Enable silent first-visit sign-in on OpenVibe.Search (#245)

ddiff --git a/server/app.js b/server/app.js
iindex e8babcc..063afff 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -25,6 +25,7 @@ const pkg = require('../package.json');
  
  function createApp({ config, db, store, engine, auth, outbox, purges, purger, saved, searcher: givenSearcher = null, notifier = null, vectorStore = null, embeddings = null, accountData = null, accountSend = null, fetchImpl = globalThis.fetch, log = console, now }) {
      const app = express();
++    app.use('/auth', require('./web-sso').webSso({ config, fetchImpl, log }));
      app.disable('x-powered-by');
      app.set('trust proxy', 'loopback');
      app.set('query parser', 'extended');
ddiff --git a/server/web-sso.js b/server/web-sso.js
nnew file mode 100644
iindex 0000000..9a5eb90
---- /dev/null
++++ b/server/web-sso.js
@@@ -0,0 +1,19 @@
++'use strict';
++// Browser sessions use the shared SDK. API/service-token authorization remains in its own middleware.
++const express = require('express');
++const { createSsoClient } = require('openvibe-sdk/sso');
++function webSso({ config, fetchImpl = globalThis.fetch, log = console }) {
++    const client = createSsoClient({
++        site: 'search', siteName: 'OpenVibe.Search', baseUrl: config.baseUrl,
++        clientId: config.oauth.clientId, clientSecret: config.oauth.clientSecret,
++        redirectUri: `${config.baseUrl}/auth/callback`, scope: 'profile theme',
++        networkUrl: config.issuer, networkInternalUrl: config.networkInternalUrl,
++        issuer: config.issuer, publicKey: undefined, audience: ['openvibe.network'],
++        secureCookies: config.isProduction, httpOnlyAccess: true, fetch: fetchImpl, log,
++    });
++    const router = express.Router();
++    router.use((_req, res, next) => { res.set('Cache-Control', 'no-store'); next(); });
++    router.use(client.router(express));
++    return router;
++}
++module.exports = { webSso };
ddiff --git a/server/web/page.js b/server/web/page.js
iindex 10e42ad..c396df0 100644
---- a/server/web/page.js
++++ b/server/web/page.js
@@@ -49,7 +49,7 @@ const LINKS = [{ label: 'Search', href: '/', icon: 'fa-magnifying-glass' }];
  // The shell options every page shares: the navbar it boots and the noscript nav and footer it renders.
  const FRAME = {
      name: SITE_NAME, lang: 'en', navLinks: LINKS,
--    navbar: { service: 'search', apiBase: NETWORK, links: LINKS },
++    navbar: { service: 'search', apiBase: NETWORK, sessionUrl: '/auth/me', loginUrl: '/auth/login?next={path}', logoutUrl: '/auth/logout?next={url}', silentLogin: '/auth/login?silent=1&next={url}', links: LINKS },
      footer: { service: 'search', variant: 'compact', updates: '/updates' },
  };
  const FOOTER = { service: 'search', variant: 'compact', mount: '#ov-footer', brandName: SITE_NAME, updates: '/updates' };
ddiff --git a/test/web-sso.test.js b/test/web-sso.test.js
nnew file mode 100644
iindex 0000000..6587602
---- /dev/null
++++ b/test/web-sso.test.js
@@@ -0,0 +1,68 @@
++'use strict';
++const assert = require('node:assert/strict');
++const express = require('express');
++const { webSso } = require('../server/web-sso');
++const config = require('../server/config').load({ NODE_ENV: 'production', BASE_URL: 'https://search.openvibe.network', OV_OAUTH_CLIENT_ID: 'search', OV_OAUTH_CLIENT_SECRET: 'test-only-secret' });
++(async () => {
++    const grants = [];
++    const crypto = require('node:crypto');
++    const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 });
++    const jwk = { ...publicKey.export({ format: 'jwk' }), kid: 'sso-test', alg: 'RS256', use: 'sig' };
++    let challenge;
++    const app = express();
++    app.use('/auth', webSso({ config, log: { warn() {}, error() {} }, fetchImpl: async (_url, options) => {
++        if (_url.endsWith('/api/.well-known/jwks')) return new Response(JSON.stringify({ keys: [jwk] }));
++        const grant = JSON.parse(options.body);
++        grants.push(grant);
++        if (grant.code === 'issued') {
++            assert.equal(crypto.createHash('sha256').update(grant.code_verifier).digest('base64url'), challenge);
++            const token = require('jsonwebtoken').sign({ sub: '12', type: 'person', username: 'sso-test' }, privateKey,
++                { algorithm: 'RS256', keyid: jwk.kid, issuer: 'https://openvibe.network', audience: 'openvibe.network', expiresIn: '1h' });
++            return new Response(JSON.stringify({ access_token: token, refresh_token: 'test-refresh' }));
++        }
++        return new Response(JSON.stringify({ error: 'invalid_grant' }), { status: 400 });
++    } }));
++    const server = app.listen(0, '127.0.0.1');
++    await new Promise(resolve => server.once('listening', resolve));
++    const get = (path, cookie) => fetch(`http://127.0.0.1:${server.address().port}${path}`, { redirect: 'manual', headers: cookie ? { Cookie: cookie } : {} });
++    const cookies = r => r.headers.getSetCookie().map(c => c.split(';')[0]).join('; ');
++    try {
++        const start = await get('/auth/login?silent=1&next=%2F%3Ffrom%3Dnav%23details');
++        assert.equal(start.status, 302);
++        const u = new URL(start.headers.get('location'));
++        assert.equal(u.origin, 'https://openvibe.network');
++        assert.equal(u.searchParams.get('client_id'), 'search');
++        assert.equal(u.searchParams.get('redirect_uri'), 'https://search.openvibe.network/auth/callback');
++        assert.equal(u.searchParams.get('prompt'), 'none');
++        assert.equal(u.searchParams.get('code_challenge_method'), 'S256');
++        assert.ok(u.searchParams.get('code_challenge'));
++        assert.ok(start.headers.getSetCookie().every(c => !/Domain=/i.test(c)), 'flow cookies are host-only');
++        const guest = await get('/auth/callback?error=login_required&state='+u.searchParams.get('state'), cookies(start));
++        assert.equal(guest.status, 302);
++        assert.equal(guest.headers.get('location'), '/?from=nav&sso=none#details');
++        assert.ok(!cookies(guest).includes('ov_token='));
++        const mismatch = await get('/auth/callback?code=unissued&state=wrong', cookies(start));
++        assert.ok(!cookies(mismatch).includes('ov_token='));
++        assert.equal(grants.length, 0, 'a mismatched state never reaches the token endpoint');
++        const me = await get('/auth/me');
++        assert.deepEqual(await me.json(), { user: null });
++        assert.equal(me.headers.get('cache-control'), 'no-store');
++        const health = await get('/auth/health');
++        assert.deepEqual(await health.json(), { ok: true, client: 'ok' });
++        assert.equal(grants[0].client_id, 'search');
++        const external = await get('/auth/login?silent=1&next=https%3A%2F%2Fevil.test');
++        const back = await get('/auth/callback?error=login_required', cookies(external));
++        assert.equal(back.headers.get('location'), '/?sso=none');
++        challenge = u.searchParams.get('code_challenge');
++        const signedIn = await get('/auth/callback?code=issued&state='+u.searchParams.get('state'), cookies(start));
++        assert.equal(signedIn.status, 302);
++        assert.equal(signedIn.headers.get('location'), '/?from=nav#details');
++        const access = signedIn.headers.getSetCookie().find(c => c.startsWith('ov_token='));
++        assert.ok(access && /HttpOnly/i.test(access) && /Secure/i.test(access) && /SameSite=Lax/i.test(access));
++        assert.ok(!/Domain=/i.test(access));
++        const person = await get('/auth/me', cookies(signedIn));
++        assert.equal((await person.json()).user.username, 'sso-test');
++
++        console.log('web SSO: SDK silent login, PKCE, state, guest return, host-only cookies and no-store passed');
++    } finally { await new Promise(resolve => server.close(resolve)); }
++})().catch(err => { console.error(err); process.exitCode = 1; });