From d487ca794793fd4535028fb8c8319c6c6c473136 Mon Sep 17 00:00:00 2001
From: 7w1 <noreply@sl.sable.moe>
Date: Thu, 23 Jul 2026 14:09:06 -0500
Subject: [PATCH 1/2] fix: non-oidc sessions using oidc device management

---
 src/app/hooks/useAuthMetadata.test.ts | 52 +++++++++++++++++++++++++++
 src/app/hooks/useAuthMetadata.ts      |  6 ++++
 src/app/pages/client/ClientRoot.tsx   |  6 ++--
 3 files changed, 62 insertions(+), 2 deletions(-)
 create mode 100644 src/app/hooks/useAuthMetadata.test.ts

diff --git a/src/app/hooks/useAuthMetadata.test.ts b/src/app/hooks/useAuthMetadata.test.ts
new file mode 100644
index 0000000000..769bf799d7
--- /dev/null
+++ b/src/app/hooks/useAuthMetadata.test.ts
@@ -0,0 +1,52 @@
+import type { ValidatedAuthMetadata } from '$types/matrix-sdk';
+import type { Session } from '$state/sessions';
+import { getSessionAuthMetadata } from './useAuthMetadata';
+
+const metadata = {
+  issuer: 'https://auth.example.org/',
+  authorization_endpoint: 'https://auth.example.org/authorize',
+  token_endpoint: 'https://auth.example.org/token',
+  registration_endpoint: 'https://auth.example.org/register',
+  response_types_supported: ['code'],
+  response_modes_supported: ['query'],
+  grant_types_supported: ['authorization_code', 'refresh_token'],
+  code_challenge_methods_supported: ['S256'],
+  account_management_uri: 'https://auth.example.org/account',
+} as ValidatedAuthMetadata;
+
+const session: Session = {
+  baseUrl: 'https://matrix.example.org',
+  userId: '@alice:example.org',
+  deviceId: 'DEVICE',
+  accessToken: 'access-token',
+};
+
+describe('getSessionAuthMetadata', () => {
+  it('does not expose delegated account management to non-OIDC sessions', () => {
+    expect(getSessionAuthMetadata(metadata, session)).toBeUndefined();
+  });
+
+  it('exposes delegated account management to OIDC sessions', () => {
+    const oidcSession: Session = {
+      ...session,
+      oidc: {
+        issuer: metadata.issuer,
+        clientId: 'client-id',
+      },
+    };
+
+    expect(getSessionAuthMetadata(metadata, oidcSession)).toBe(metadata);
+  });
+
+  it('does not invent metadata when an OIDC session has no discovered metadata', () => {
+    const oidcSession: Session = {
+      ...session,
+      oidc: {
+        issuer: metadata.issuer,
+        clientId: 'client-id',
+      },
+    };
+
+    expect(getSessionAuthMetadata(undefined, oidcSession)).toBeUndefined();
+  });
+});
diff --git a/src/app/hooks/useAuthMetadata.ts b/src/app/hooks/useAuthMetadata.ts
index 3d434beb93..cc41f0a26a 100644
--- a/src/app/hooks/useAuthMetadata.ts
+++ b/src/app/hooks/useAuthMetadata.ts
@@ -1,10 +1,16 @@
 import type { ValidatedAuthMetadata } from '$types/matrix-sdk';
+import type { Session } from '$state/sessions';
 import { createContext, useContext } from 'react';
 
 const AuthMetadataContext = createContext<ValidatedAuthMetadata | undefined>(undefined);
 
 export const AuthMetadataProvider = AuthMetadataContext.Provider;
 
+export const getSessionAuthMetadata = (
+  metadata: ValidatedAuthMetadata | undefined,
+  session: Session | undefined
+): ValidatedAuthMetadata | undefined => (session?.oidc ? metadata : undefined);
+
 export const useAuthMetadata = (): ValidatedAuthMetadata | undefined => {
   const metadata = useContext(AuthMetadataContext);
 
diff --git a/src/app/pages/client/ClientRoot.tsx b/src/app/pages/client/ClientRoot.tsx
index f86e518b28..5d4ea38a81 100644
--- a/src/app/pages/client/ClientRoot.tsx
+++ b/src/app/pages/client/ClientRoot.tsx
@@ -35,7 +35,7 @@ import { MatrixClientProvider } from '$hooks/useMatrixClient';
 import { AsyncStatus, useAsyncCallback } from '$hooks/useAsyncCallback';
 import { useSyncState } from '$hooks/useSyncState';
 import { stopPropagation } from '$utils/keyboard';
-import { AuthMetadataProvider } from '$hooks/useAuthMetadata';
+import { AuthMetadataProvider, getSessionAuthMetadata } from '$hooks/useAuthMetadata';
 import {
   sessionsAtom,
   activeSessionIdAtom,
@@ -480,7 +480,9 @@ export function ClientRoot({ children }: ClientRootProps) {
                 {(serverConfigs) => (
                   <CapabilitiesProvider value={serverConfigs.capabilities ?? {}}>
                     <MediaConfigProvider value={serverConfigs.mediaConfig ?? {}}>
-                      <AuthMetadataProvider value={serverConfigs.authMetadata}>
+                      <AuthMetadataProvider
+                        value={getSessionAuthMetadata(serverConfigs.authMetadata, activeSession)}
+                      >
                         {children}
                       </AuthMetadataProvider>
                     </MediaConfigProvider>

From 6627b92f0a7c3007638f4cdfb970b093d1717440 Mon Sep 17 00:00:00 2001
From: 7w1 <noreply@sl.sable.moe>
Date: Thu, 23 Jul 2026 14:12:57 -0500
Subject: [PATCH 2/2] Update useAuthMetadata.test.ts

---
 src/app/hooks/useAuthMetadata.test.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/app/hooks/useAuthMetadata.test.ts b/src/app/hooks/useAuthMetadata.test.ts
index 769bf799d7..95bf05d0cd 100644
--- a/src/app/hooks/useAuthMetadata.test.ts
+++ b/src/app/hooks/useAuthMetadata.test.ts
@@ -1,3 +1,4 @@
+import { describe, expect, it } from 'vitest';
 import type { ValidatedAuthMetadata } from '$types/matrix-sdk';
 import type { Session } from '$state/sessions';
 import { getSessionAuthMetadata } from './useAuthMetadata';