Community: sessions verified by openvibe-sdk/auth (typed tokens refused) over createNetworkKeys (#53)

ddiff --git a/README.md b/README.md
iindex 96f4b89..e1609bf 100644
---- a/README.md
++++ b/README.md
@@@ -41,7 +41,7 @@ little progressive JavaScript for pagination, copy buttons and the upload path.
  - OpenVibe.Media (screenshot and attachment uploads), OpenVibe.VIP (members-only gates), OpenVibe.Chat
    (a space's room), OpenVibe.Events (the outbox relay and the Pulse and account subscriptions)
  - OpenVibe.Live only for old VOD/clip comment imports (it reads and writes no pastes here any more)
--- `openvibe-contracts` v0.112.0, `openvibe-sdk` v0.38.0 (events outbox, per-actor limits),
++- `openvibe-contracts` v0.112.0, `openvibe-sdk` v0.40.0 (events outbox, per-actor limits),
    `openvibe-shared` v3.0.0, pinned by release tarball
  
  ## How it fits the network
@@@ -825,6 +825,6 @@ release after paste comments moved onto the typed comment threads. [Submissions]
  
  <!-- versions:start -->
  - openvibe-contracts: v0.129.0
--- openvibe-sdk: v0.38.0
++- openvibe-sdk: v0.40.0
  - openvibe-shared: v3.0.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex 6a1493c..b210616 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -8,7 +8,7 @@
    "port": 4200,
    "domain": "openvibe.community",
    "contracts": "openvibe-contracts v0.129.0",
--  "sdk": "openvibe-sdk v0.38.0",
++  "sdk": "openvibe-sdk v0.40.0",
    "shared": "openvibe-shared v3.0.0",
    "capabilities": [
      "community.paste.create",
ddiff --git a/package-lock.json b/package-lock.json
iindex 829d796..cdf939c 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -18,7 +18,7 @@
          "iovalkey": "^0.4.0",
          "multer": "^2.4.0",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.129.0",
--        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.38.0",
++        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.40.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v3.0.0",
          "pg": "^8.23.0"
        },
@@@ -933,9 +933,9 @@
        }
      },
      "node_modules/openvibe-sdk": {
--      "version": "0.38.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.38.0",
--      "integrity": "sha512-/Z+1kB5l4Hff0E1O1Zo+DcXaZX93wrmISOPP75sB7NqVUZVeKuJgjYu6vBwG8ufJjlk0vD3ZJ0ntBLI/3IKdpg==",
++      "version": "0.40.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.40.0",
++      "integrity": "sha512-fYX0zijJZDdwjXJGwroLDlb/wniY6NXVtgdPVJJHNgcdRmaAydpr6SKuxcLffmkTquyZQptwChsCvo+D6Wx+IA==",
        "license": "MIT",
        "engines": {
          "node": ">=20"
ddiff --git a/package.json b/package.json
iindex 3039c33..807ad96 100644
---- a/package.json
++++ b/package.json
@@@ -29,7 +29,7 @@
      "iovalkey": "^0.4.0",
      "multer": "^2.4.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.129.0",
--    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.38.0",
++    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.40.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v3.0.0",
      "pg": "^8.23.0"
    },
ddiff --git a/server/auth/routes.js b/server/auth/routes.js
iindex 4a699be..41601cc 100644
---- a/server/auth/routes.js
++++ b/server/auth/routes.js
@@@ -35,6 +35,7 @@
  const express = require('express');
  const crypto = require('crypto');
  const { OpenVibeAuthClient } = require('openvibe-shared/auth-client');
++const { createNetworkKeys, verifyUserToken } = require('openvibe-sdk/auth');
  const cache = require('openvibe-shared/cache-policy');
  
  const ACCESS_COOKIE = 'ov_token';
@@@ -45,63 +46,46 @@ const NEXT_COOKIE = 'ov_oauth_next';
  const SILENT_COOKIE = 'ov_oauth_silent';
  
  /**
-- * Create the auth client + JWKS fetcher shared by the whole app.
-- * Verification is OFFLINE: we cache the Network's RS256 public key from
-- * GET /api/.well-known/jwks and verify JWTs locally on every request.
++ * Create the auth client shared by the whole app: OAuth (code, jwt-bearer and refresh grants) through
++ * OpenVibeAuthClient, and OFFLINE session verification with openvibe-sdk/auth verifyUserToken against Network's keys
++ * (createNetworkKeys: the JWKS, retried every 30 s until it loads, refreshed every 15 minutes, a rotation followed on
++ * an unknown kid). A typed token (a FedCM assertion, a realtime ticket, an export token) or a service principal is
++ * never a session here.
++ *
++ *   auth.keys          Network's keys (keys.verifyOptions for the other verifiers, keys.loaded() for readiness)
++ *   auth.ensureKey()   the keys once loaded (fetching once if they are not), else null
++ *   auth.verify(token) claims | null
   */
  function createAuthClient(config) {
      const client = new OpenVibeAuthClient({
          clientId: config.oauth.clientId,
          clientSecret: config.oauth.clientSecret,
          redirectUri: config.oauth.redirectUri,
--        publicKey: null, // filled by ensureKey()
++        publicKey: null, // sessions are verified below, never by this client
          authBase: config.networkUrl,
          internalBase: config.networkInternalUrl,
      });
++    const keys = createNetworkKeys({ network: config.networkInternalUrl || config.networkUrl, log: console });
  
--    let lastFetch = 0;
--    let inflight = null;
      async function ensureKey() {
--        if (client.publicKey) return client.publicKey;
--        // A request that arrives while the key is being fetched waits for that fetch rather than
--        // being treated as signed out.
--        if (inflight) return inflight;
--        // Don't hammer the Network if it's down — retry at most every 30s
--        if (Date.now() - lastFetch < 30_000) return null;
--        lastFetch = Date.now();
--        inflight = fetchKey().finally(() => { inflight = null; });
--        return inflight;
--    }
--    async function fetchKey() {
--        for (const base of [config.networkInternalUrl, config.networkUrl]) {
--            if (!base) continue;
--            try {
--                const res = await fetch(`${base}/api/.well-known/jwks`, { signal: AbortSignal.timeout(5000) });
--                if (!res.ok) continue;
--                const jwks = await res.json();
--                if (jwks.public_key) {
--                    client.publicKey = jwks.public_key;
--                    console.log(`[Auth] Network public key loaded from ${base} (${jwks.algorithm || 'RS256'})`);
--                    return client.publicKey;
--                }
--            } catch (err) {
--                console.warn(`[Auth] JWKS fetch failed from ${base}: ${err.message}`);
--            }
--        }
--        return null;
++        if (!keys.loaded()) await keys.refresh();
++        return keys.loaded() ? keys : null;
      }
  
      /** Offline JWT verification. Returns decoded claims or null. */
      async function verify(token) {
          if (!token) return null;
--        await ensureKey();
--        return client.verifyToken(token);
++        try {
++            return await verifyUserToken(String(token), { ...keys.verifyOptions, issuer: config.networkUrl });
++        } catch {
++            return null;
++        }
      }
  
--    // Warm the key cache at boot (non-fatal if the Network is down)
--    ensureKey().catch(() => {});
++    // Load the keys now and keep them fresh (non-fatal if the Network is down; unref'd timers).
++    keys.start().catch(() => {});
  
--    return { client, ensureKey, verify };
++    return { client, keys, ensureKey, verify };
  }
  
  /** Token from Authorization header or the ov_token cookie. */
ddiff --git a/server/identity/viewer.js b/server/identity/viewer.js
iindex 9a5a449..fa3a32e 100644
---- a/server/identity/viewer.js
++++ b/server/identity/viewer.js
@@@ -25,7 +25,8 @@ const contracts = require('openvibe-contracts');
  const { extractToken, claimsToUser, decodeJwtPayload } = require('../auth/routes');
  const { checkCapability } = require('./capabilities');
  
--const { ids, capabilities, serviceAuth, http } = contracts;
++const { ids, capabilities, http } = contracts;
++const { verifyServiceToken } = require('openvibe-sdk/auth');
  const { staff: staffMap } = require('openvibe-contracts');
  // The roles that hold staff moderation today (kept for callers; gates ask staffMap.can instead).
  const STAFF_ROLES = new Set(['admin', 'global_mod']);
@@@ -49,9 +50,9 @@ function hasCap(viewer, capabilityId) {
  
  function createViewerResolver({ auth, config, network, revocations = null }) {
      async function fromServiceToken(req, token) {
--        const publicKey = await auth.ensureKey();
--        if (!publicKey) throw new ViewerError(503, 'identity.unavailable', 'the Network signing key is not loaded yet');
--        const r = serviceAuth.verifyServiceToken(token, { publicKey, issuer: config.networkUrl, audience: AUDIENCE });
++        // openvibe-sdk/auth: the pinned contracts rules with the key the token's kid names.
++        const r = await verifyServiceToken(token, { ...auth.keys.verifyOptions, issuer: config.networkUrl, audience: AUDIENCE, contracts });
++        if (!r.ok && r.code === 'token.unavailable') throw new ViewerError(503, 'identity.unavailable', 'the Network signing key is not loaded yet');
          if (!r.ok) throw new ViewerError(401, r.code, r.reason);
          const claims = r.claims;
          // Developer apps (app:…) and modules (mod:…) are third parties: they act only for the person
ddiff --git a/server/observability.js b/server/observability.js
iindex aa37cbf..fd70ad8 100644
---- a/server/observability.js
++++ b/server/observability.js
@@@ -39,9 +39,8 @@ function createCommunityReadiness({ db, auth, config, relay = null, release = nu
          {
              name: 'network_jwks', required: false,
              check: () => {
--                if (auth.client.publicKey) return true;
--                // Not loaded: ask again (ensureKey throttles itself to one fetch per 30 s) and report now.
--                auth.ensureKey().catch(() => {});
++                if (auth.keys.loaded()) return true;
++                // Not loaded: createNetworkKeys retries every 30 s on its own; report now.
                  return 'Network signing key not loaded yet: sign-in and signed-in writes are unavailable';
              },
          },
ddiff --git a/test/auth.test.js b/test/auth.test.js
iindex 19b2880..32c9b0e 100644
---- a/test/auth.test.js
++++ b/test/auth.test.js
@@@ -87,6 +87,17 @@ const { boot, check, done } = require('./helpers/app');
          assert.strictEqual(bad.status, 401, 'a present but invalid cookie');
      });
  
++    await check('a typed Network token (a FedCM assertion, a realtime ticket, an export token) is never a session', async () => {
++        // Network signs them with the session key; openvibe-sdk/auth verifyUserToken refuses `typ`/`purpose`.
++        const me = (token) => fetch(`${t.base}/auth/me`, { headers: { cookie: `ov_token=${token}` } });
++        for (const extra of [{ typ: 'fedcm', aud: 'community' }, { typ: 'realtime', purpose: 'realtime' }, { purpose: 'export' }]) {
++            const r = await me(t.network.sign({ id: 7, username: 'alex', subject_id: 'usr_01JAB2C3D4E5F6G7H8J9K0MNPR', ...extra }));
++            assert.strictEqual(r.status, 401, `${JSON.stringify(extra)} on /auth/me`);
++        }
++        const session = await me(t.network.sign({ id: 7, username: 'alex', subject_id: 'usr_01JAB2C3D4E5F6G7H8J9K0MNPR' }));
++        assert.strictEqual(session.status, 200, 'the session token itself signs in');
++    });
++
      await check('silent login with a valid ov_token skips the Network and 302s to next; non-silent and bad tokens still go', async () => {
          assert.ok(t.jar.has('ov_token'), 'precondition: signed in');
          const short = await t.get('/auth/login?silent=1&next=/pastes%3Fsort%3Dviews');
ddiff --git a/test/observability.test.js b/test/observability.test.js
iindex 6625e49..99caede 100644
---- a/test/observability.test.js
++++ b/test/observability.test.js
@@@ -65,7 +65,7 @@ function raw(base, path, headers = {}) {
  
      await check('Network key not loaded: degraded, not down', async () => {
          const { createCommunityReadiness } = require('../server/observability');
--        const auth = { client: { publicKey: null }, ensureKey: async () => null };
++        const auth = { keys: { loaded: () => false }, ensureKey: async () => null };
          const b = await createCommunityReadiness({ db: t.app.locals.db, auth, config: { ...t.app.locals.config, mediaInternalUrl: t.media.url } }).run();
          assert.strictEqual(b.ready, true);
          assert.deepStrictEqual(b.degraded, ['network_jwks']);
ddiff --git a/test/security-ssrf.test.js b/test/security-ssrf.test.js
iindex 84c475d..7cdc324 100644
---- a/test/security-ssrf.test.js
++++ b/test/security-ssrf.test.js
@@@ -23,7 +23,7 @@ const { boot, check, done } = require('./helpers/app');
  // file → [call sites, where they go and why the URL is not a user's]
  const INVENTORY = {
      'server/app.js': [1, 'createAuthClient(config): the Network JWKS (OV_NETWORK_INTERNAL_URL)'],
--    'server/auth/routes.js': [4, 'createAuthClient, JWKS, /oauth/token, /oauth/revoke: OV_NETWORK_INTERNAL_URL, fixed paths'],
++    'server/auth/routes.js': [3, '/oauth/token, /oauth/revoke: OV_NETWORK_INTERNAL_URL, fixed paths (the signing keys come from openvibe-sdk/auth)'],
      'server/chat-rooms.js': [1, 'OV_CHAT_INTERNAL_URL /api/chat/rooms/<slug>/attachments; the slug must match ROOM_SLUG and is encoded'],
      'server/events.js': [3, 'service token (Network) and the outbox publisher: EVENTS_URL'],
      'server/identity/network.js': [3, 'Network /internal/identity/resolve-batch and /internal/identity/resolve?username= with a service token (configured base, never a user URL)'],