_id,
+                            },
+                        )
+            except Exception:
+                current_app.logger.exception("OAuth: failed to emit login activity")
+
+        return redirect(next_url, 303)
+
+    @bp.post("/logout")
+    @bp.post("/logout/")
+    async def logout():
+        qsession.pop(SESSION_USER_KEY, None)
+        qsession.pop("cart_sid", None)
+        return redirect("/")
+
+    return bp

infrastructure/urls.py

@@ -41,6 +41,10 @@ def federation_url(path: str = "/") -> str:
     return app_url("federation", path)
 
 
+def account_url(path: str = "/") -> str:
+    return app_url("account", path)
+
+
 def page_cart_url(page_slug: str, path: str = "/") -> str:
     if not path.startswith("/"):
         path = "/" + path
@@ -66,17 +70,24 @@ def market_product_url(product_slug: str, suffix: str = "", market_place=None) -
 
 
 def login_url(next_url: str = "") -> str:
-    # Auth lives in federation. Set AUTH_APP to override.
-    from quart import session as qsession
-    auth_app = os.getenv("AUTH_APP", "federation")
-    base = app_url(auth_app, "/auth/login/")
-    params: list[str] = []
+    from quart import current_app
+
+    # Federation handles login directly (magic link flow)
+    if current_app.name == "federation":
+        base = "/auth/login/"
+        params: list[str] = []
+        if next_url:
+            params.append(f"next={quote(next_url, safe='')}")
+        from quart import session as qsession
+        cart_sid = qsession.get("cart_sid")
+        if cart_sid:
+            params.append(f"cart_sid={quote(cart_sid, safe='')}")
+        if params:
+            return f"{base}?{'&'.join(params)}"
+        return base
+
+    # Client apps: local /auth/login triggers OAuth redirect to federation
+    base = "/auth/login/"
     if next_url:
-        params.append(f"next={quote(next_url, safe='')}")
-    # Pass anonymous cart session so the auth app can adopt it on login
-    cart_sid = qsession.get("cart_sid")
-    if cart_sid:
-        params.append(f"cart_sid={quote(cart_sid, safe='')}")
-    if params:
-        return f"{base}?{'&'.join(params)}"
+        return f"{base}?next={quote(next_url, safe='')}"
     return base