fix(e2e): repair badge-disclosure gated join; prove the GitHub-badge gate

The gated-join happy path was silently broken by SDK drift: @ministryofmany/client
now pins each badge-VC key to the issuer did:web document's assertionMethod
(fetched from /.well-known/did.json, kid-scoped so the id_token key cannot
attest a badge) and binds each badge to the login via the pairwise subject DID
`did:web:<host>:u:<id_token sub>`. The e2e mock issuer still served only
/.well-known/jwks.json and minted VC subjects as `...:users:<sanitized-sub>`,
so EVERY disclosed badge landed in `rejected` (fail-closed) and no badge-gated
join could complete - the whole disclosure path was dead end to end, unnoticed
because e2e is not in CI.

Fix the mock to Minister's post-MIN-1 contract:
  - serve /.well-known/did.json with the badge key in assertionMethod;
  - mint the badge subject as `did:web:<host>:u:<raw id_token sub>`;
  - stamp the coarse issuanceMonth claim for disclosure fidelity.

Add e2e/09: a user disclosing an oauth-account (provider=github) badge joins
the github-devs sub-forum and gets the github-dev role - the happy-path
counterpart to the spec-08 deny, exercising the full authorize-with-badge-scope
-> disclose -> verify -> gate -> membership path (task #40).

Author: AtHeartEngineer

e2e/09-github-badge-join.spec.ts

@@ -0,0 +1,45 @@
+// SPEC 9: JOIN the GitHub-verified-devs sub-forum by DISCLOSING a GitHub badge
+// (the happy path of the badge-disclosure gate).
+//
+// The counterpart to spec 8a (deny): there, a user disclosing only an
+// email-domain badge is REJECTED from github-devs. Here the user discloses the
+// required oauth-account (provider=github) badge, so the whole disclosure path
+// runs green end to end:
+//
+//   /api/auth/oidc/start?subforum=github-devs&role=github-dev
+//     -> the role's policy { badge: oauth-account, where: { provider: github } }
+//        rides along as `minister_policy` and adds the `badge:oauth-account`
+//        scope, so the mock issuer discloses exactly that badge (minimal set);
+//   -> the callback re-verifies the id_token + the disclosed VC and stashes a
+//        single-use pending-join;
+//   -> the join page derives this device's per-sub-forum Semaphore identity
+//        client-side and POSTs it, and the server re-runs the gate on the
+//        VERIFIED disclosure, admits the user, and records the github-dev role.
+//
+// This is the end-to-end proof that a user WITH a GitHub badge can join the
+// GitHub-gated forum (task #40), complementing the DB-level gate coverage in
+// tests/join.int.test.ts and the browser deny path in spec 8.
+
+import { test, expect } from '@playwright/test';
+import { joinSubforum } from './harness/helpers';
+import { GITHUB_SLUG, GITHUB_ROLE } from './harness/env';
+
+test('joins github-devs by disclosing a GitHub oauth-account badge', async ({ page }) => {
+	await joinSubforum(page, {
+		email: 'join-dev@acme.example',
+		badges: ['oauth-account'],
+		slug: GITHUB_SLUG,
+		role: GITHUB_ROLE,
+		pseudonym: 'OctoJoiner'
+	});
+
+	// The confirmation shows the chosen pseudonym + the verified github-dev role
+	// pill (the gate passed on the disclosed, re-verified GitHub badge).
+	await expect(page.getByText('OctoJoiner', { exact: false })).toBeVisible();
+	await expect(page.getByText('verified roles:')).toBeVisible();
+	await expect(page.getByText(GITHUB_ROLE, { exact: true })).toBeVisible();
+
+	// Following through lands the now-member on the sub-forum page.
+	await page.getByRole('link', { name: `Go to ${GITHUB_SLUG}` }).click();
+	await expect(page).toHaveURL(new RegExp(`/s/${GITHUB_SLUG}`));
+});

e2e/mock-oidc/issuer.ts

@@ -49,6 +49,34 @@ async function jwks(port: number): Promise<{ keys: JWK[] }> {
 	return { keys: [{ ...publicJwk, alg: 'EdDSA', use: 'sig', kid: kidForPort(port) }] };
 }
 
+/**
+ * The did:web DID document served at `/.well-known/did.json`. @ministryofmany/client
+ * pins each badge-VC signing key to the issuer DID document's `assertionMethod`
+ * (NOT the OIDC JWKS) - it resolves the key by the VC `kid` from here and REJECTS
+ * any kid not listed, so the id_token key can never attest a badge. Without this
+ * document every disclosed badge fails closed with a did.json-fetch error, and no
+ * badge-gated join can complete. This mock signs the id_token AND the badge VCs
+ * with one key, so its single kid is the sole `assertionMethod` entry.
+ */
+async function didDocument(port: number): Promise<Record<string, unknown>> {
+	publicJwk ??= await exportJWK(publicKey);
+	const did = vcIssuerForPort(port);
+	const kid = kidForPort(port);
+	return {
+		'@context': ['https://www.w3.org/ns/did/v1', 'https://w3id.org/security/suites/jws-2020/v1'],
+		id: did,
+		verificationMethod: [
+			{
+				id: kid,
+				type: 'JsonWebKey2020',
+				controller: did,
+				publicKeyJwk: { ...publicJwk, alg: 'EdDSA', use: 'sig', kid }
+			}
+		],
+		assertionMethod: [kid]
+	};
+}
+
 export interface MockBadge {
 	type: string;
 	attributes: Record<string, string | number | boolean>;
@@ -66,16 +94,36 @@ function badgeTypeToCredType(type: string): string {
 	return `Minister${pascal}Credential`;
 }
 
-async function signVc(userId: string, badge: MockBadge, port: number): Promise<string> {
+/** The UTC calendar month ("YYYY-MM") of a unix-seconds instant - Minister's
+ *  coarse `credentialSubject.issuanceMonth` disclosure bucket. */
+function issuanceMonthOf(sec: number): string {
+	return new Date(sec * 1000).toISOString().slice(0, 7);
+}
+
+/**
+ * Sign a badge VC bound to the login. Post-MIN-1 Minister re-mints each
+ * disclosed badge under the per-RP PAIRWISE subject DID `did:web:<host>:u:<sub>`
+ * - the SAME pairwise `sub` it stamps as the id_token subject - and the SDK's
+ * holder-binding requires `credentialSubject.id === did:web:<host>:u:<id_token
+ * sub>` (see @ministryofmany/client verify-badges). The subject MUST therefore be
+ * built from the RAW id_token `sub`, not a sanitized handle, or every badge
+ * lands in `rejected` (fail-closed) and no gated join can succeed. `iat` is the
+ * disclosure instant; the only issuance residue is the coarse `issuanceMonth`.
+ */
+async function signVc(sub: string, badge: MockBadge, port: number): Promise<string> {
 	const nowSec = Math.floor(Date.now() / 1000);
 	const iatSec = badge.expired ? nowSec - 120 : nowSec - 10;
 	const vcIssuer = vcIssuerForPort(port);
-	const subjectId = `${vcIssuer}:users:${userId}`;
+	const subjectId = `${vcIssuer}:u:${sub}`;
 	return new SignJWT({
 		vc: {
 			'@context': ['https://www.w3.org/ns/credentials/v2'],
 			type: ['VerifiableCredential', badgeTypeToCredType(badge.type)],
-			credentialSubject: { id: subjectId, ...badge.attributes }
+			credentialSubject: {
+				id: subjectId,
+				...badge.attributes,
+				issuanceMonth: issuanceMonthOf(iatSec)
+			}
 		}
 	})
 		.setProtectedHeader({ alg: 'EdDSA', kid: kidForPort(port), typ: 'vc+jwt' })
@@ -97,15 +145,14 @@ export interface MintOpts {
 	name?: string;
 	badges?: MockBadge[];
 	nonce?: string;
-	userId?: string;
 }
 
-/** Mint an id_token directly (non-browser checks). */
+/** Mint an id_token directly (non-browser checks). Each disclosed badge is
+ *  bound to the pairwise `sub` per the post-MIN-1 holder-binding contract. */
 export async function mintIdToken(opts: MintOpts): Promise<string> {
-	const userId = opts.userId ?? opts.sub.replace(/[^a-zA-Z0-9]/g, '');
 	const port = Number(new URL(opts.issuer).port);
 	const minister_badges = await Promise.all(
-		(opts.badges ?? []).map((b) => signVc(userId, b, port))
+		(opts.badges ?? []).map((b) => signVc(opts.sub, b, port))
 	);
 	return new SignJWT({
 		nonce: opts.nonce,
@@ -311,6 +358,13 @@ async function handle(req: IncomingMessage, res: ServerResponse, issuer: string)
 		return json(res, await jwks(port));
 	}
 
+	// The did:web DID document. @ministryofmany/client resolves the badge-VC key
+	// from this document's assertionMethod (kid-pinned), so a gated join that
+	// discloses a badge fails closed without it.
+	if (path === '/.well-known/did.json') {
+		return json(res, await didDocument(port));
+	}
+
 	if (path === '/oidc/authorize') return authorize(req, res, url);
 	if (path === '/oidc/approve') return approve(req, res);
 	if (path === '/oidc/token') return token(req, res, issuer);