One sign-in for decePubClient: the root JWT exchanged for a persona's token

The first-party client signs in on /clientapi and exchanges that JWT on
/oauth/token (RFC 8693, subject_token_type jwt, avatar_id) for one
persona's Mastodon token. Only the seeded public application `decepub`
holds the grant; RootJwtSubjectToken validates the JWT through RootJwt,
which JwtBearer now shares (signature, lifetime, ban, deletion, session
stamp). The issued token names the avatar, never the root.

Owner decision recorded in ROADMAP; it supersedes "moving decePubClient
onto the Mastodon API is out of scope".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub/Api/Mastodon/Auth/TokenController.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore;
+using Microsoft.AspNetCore;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.IdentityModel.Tokens;
@@ -48,9 +48,33 @@ namespace PrivaPub.Api.Mastodon.Auth
 				return SignIn(new ClaimsPrincipal(identity), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
 			}
 
+			if (request.IsTokenExchangeGrantType())
+				return await Persona(request, token);
+
 			return Refuse(Errors.UnsupportedGrantType, "The grant type is not supported.");
 		}
 
+		//PersonaExchange: the root JWT, validated by RootJwtSubjectToken, for a token of one of the root's personas
+		async Task<IActionResult> Persona(OpenIddictRequest request, CancellationToken token)
+		{
+			var subject = (await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)).Principal;
+			var rootId = subject?.GetClaim(PersonaExchange.RootClaim);
+			var avatarId = (string)request[PersonaExchange.AvatarParameter];
+			if (string.IsNullOrEmpty(rootId) || string.IsNullOrEmpty(avatarId))
+				return Refuse(Errors.InvalidGrant, "The persona can no longer be used.");
+			var owns = await _dbEntities.RootToAvatars.Match(r => r.RootId == rootId && r.AvatarId == avatarId).ExecuteAnyAsync(token);
+			var avatar = owns ? await _dbEntities.Avatars.MatchID(avatarId).ExecuteFirstAsync(token) : default;
+			if (avatar == default || !await Usable(avatarId, token))
+				return Refuse(Errors.InvalidGrant, "The persona can no longer be used.");
+
+			var identity = new ClaimsIdentity(TokenValidationParameters.DefaultAuthenticationType, Claims.Name, Claims.Role);
+			identity.SetClaim(Claims.Subject, avatar.ID);
+			identity.SetClaim(Claims.Name, avatar.UserName);
+			identity.SetScopes(MastodonScopes.Parse(request.Scope).Intersect(new[] { "read", "write", "follow" }));
+			identity.SetDestinations(_ => new[] { Destinations.AccessToken });
+			return SignIn(new ClaimsPrincipal(identity), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
+		}
+
 		async Task<bool> Usable(string avatarId, CancellationToken token)
 		{
 			if (string.IsNullOrEmpty(avatarId))