Module sso 

Silent session refresh through the GrabID SSO cookie (grab auth refresh).

gfc_session (food.grab.com, 2 h) carries no refresh token, and POST /auth/access-token only echoes the token of a live gfc_session (docs/login.md §1). The only way to a fresh gfc_session without a challenge is the browser’s own silent OAuth round trip, done here over plain HTTP in ONE cookie jar so the PKCE state food stores in its anonymous gfc_session is carried to the callback:

1. GET food.grab.com/auth/login → 302 to …/oauth2/authorize and a new anonymous gfc_session holding the PKCE verifier/state/nonce.
2. GET authorize with the .grab.com SSO cookie (grabid-openid-authn-ck):
   • 302 to food.grab.com/auth/callback?code&state → step 3;
   • 302 to weblogin with auth_cookie_exists=true (the “Continue as …” screen) → re-issue authorize with user_selection_done=true& remember_me=true, as that button does (a top-level navigation, no captcha involved) → expect the callback;
   • weblogin without auth_cookie_exists → the SSO session is dead: auth_expired, run grab auth login.
3. GET callback → food exchanges the code server-side and sets the logged-in gfc_session.

GrabMart has its own OAuth client (mart.grab.com/grab-id/login → authorize → mart.grab.com/grab-id/token); silent_login runs the same round trip for it (Service::Mart). A consent screen (weblogin.grab.com/consent) stops the flow: only the user may approve it.

No challenge (OTP, push, captcha) can be triggered by this path. Every hop is checked against a fixed allowlist; redirects are never followed blindly. Nothing here logs cookie values, codes or tokens.

Enums

Hop

Where a redirect points during the silent round trip.

Service

A web app with its own GrabID OAuth client that the SSO cookie can log in silently.

Constants

FOOD_CALLBACK

FOOD_LOGIN

MART_CALLBACK

MART_LOGIN

GrabMart’s own OAuth client (scope martweb-protected): the protected mart API doesn’t accept food’s gfc_session.

SSO_COOKIE

The SSO cookie the IdP reads on authorize.

Functions

allowlist

The only URLs the refresh may touch.

classify_hop

classify_hop_for

classify_hop for service’s callback.

mart_session_cookies

Names of the mart.grab.com session cookies in session (whatever the mart callback set, minus known bookkeeping cookies). Names only.

silent_login

Run the silent SSO round trip for service (see the module docs): its login URL → GrabID authorize (with the SSO cookie) → its callback, all in one cookie jar. Never sends a challenge. On failure session is left untouched.

silent_refresh

Run the silent round trip for food. On success session holds a logged-in gfc_session (and any re-issued SSO cookies). On failure session is left untouched.

with_account_selected

authorize URL plus what the “Continue as …” button adds.