0.0.6 — authenticated session (NIP-98 → DPoP exchange) #5

0.0.1 lands the user at the pod root but they're not signed in — they can browse public content, but anything WAC-protected would prompt for a separate OIDC flow in whatever app uses it. The "magic SSO landing" is real; the "authenticated session" is missing.

Goal

After resolving the WebID, do a NIP-98 → DPoP exchange with the user's IdP so that the cookie / token state at the pod is already set up by the time the redirect lands.

Sketch

1. (existing) get pubkey + resolve WebID
2. Sign a NIP-98 event against the IdP's /idp/sso-token endpoint (or similar — a new endpoint to be added to JSS)
3. IdP verifies the NIP-98 signature against the user's profile VM, issues a DPoP-bound token
4. SSO page stores the token / cookie / handoff state appropriately
5. Redirect to the pod

The "new endpoint on JSS" piece is the bigger lift — it's a server-side companion to this client-side feature.

Acceptance

• User lands at the pod with a valid Solid-OIDC session
• WAC-protected resources accessible immediately, no further sign-in prompt
• Session refresh / expiry handled (or at least documented as a known follow-up)

Out of scope

• DPoP token rotation (long-running session) — separate concern
• Cross-pod sessions — separate concern

Refs

• 0.0.1 — current "navigation only, no session" PoC
• LWS 1.0 — defines NIP-98-style auth for Solid