Spelunk: sign each device in through the browser instead of keeping Spelunk API keys in the vault

A Spelunk API key reaches one organisation, so a server elsewhere - oc-linux in Orange Climate - was
refused before it reached the agent. Each device now signs in to a Spelunk once, under Settings ->
Security -> Spelunk or from a Spelunk host's editor: the OAuth authorization code flow with PKCE for a
native app (RFC 8252), with Spelunk as the authorization server. The browser opens Spelunk's
/api/app-sign-in/authorize with a loopback redirect (the app's own scheme on Android), the person signs
in there however they normally do and allows "DodoSSH on <device>", and the code is redeemed at
/api/app-sign-in/token for an app session token. That token opens terminals in every organisation its
person is in, with the role they have on each server at the time; tunnel tickets send no organisation.

The sign-in stays on the device: sealed in the local cache under the LocalCacheKey (AAD resource type
18, bound to its row), never synced, wiped with the cache, and only ever sent to the Spelunk it came
from. A 401 from Spelunk forgets it; SIGN OUT ends it there and here, and so does signing out of
DodoSSH. Before every Spelunk connection DodoSSH asks its own identity provider whether its sign-in
still stands (a forced refresh, at most once a minute), and an account it refuses is signed out of
DodoSSH and of every Spelunk on the device.

A route names no key any more: Spelunk hosts are written at host schema 11, which an older build shows
read-only and asks to be updated for, and a payload that still names a key credential decodes with the
id skipped. The SpelunkKey item type is gone: SyncEntityType 14, ChangeEntityType 14 and AAD type 17
are retired, the server drops spelunk_key and its change-log rows, and the client cache drops its
cached items, outbox entries and conflicts of that type. A link still never starts a sign-in: from a
Spelunk this device is not signed in to it opens the editor, which offers to.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/DodoSSH.Client.App.Tests/FakeVaultServer.cs

@@ -122,6 +122,20 @@ internal sealed partial class FakeVaultServer : IVaultServer, IAccountApi, ISync
     /// <inheritdoc />
     public IVaultEventStream Events => Notices;
 
+    /// <summary>What the identity provider answers when the vault checks the sign-in, or null for yes.</summary>
+    /// <remarks>An <c>OidcException</c> with <c>invalid_grant</c> is an account the provider no longer signs in.</remarks>
+    public Exception? SignInRefusal { get; set; }
+
+    /// <summary>How many times the vault checked the sign-in.</summary>
+    public int SignInChecks { get; private set; }
+
+    /// <inheritdoc />
+    public Task VerifySignInAsync(CancellationToken cancellationToken)
+    {
+        SignInChecks++;
+        return SignInRefusal is { } refusal ? Task.FromException(refusal) : Task.CompletedTask;
+    }
+
     /// <summary>
     /// The relay a relayed host is reached through. Unavailable unless a test sets one, which is what a
     /// server that does not advertise the feature supplies.

tests/DodoSSH.Client.App.Tests/ShellFlowTests.Spelunk.cs

@@ -2,7 +2,9 @@ using System.Net;
 using System.Net.Sockets;
 using System.Net.WebSockets;
 using System.Text;
+using DodoSSH.Client.Auth;
 using DodoSSH.Client.Session;
+using DodoSSH.Client.Storage;
 using DodoSSH.Client.Shell.ViewModels;
 using DodoSSH.Client.Ssh;
 
@@ -19,22 +21,25 @@ namespace DodoSSH.Client.App.Tests;
 /// own HTTP and WebSocket half is <c>SpelunkTunnelTests</c>' job.
 /// </para>
 /// <para>
-/// What these hold is what the tick box and the link promise: a Spelunk host is never dialled directly and
-/// never probed, a refusal is said in Spelunk's terms, the key goes only where the host says, a sign-in
-/// connects with the tunnel's key and Spelunk's account and nothing of the host's, and a link connects
-/// straight away but never sends a key to a Spelunk no saved host already sends it to.
+/// What these hold is what the tick box, the sign-in and the link promise: a Spelunk host is never dialled
+/// directly and never probed, a refusal is said in Spelunk's terms, this device's sign-in to a Spelunk goes
+/// only to that Spelunk and only once DodoSSH's own account has been checked, a sign-in connects with the
+/// tunnel's key and Spelunk's account and nothing of the host's, and a link connects straight away but never
+/// starts a sign-in by itself.
 /// </para>
 /// </remarks>
 public sealed partial class ShellFlowTests
 {
     private const string SpelunkApi = "https://api.spelunk.example.com";
 
-    private const string SpelunkApiKey = "spelunk_0123456789abcdefghijklmnopqrstuvwxyzABCDEFG";
+    private const string SpelunkToken = "spelunkapp_0123456789abcdefghijklmnopqrstuvwxyzABCDEFG";
 
     private static readonly Guid SpelunkServer = Guid.Parse("0192f0c8-bbbb-7c3d-8e4f-5a6b7c8d9e0b");
 
     private readonly FakeSpelunkTunnel spelunkTunnels = new();
 
+    private readonly FakeSpelunkAccounts spelunkAccounts = new();
+
     [Fact]
     public async Task ASpelunkHost_IsDialledThroughTheTunnel_AndStillAsItself()
     {
@@ -43,9 +48,11 @@ public sealed partial class ShellFlowTests
         await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
         await vault.ConnectCommand.ExecuteAsync(null);
 
-        // The key from the credential, to the Spelunk and server the host names, for the host's own port.
+        // This device's sign-in, to the Spelunk and server the host names, for the host's own port — and only
+        // once DodoSSH's own account has been checked.
         var opened = spelunkTunnels.Opened.ShouldHaveSingleItem();
-        opened.ShouldBe((SpelunkApi, SpelunkServer, SpelunkApiKey, 22));
+        opened.ShouldBe((SpelunkApi, SpelunkServer, SpelunkToken, 22));
+        server.SignInChecks.ShouldBeGreaterThan(0);
 
         // Through the loopback proxy, and named as the host, because the name is what its key is pinned under.
         var request = ssh.Requests.ShouldHaveSingleItem();
@@ -127,23 +134,22 @@ public sealed partial class ShellFlowTests
     }
 
     [Fact]
-    public async Task ASpelunkHostWithNoKeyChosen_IsNotSaved()
+    public async Task AHostOnASpelunkThisDeviceIsNotSignedInTo_IsRefusedAtConnect_AndOffersTheSignIn()
     {
-        await UnlockedAsync();
-        var vault = shell.Vault!;
+        var vault = await ReadyToConnectThroughSpelunkAsync();
+        await vault.Session.SpelunkSignIns.ForgetAllAsync(Token);
+        await vault.ReloadSpelunkSignInsAsync(Token);
 
-        vault.NewHostCommand.Execute(null);
-        vault.EditorLabel = "web-01";
-        vault.EditorHostname = "203.0.113.10";
-        vault.EditorUsername = "deploy";
-        vault.EditorThroughSpelunk = true;
-        vault.EditorSpelunkApi = SpelunkApi;
-        vault.EditorSpelunkServerId = SpelunkServer.ToString();
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.ConnectCommand.ExecuteAsync(null);
 
-        await vault.SaveHostCommand.ExecuteAsync(null);
+        spelunkTunnels.Opened.ShouldBeEmpty();
+        ssh.Requests.ShouldBeEmpty();
+        vault.Status.ShouldNotBeNull().ShouldContain("not signed in there");
 
-        vault.Status.ShouldNotBeNull().ShouldContain("Spelunk API key");
-        vault.Hosts.ShouldBeEmpty();
+        vault.EditSelectedHostCommand.Execute(null);
+        vault.EditorSpelunkNeedsSignIn.ShouldBeTrue();
+        vault.EditorSpelunkSignInNote.ShouldContain("not signed in to Spelunk");
     }
 
     [Fact]
@@ -156,22 +162,8 @@ public sealed partial class ShellFlowTests
         vault.EditorThroughSpelunk.ShouldBeTrue();
         vault.EditorSpelunkApi.ShouldBe(SpelunkApi);
         vault.EditorSpelunkServerId.ShouldBe(SpelunkServer.ToString());
-        vault.EditorSelectedSpelunkKey.ShouldNotBeNull().Label.ShouldBe("spelunk key");
-    }
-
-    [Fact]
-    public async Task ACredentialHoldingASpelunkKey_IsInUse_WhereverThatIsDrawn()
-    {
-        // So deleting it is warned about like any other credential a host needs, rather than looking unused.
-        var vault = await ReadyToConnectThroughSpelunkAsync();
-
-        vault.ShowSectionCommand.Execute(VaultSection.All);
-        var row = vault.VaultItems.Single(item => string.Equals(item.Name, "spelunk key", StringComparison.Ordinal));
-
-        row.UsedBySummary.ShouldBe("web-01");
-
-        vault.SelectedVaultItem = row;
-        vault.SelectedItemUsedByHosts.ShouldHaveSingleItem().Label.ShouldBe("web-01");
+        vault.EditorSpelunkNeedsSignIn.ShouldBeFalse();
+        vault.EditorSpelunkSignInNote.ShouldContain("ops@example.com");
     }
 
     // ---- Signing in through Spelunk ----
@@ -188,7 +180,7 @@ public sealed partial class ShellFlowTests
         await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
         await vault.ConnectCommand.ExecuteAsync(null);
 
-        spelunkTunnels.Opened.ShouldHaveSingleItem().ShouldBe((SpelunkApi, SpelunkServer, SpelunkApiKey, 22));
+        spelunkTunnels.Opened.ShouldHaveSingleItem().ShouldBe((SpelunkApi, SpelunkServer, SpelunkToken, 22));
         var signIn = spelunkTunnels.SignIns.ShouldHaveSingleItem().ShouldNotBeNull();
         signIn.PublicKeyLine.ShouldStartWith("ssh-ed25519 ");
 
@@ -201,7 +193,7 @@ public sealed partial class ShellFlowTests
 
         shell.IsTerminalShowing.ShouldBeTrue();
         shell.Tabs.ShouldHaveSingleItem();
-        vault.Credentials.Count.ShouldBe(1, "nothing is remembered for a sign-in");
+        vault.Credentials.ShouldBeEmpty("nothing is remembered for a sign-in");
 
         await request.Proxy.Lifetime.DisposeAsync();
     }
@@ -319,11 +311,11 @@ public sealed partial class ShellFlowTests
         vault.EditorSpelunkApi.ShouldBe(SpelunkApi);
         vault.EditorSpelunkServerId.ShouldBe(SpelunkServer.ToString());
 
-        // No key chosen for a Spelunk no host already uses: the link named the address, and guessing a key
-        // for it would be offering to send the key wherever a link says.
-        vault.EditorSelectedSpelunkKey.ShouldBeNull();
-        vault.Status.ShouldNotBeNull().ShouldContain("first server");
+        // Not signed in to that Spelunk, and a link never starts a sign-in by itself: the editor offers it.
+        vault.EditorSpelunkNeedsSignIn.ShouldBeTrue();
+        vault.Status.ShouldNotBeNull().ShouldContain("Sign in to that Spelunk");
 
+        spelunkAccounts.SignedIn.ShouldBeEmpty();
         spelunkTunnels.Opened.ShouldBeEmpty();
         ssh.Requests.ShouldBeEmpty();
         vault.Hosts.ShouldBeEmpty("nothing is saved until the user saves it");
@@ -353,9 +345,11 @@ public sealed partial class ShellFlowTests
             chip => chip.Label.ShouldBe(VaultViewModel.SpelunkTag),
             chip => chip.IsWorn.ShouldBeTrue());
 
-        // So once it is saved, the next link for that server finds it rather than adding a second one.
-        await AddCredentialAsync(vault, "spelunk key", password: SpelunkApiKey);
-        vault.EditorSelectedSpelunkKey = vault.EditorSpelunkKeyChoices.Single(choice => choice.Label == "spelunk key");
+        // Signed in from the editor and saved, the next link for that server finds it rather than adding a
+        // second one.
+        await vault.SignInToEditorSpelunkCommand.ExecuteAsync(null);
+        spelunkAccounts.SignedIn.ShouldBe([SpelunkApi]);
+        vault.EditorSpelunkNeedsSignIn.ShouldBeFalse();
         await vault.SaveHostCommand.ExecuteAsync(null);
 
         await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
@@ -376,10 +370,10 @@ public sealed partial class ShellFlowTests
         await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
         await vault.OpenSpelunkLinkAsync(Link(host: null, server: other));
 
-        vault.IsEditing.ShouldBeFalse("nothing to choose: the key already goes to this Spelunk");
+        vault.IsEditing.ShouldBeFalse("nothing to choose: this device is signed in to this Spelunk");
 
-        // Saved as a host like any other: in the personal vault, tagged, signing in through Spelunk with the
-        // key that Spelunk already gets, and no login of its own.
+        // Saved as a host like any other: in the personal vault, tagged, signing in through Spelunk, and no
+        // login of its own.
         var added = vault.Hosts.Single(row => row.Host.Spelunk?.ServerId == other);
         added.VaultId.ShouldBe(vault.TargetVaults.Single(choice => choice.IsPersonal).VaultId);
         added.Label.ShouldBe("web 01");
@@ -387,7 +381,6 @@ public sealed partial class ShellFlowTests
         added.Host.Port.ShouldBe(22);
         added.Host.Spelunk!.ApiBase.ShouldBe(SpelunkApi);
         added.Host.Spelunk.SignInThroughSpelunk.ShouldBeTrue();
-        added.Host.Spelunk.ApiKeyCredentialId.ShouldBe(vault.Credentials.Single(row => row.Label == "spelunk key").EntityId);
         added.Host.SshKeyId.ShouldBeNull();
         added.Host.CredentialId.ShouldBeNull();
         added.Host.Username.ShouldBeNull();
@@ -395,7 +388,7 @@ public sealed partial class ShellFlowTests
 
         // And connected, through Spelunk, signing in.
         var opened = spelunkTunnels.Opened.ShouldHaveSingleItem();
-        opened.ShouldBe((SpelunkApi, other, SpelunkApiKey, 22));
+        opened.ShouldBe((SpelunkApi, other, SpelunkToken, 22));
         var signIn = spelunkTunnels.SignIns.ShouldHaveSingleItem().ShouldNotBeNull();
 
         var request = ssh.Requests.ShouldHaveSingleItem();
@@ -507,70 +500,45 @@ public sealed partial class ShellFlowTests
         vault.Status.ShouldNotBeNull().ShouldContain("Finish or cancel");
     }
 
-    // ---- A Spelunk key saved on the Security page ----
+    // ---- Signing this device in to Spelunk ----
 
     [Fact]
-    public async Task AKeySavedOnTheSecurityPage_LetsTheFirstLinkConnectStraightAway()
+    public async Task ASignInOnTheSecurityPage_LetsTheFirstLinkConnectStraightAway()
     {
         await UnlockedAsync();
         var vault = shell.Vault!;
 
-        await SaveSpelunkKeyAsync(vault, SpelunkApi + "/", SpelunkApiKey);
+        await SignInToSpelunkAsync(vault, SpelunkApi + "/");
 
-        // Saved in the one form, in the personal vault, and gone from the form.
-        var saved = vault.SpelunkKeys.ShouldHaveSingleItem();
-        saved.ApiBase.ShouldBe(SpelunkApi);
-        saved.VaultId.ShouldBe(vault.TargetVaults.Single(choice => choice.IsPersonal).VaultId);
-        vault.SpelunkKeyFormKey.ShouldBeEmpty();
+        // Signed in through the browser, for the address in its one form, and kept on this device.
+        spelunkAccounts.SignedIn.ShouldBe([SpelunkApi]);
+        var signedIn = vault.SpelunkSignIns.ShouldHaveSingleItem();
+        signedIn.ApiBase.ShouldBe(SpelunkApi);
+        signedIn.Who.ShouldContain("ops@example.com");
+        vault.SpelunkSignInFormNote.ShouldContain("Signed in");
 
         await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
         await vault.OpenSpelunkLinkAsync(Link(host: "203.0.113.10"));
 
-        vault.IsEditing.ShouldBeFalse("saving the key for this Spelunk is the say-so the first link used to ask for");
+        vault.IsEditing.ShouldBeFalse("signing in to this Spelunk is the say-so a link needs");
 
         var added = vault.Hosts.ShouldHaveSingleItem();
-        added.Host.Spelunk.ShouldNotBeNull().ApiKeyCredentialId.ShouldBe(saved.EntityId);
         added.Host.SignsInThroughSpelunk.ShouldBeTrue();
 
-        spelunkTunnels.Opened.ShouldHaveSingleItem().ShouldBe((SpelunkApi, SpelunkServer, SpelunkApiKey, 22));
+        spelunkTunnels.Opened.ShouldHaveSingleItem().ShouldBe((SpelunkApi, SpelunkServer, SpelunkToken, 22));
 
         await ssh.Requests.ShouldHaveSingleItem().Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
     }
 
     [Fact]
-    public async Task ASecondKeyForTheSameSpelunk_ReplacesTheFirst_AndHostsUseTheNewOne()
+    public async Task ASignIn_IsNeverSentToAnotherSpelunk()
     {
         await UnlockedAsync();
         var vault = shell.Vault!;
 
-        await SaveSpelunkKeyAsync(vault, SpelunkApi, "spelunk_the_old_key");
+        await SignInToSpelunkAsync(vault, SpelunkApi);
 
-        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
-        await vault.OpenSpelunkLinkAsync(Link());
-        await ssh.Requests.ShouldHaveSingleItem().Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
-
-        await SaveSpelunkKeyAsync(vault, SpelunkApi, SpelunkApiKey);
-
-        vault.SpelunkKeys.ShouldHaveSingleItem().UsedBy.ShouldBe("1 host uses it");
-        vault.SpelunkKeyFormNote.ShouldContain("Replaced");
-
-        await vault.OpenSpelunkLinkAsync(Link());
-
-        spelunkTunnels.Opened.Select(opened => opened.ApiKey).ShouldBe(["spelunk_the_old_key", SpelunkApiKey]);
-
-        await ssh.Requests[1].Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
-    }
-
-    [Fact]
-    public async Task ASavedKey_IsNeverSentToAnotherSpelunk()
-    {
-        await UnlockedAsync();
-        var vault = shell.Vault!;
-
-        await SaveSpelunkKeyAsync(vault, SpelunkApi, SpelunkApiKey);
-        var saved = vault.SpelunkKeys.ShouldHaveSingleItem();
-
-        // A host that names the key but another address — the one thing a key kept with its address refuses.
+        // A host on a Spelunk this device did not sign in to: the sign-in it has is for somewhere else.
         vault.NewHostCommand.Execute(null);
         vault.EditorLabel = "web-01";
         vault.EditorHostname = "203.0.113.10";
@@ -578,7 +546,7 @@ public sealed partial class ShellFlowTests
         vault.EditorSpelunkSignIn = true;
         vault.EditorSpelunkApi = "https://spelunk.somewhere-else.example";
         vault.EditorSpelunkServerId = SpelunkServer.ToString();
-        vault.EditorSelectedSpelunkKey = vault.EditorSpelunkKeyChoices.Single(choice => choice.EntityId == saved.EntityId);
+        vault.EditorSpelunkNeedsSignIn.ShouldBeTrue();
         await vault.SaveHostCommand.ExecuteAsync(null);
 
         vault.SelectedHost = vault.Hosts.ShouldHaveSingleItem(vault.Status);
@@ -588,85 +556,171 @@ public sealed partial class ShellFlowTests
 
         spelunkTunnels.Opened.ShouldBeEmpty();
         ssh.Requests.ShouldBeEmpty();
-        vault.Status.ShouldNotBeNull().ShouldContain("never sent anywhere else");
+        vault.Status.ShouldNotBeNull().ShouldContain("not signed in there");
     }
 
     [Fact]
-    public async Task TypingTheAddressOfASavedKey_PicksThatKey_InTheEditor()
+    public async Task AnAddressThatWouldSendTheSignInInClear_IsRefusedOnTheForm()
     {
         await UnlockedAsync();
         var vault = shell.Vault!;
 
-        await AddCredentialAsync(vault, "an older key", password: "spelunk_older");
-        await SaveSpelunkKeyAsync(vault, SpelunkApi, SpelunkApiKey);
+        await SignInToSpelunkAsync(vault, "http://api.spelunk.example.com");
+
+        spelunkAccounts.SignedIn.ShouldBeEmpty("no browser is opened for an address that would be refused");
+        vault.SpelunkSignIns.ShouldBeEmpty();
+        vault.SpelunkSignInFormNote.ShouldContain("https");
+    }
+
+    [Fact]
+    public async Task ASignInCancelledInTheBrowser_IsSaid_AndNothingIsKept()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        spelunkAccounts.Refusal = new SpelunkSignInException("Signing in to Spelunk was cancelled in the browser.");
+        await SignInToSpelunkAsync(vault, SpelunkApi);
+
+        vault.SpelunkSignIns.ShouldBeEmpty();
+        vault.SpelunkSignInFormNote.ShouldContain("cancelled in the browser");
+        vault.IsSigningInToSpelunk.ShouldBeFalse();
+    }
+
+    [Fact]
+    public async Task TheEditor_SaysWhoItReachesSpelunkAs_AndSignsInFromThere()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
 
         vault.NewHostCommand.Execute(null);
         vault.EditorThroughSpelunk = true;
         vault.EditorSpelunkApi = SpelunkApi + "/";
 
-        var chosen = vault.EditorSelectedSpelunkKey.ShouldNotBeNull();
-        chosen.EntityId.ShouldBe(vault.SpelunkKeys.Single().EntityId);
-        chosen.Qualifier.ShouldBe($"Spelunk key · {SpelunkApi}");
+        vault.EditorSpelunkNeedsSignIn.ShouldBeTrue();
 
-        // Saved keys come before credentials, which stay on offer for keys kept the older way.
-        vault.EditorSpelunkKeyChoices.Select(choice => choice.Label)
-            .ShouldBe(["Spelunk at api.spelunk.example.com", "an older key"]);
+        await vault.SignInToEditorSpelunkCommand.ExecuteAsync(null);
+
+        spelunkAccounts.SignedIn.ShouldBe([SpelunkApi]);
+        vault.EditorSpelunkNeedsSignIn.ShouldBeFalse();
+        vault.SpelunkSignIns.ShouldHaveSingleItem();
     }
 
     [Fact]
-    public async Task AnAddressThatWouldSendTheKeyInClear_IsRefusedOnTheForm()
+    public async Task SpelunkSigningThisDeviceOut_ForgetsTheSignIn_SoTheNextConnectAsksForANewOne()
     {
-        await UnlockedAsync();
-        var vault = shell.Vault!;
+        spelunkTunnels.Refusal = new SpelunkTunnelException(
+            "Spelunk signed this device out: your password changed.", HttpStatusCode.Unauthorized);
 
-        await SaveSpelunkKeyAsync(vault, "http://api.spelunk.example.com", SpelunkApiKey);
-
-        vault.SpelunkKeys.ShouldBeEmpty();
-        vault.SpelunkKeyFormNote.ShouldContain("https");
-        vault.SpelunkKeyFormKey.ShouldBe(SpelunkApiKey, "a refused key stays in the box to be saved once the address is fixed");
-    }
-
-    [Fact]
-    public async Task DeletingASavedKey_SaysWhichHostsWillStopConnecting()
-    {
-        await UnlockedAsync();
-        var vault = shell.Vault!;
-
-        await SaveSpelunkKeyAsync(vault, SpelunkApi, SpelunkApiKey);
+        var vault = await ReadyToConnectThroughSpelunkAsync();
 
         await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
-        await vault.OpenSpelunkLinkAsync(Link());
-        await ssh.Requests.ShouldHaveSingleItem().Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
+        await vault.ConnectCommand.ExecuteAsync(null);
 
-        vault.DeleteSpelunkKeyRowCommand.Execute(vault.SpelunkKeys.Single());
+        vault.Status.ShouldNotBeNull().ShouldContain("signed this device out");
+        vault.SpelunkSignIns.ShouldBeEmpty();
+        (await vault.Session.SpelunkSignIns.ListAsync(Token)).ShouldBeEmpty();
 
-        var request = vault.PendingDeletion.ShouldNotBeNull();
-        request.Usage.ShouldContain("web 01 reaches Spelunk with it");
-
-        await vault.ConfirmDeleteCommand.ExecuteAsync(null);
-
-        vault.SpelunkKeys.ShouldBeEmpty();
-
-        await vault.ConnectToRowCommand.ExecuteAsync(vault.Hosts.Single());
-        vault.Status.ShouldNotBeNull().ShouldContain("not in this keychain any more");
+        // The next attempt does not repeat the refusal: it asks to sign in.
+        spelunkTunnels.Refusal = null;
+        await vault.ConnectCommand.ExecuteAsync(null);
+        spelunkTunnels.Opened.Count.ShouldBe(1);
+        vault.Status.ShouldNotBeNull().ShouldContain("not signed in there");
     }
 
-    private static async Task SaveSpelunkKeyAsync(VaultViewModel vault, string apiBase, string apiKey)
+    [Fact]
+    public async Task AServerOrOrganisationSpelunkRefuses_KeepsTheSignIn()
     {
-        vault.SpelunkKeyFormApi = apiBase;
-        vault.SpelunkKeyFormKey = apiKey;
+        // A 403 is about this server, not about who is signed in: every other server stays reachable.
+        spelunkTunnels.Refusal = new SpelunkTunnelException(
+            "You are not allowed to open a terminal on this server.", HttpStatusCode.Forbidden);
 
-        await vault.SaveSpelunkKeyCommand.ExecuteAsync(null);
+        var vault = await ReadyToConnectThroughSpelunkAsync();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.ConnectCommand.ExecuteAsync(null);
+
+        vault.Status.ShouldNotBeNull().ShouldContain("not allowed");
+        vault.SpelunkSignIns.ShouldHaveSingleItem();
     }
 
-    /// <summary>A saved host through Spelunk, bound to a stored SSH password, with its key in the keychain.</summary>
+    [Fact]
+    public async Task ADodoSshAccountTheProviderRefuses_ReachesNoSpelunk_AndSignsThisDeviceOut()
+    {
+        var vault = await ReadyToConnectThroughSpelunkAsync();
+
+        server.SignInRefusal = new OidcException("The account is disabled.", "invalid_grant");
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.ConnectCommand.ExecuteAsync(null);
+
+        spelunkTunnels.Opened.ShouldBeEmpty("Spelunk is not reached for an account DodoSSH no longer has");
+        ssh.Requests.ShouldBeEmpty();
+        vault.Status.ShouldNotBeNull().ShouldContain("no longer signs in");
+
+        // Signed out of every Spelunk, there and here, and of DodoSSH: offline, and saying why.
+        spelunkAccounts.SignedOut.ShouldBe([SpelunkToken]);
+        vault.SpelunkSignIns.ShouldBeEmpty();
+        shell.IsOnline.ShouldBeFalse();
+        vault.OfflineReason.ShouldNotBeNull().ShouldContain("refused");
+    }
+
+    [Fact]
+    public async Task ADodoSshSignInThatCannotBeChecked_ReachesNoSpelunk_ButIsKept()
+    {
+        var vault = await ReadyToConnectThroughSpelunkAsync();
+
+        server.SignInRefusal = new HttpRequestException("The identity provider could not be reached.");
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.ConnectCommand.ExecuteAsync(null);
+
+        spelunkTunnels.Opened.ShouldBeEmpty();
+        vault.Status.ShouldNotBeNull().ShouldContain("could not check");
+        vault.SpelunkSignIns.ShouldHaveSingleItem("a provider that is down is not an account that is gone");
+        shell.IsOnline.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task SigningOutOfSpelunk_OnTheSecurityPage_EndsItThereAndHere()
+    {
+        var vault = await ReadyToConnectThroughSpelunkAsync();
+
+        await vault.SignOutOfSpelunkCommand.ExecuteAsync(vault.SpelunkSignIns.Single());
+
+        spelunkAccounts.SignedOut.ShouldBe([SpelunkToken]);
+        vault.SpelunkSignIns.ShouldBeEmpty();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.ConnectCommand.ExecuteAsync(null);
+        spelunkTunnels.Opened.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task SigningOutOfDodoSsh_SignsOutOfEverySpelunk()
+    {
+        await ReadyToConnectThroughSpelunkAsync();
+
+        shell.SignOutCommand.Execute(null);
+        await shell.ConfirmSignOutCommand.ExecuteAsync(null);
+
+        spelunkAccounts.SignedOut.ShouldBe([SpelunkToken]);
+    }
+
+    private static async Task SignInToSpelunkAsync(VaultViewModel vault, string apiBase)
+    {
+        vault.SpelunkSignInFormApi = apiBase;
+
+        await vault.SignInToSpelunkCommand.ExecuteAsync(null);
+    }
+
+    /// <summary>A saved host through Spelunk, bound to a stored SSH password, on a Spelunk this device is signed in to.</summary>
     private async Task<VaultViewModel> ReadyToConnectThroughSpelunkAsync()
     {
         await UnlockedAsync();
 
         var vault = shell.Vault!;
 
-        await AddCredentialAsync(vault, "spelunk key", password: SpelunkApiKey);
+        await SignInToSpelunkAsync(vault, SpelunkApi);
         await AddCredentialAsync(vault, "deploy password", password: "s3cret", username: "deploy");
 
         vault.NewHostCommand.Execute(null);
@@ -676,7 +730,6 @@ public sealed partial class ShellFlowTests
         vault.EditorThroughSpelunk = true;
         vault.EditorSpelunkApi = SpelunkApi + "/";
         vault.EditorSpelunkServerId = SpelunkServer.ToString();
-        vault.EditorSelectedSpelunkKey = vault.EditorSpelunkKeyChoices.Single(choice => choice.Label == "spelunk key");
         vault.EditorSelectedAuthentication = vault.EditorAuthenticationChoices
             .Single(choice => choice.Label == "deploy password");
 
@@ -697,7 +750,7 @@ public sealed partial class ShellFlowTests
 
         var vault = shell.Vault!;
 
-        await AddCredentialAsync(vault, "spelunk key", password: SpelunkApiKey);
+        await SignInToSpelunkAsync(vault, SpelunkApi);
 
         vault.NewHostCommand.Execute(null);
         vault.EditorLabel = "web-01";
@@ -706,7 +759,6 @@ public sealed partial class ShellFlowTests
         vault.EditorSpelunkSignIn = true;
         vault.EditorSpelunkApi = SpelunkApi;
         vault.EditorSpelunkServerId = SpelunkServer.ToString();
-        vault.EditorSelectedSpelunkKey = vault.EditorSpelunkKeyChoices.Single(choice => choice.Label == "spelunk key");
 
         await vault.SaveHostCommand.ExecuteAsync(null);
 
@@ -748,7 +800,7 @@ public sealed partial class ShellFlowTests
     /// </summary>
     private sealed class FakeSpelunkTunnel : ISpelunkTunnel
     {
-        internal List<(string ApiBase, Guid ServerId, string ApiKey, int Port)> Opened { get; } = [];
+        internal List<(string ApiBase, Guid ServerId, string Token, int Port)> Opened { get; } = [];
 
         /// <summary>The sign-in key each tunnel was asked for, in order; null for a plain tunnel.</summary>
         internal List<SpelunkSignIn?> SignIns { get; } = [];
@@ -764,12 +816,12 @@ public sealed partial class ShellFlowTests
         public async Task<SpelunkTunnelRoute> OpenAsync(
             string apiBase,
             Guid serverId,
-            string apiKey,
+            string token,
             int port,
             SpelunkSignIn? signIn,
             CancellationToken cancellationToken)
         {
-            Opened.Add((apiBase, serverId, apiKey, port));
+            Opened.Add((apiBase, serverId, token, port));
             SignIns.Add(signIn);
 
             if (Refusal is { } refusal)
@@ -806,4 +858,32 @@ public sealed partial class ShellFlowTests
                     new WebSocketCreationOptions { IsServer = true, KeepAliveInterval = TimeSpan.Zero }));
         }
     }
+
+    /// <summary>Signing in to Spelunk as far as the shell can see it: no browser, a sign-in or a refusal.</summary>
+    private sealed class FakeSpelunkAccounts : ISpelunkAccounts
+    {
+        /// <summary>The Spelunks a sign-in was asked for, in order.</summary>
+        internal List<string> SignedIn { get; } = [];
+
+        /// <summary>The tokens that were signed out, in order.</summary>
+        internal List<string> SignedOut { get; } = [];
+
+        internal SpelunkSignInException? Refusal { get; set; }
+
+        public Task<SpelunkSignInRecord> SignInAsync(string apiBase, CancellationToken cancellationToken)
+        {
+            SignedIn.Add(apiBase);
+
+            return Refusal is { } refusal
+                ? Task.FromException<SpelunkSignInRecord>(refusal)
+                : Task.FromResult(new SpelunkSignInRecord(
+                    apiBase, SpelunkToken, Guid.CreateVersion7(), "ops@example.com", "Ops", DateTimeOffset.UtcNow));
+        }
+
+        public Task SignOutAsync(SpelunkSignInRecord signIn, CancellationToken cancellationToken)
+        {
+            SignedOut.Add(signIn.Token);
+            return Task.CompletedTask;
+        }
+    }
 }

tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs

@@ -228,9 +228,10 @@ public sealed partial class ShellFlowTests : IAsyncLifetime
             // the wall clock.
             reachability: reachability,
 
-            // Scripted for the same reason: a Spelunk host's connect never leaves the process. See
-            // ShellFlowTests.Spelunk.cs.
-            spelunk: spelunkTunnels);
+            // Scripted for the same reason: a Spelunk host's connect never leaves the process, and signing in
+            // to Spelunk opens no browser. See ShellFlowTests.Spelunk.cs.
+            spelunk: spelunkTunnels,
+            spelunkAccounts: spelunkAccounts);
 
         return ValueTask.CompletedTask;
     }