From 5d7e67a972f97c3050bb87efbca57682bc37bd6b Mon Sep 17 00:00:00 2001 From: "pr-automation-bot-public[bot]" Date: Tue, 4 Aug 2026 09:57:04 +0000 Subject: [PATCH] chore: sync II spec to dfinity/internet-identity release-2026-07-31 --- .sources/VERSIONS | 2 +- .sources/internetidentity | 2 +- public/references/internet-identity.did | 39 ++++++++++++++++++++----- 3 files changed, 34 insertions(+), 9 deletions(-) diff --git a/.sources/VERSIONS b/.sources/VERSIONS index 24c3a7eb..bc571d1c 100644 --- a/.sources/VERSIONS +++ b/.sources/VERSIONS @@ -62,4 +62,4 @@ motoko-core v2.4.0 cdk-rs ic-cdk v0.20.1 / ic-cdk-timers v1.0.0 / ic-cdk-executor v2.0.0 317f55c candid 2025-12-18 # candid v0.10.20, didc v0.5.4 2e4a2cf response-verification v3.1.0 18c5a37 -internetidentity release-2026-07-27 f94dde5f +internetidentity release-2026-07-31 e646fe93 diff --git a/.sources/internetidentity b/.sources/internetidentity index f94dde5f..e646fe93 160000 --- a/.sources/internetidentity +++ b/.sources/internetidentity @@ -1 +1 @@ -Subproject commit f94dde5fb28489b7afb3653951f4fadd1ce5af1e +Subproject commit e646fe9338d0aedd3ee35aa9ea70c1d6b95c511d diff --git a/public/references/internet-identity.did b/public/references/internet-identity.did index 3208529c..4e83f4b1 100644 --- a/public/references/internet-identity.did +++ b/public/references/internet-identity.did @@ -350,6 +350,16 @@ type InternetIdentityInit = record { // via HTTP outcalls when no DNSSEC chain is available โ€” see // `docs/ongoing/email-recovery.md` ยง7.6. Same set/clear pattern. doh_config : opt opt DohConfig; + // URL of the official MCP connector the deployment ships, if any. Same + // set/clear pattern as `dnssec_config`: null keeps the previously stored + // value, `opt null` clears it, `opt opt "https://..."` sets it. + mcp_official_url : opt opt text; + // One-shot upgrade arg driving the MCP config migration: `opt true` gives + // every anchor "enabled, official connector", since neither a value stored + // before the official connector existed nor an absent config was ever a + // choice about it. Unset means no migration, and the migration is refused + // when the deployment ships no `mcp_official_url`. + mcp_config_migration : opt bool; }; // DNSSEC trust-anchor list. Any feature that needs DNSSEC-verified DNS @@ -1164,13 +1174,18 @@ type McpConfig = record { }; // Result of prepare_mcp_registration_delegation: the canister-signature public -// key the registration delegation is rooted at (P_reg), and the (short) -// expiration of that delegation. The frontend fetches the signed delegation via -// get_mcp_registration_delegation and delivers the chain to the trusted MCP +// key the registration delegation is rooted at (P_reg), the (short) expiration +// of that delegation, and the identity's resolved trusted_url (the anchor's own +// server if set, else the official connector). trusted_url is certified (this +// is an update call), so the frontend can gate delivery on it - delivering the +// chain only when the connect link's origin matches - rather than trusting an +// uncertified mcp_get_config query. The frontend fetches the signed delegation +// via get_mcp_registration_delegation and delivers the chain to the trusted MCP // server, which redeems it with mcp_register_v2. type PrepareMcpRegistrationDelegation = record { user_key : UserKey; expiration : Timestamp; + trusted_url : text; }; // Result of mcp_register_v2: the expiration (ns since epoch) of the MCP session @@ -1887,7 +1902,11 @@ service : (opt InternetIdentityInit) -> { // devices. Read by the Settings UI and the /mcp connect flow (which verifies // the connecting origin against it). Returns the disabled, no-server default // for an unauthorized caller or an anchor that never wrote a config. - mcp_get_config : (anchor_number : UserNumber) -> (McpConfig) query; + // `null` means the identity has never written a config โ€” distinct from a + // stored one that is switched off. The two behave differently at /mcp: the + // first may connect the deployment's official connector (completing the + // consent is what enables it), the second is sent back to Settings. + mcp_get_config : (anchor_number : UserNumber) -> (opt McpConfig) query; // Persist the identity's trusted-MCP-server config so it syncs across the // identity's devices. Authenticated as the identity, so only the user โ€” never @@ -1906,9 +1925,15 @@ service : (opt InternetIdentityInit) -> { // mcp_get_accounts), and null uses the anchor's default account there; an // account_number that isn't the anchor's at target_origin is rejected as // Unauthorized. max_ttl is the requested lifetime in ns, defaulting to and - // capped at 1 hour, and never outliving the session grant. The resolved - // account_number is returned in McpPrepareDelegation so it can be threaded - // into mcp_get_delegation (the default account at an origin is mutable). + // capped at 5 minutes, and never outliving the session grant. The cap is + // short because it is the residual window revocation cannot reach: once the + // session is revoked no further delegation can be minted, but one already + // minted stays usable until it expires. Re-minting is unattended (a fresh + // prepare/get pair signed by the session key, no user interaction), so + // re-mint rather than holding a delegation for the life of the session. The + // resolved account_number is returned in McpPrepareDelegation so it can be + // threaded into mcp_get_delegation (the default account at an origin is + // mutable). mcp_prepare_delegation : ( target_origin : FrontendHostname, account_number : opt AccountNumber,