Problem

src/idp/interactions.js is 662 lines handling complex OIDC interaction logic in one file.

Current structure (approximate):

• Lines 1-50: Imports and setup
• Lines 50-150: Login interaction handling
• Lines 150-250: Registration flow
• Lines 250-350: Consent/confirmation screens
• Lines 350-450: Callback handling
• Lines 450-550: Session management
• Lines 550-662: View rendering helpers

Issues:

1. Hard to navigate - finding specific interaction logic requires scrolling
2. Mixed concerns - UI rendering mixed with business logic
3. Difficult to test individual flows
4. Complex state machine implicit in code

Proposed Solution

Split into focused modules:

src/idp/
  ├── index.js            (plugin entry, unchanged)
  ├── provider.js         (OIDC provider setup, unchanged)
  ├── interactions/
  │   ├── index.js        (router/dispatcher)
  │   ├── login.js        (login flow)
  │   ├── register.js     (registration flow)
  │   ├── consent.js      (consent/confirmation)
  │   ├── callback.js     (OAuth callbacks)
  │   └── session.js      (session management)
  └── views.js            (HTML rendering, unchanged)

Example split:

// interactions/login.js
export async function handleLogin(ctx, provider) {
  const { prompt, params } = await provider.interactionDetails(ctx.req, ctx.res);
  // ... login-specific logic
}

// interactions/index.js
import { handleLogin } from './login.js';
import { handleRegister } from './register.js';
import { handleConsent } from './consent.js';

export function setupInteractions(fastify, provider) {
  fastify.get('/idp/interaction/:uid', async (request, reply) => {
    const details = await provider.interactionDetails(request.raw, reply.raw);
    
    switch (details.prompt.name) {
      case 'login': return handleLogin(details, provider, request, reply);
      case 'consent': return handleConsent(details, provider, request, reply);
      // ...
    }
  });
}

Benefits

• Each interaction flow in its own file (~100-150 lines)
• Easier to understand individual flows
• Can test login without loading consent code
• Clear separation of interaction types

Files Affected

• Split: src/idp/interactions.js → src/idp/interactions/*.js
• Minor: src/idp/index.js (import path change)

Priority

P3 - Low priority, IDP-specific improvement