@b3dotfun/sdk 0.1.70-alpha.21 → 0.1.70-alpha.22

package/src/anyspend/react/components/__tests__/AnySpendDeposit.isDepositMode.test.tsx

@@ -0,0 +1,117 @@
+import { USDC_BASE } from "@b3dotfun/sdk/anyspend";
+import { render } from "@testing-library/react";
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+
+/**
+ * Regression test for fix round 2: `AnySpendDeposit` backs 15+ funding modals that are all
+ * source-exact-in (b3os-web's InsufficientBalanceModal, GasBalanceWarningModal,
+ * HyperliquidFundingModal, TreasuryModal, WalletsTab, FundTokenModal, anyspend-web's
+ * obsdn-deposit/deposit pages, etc.) — the user sets the "pay with" amount, and the destination
+ * side is an INTENDED read-only computed display. Round 1 turned `isDepositMode` on
+ * unconditionally for every one of those callers, which would have added a second, competing
+ * amount input on all of them. The fix scopes it to ONLY the one case that actually has an
+ * amount to prefill: `isDepositMode={!!defaultDestinationTokenAmount}`. Only
+ * `b3os-deposit-client.tsx` ever passes `defaultDestinationTokenAmount` (and only when the
+ * page's `?amount` query param is present) — every other caller passes neither prop, so
+ * `isDepositMode` stays `false` and their behavior is unchanged.
+ *
+ * This asserts the derivation at its actual seam: the `isDepositMode` prop `AnySpendDeposit`
+ * hands to `<AnySpend>`. `AnySpend` itself is mocked out (a prop-capturing spy) rather than
+ * rendered for real — its own render tree pulls in quote-fetching, gas-price, and
+ * payment-method hooks that aren't mocked anywhere in the SDK test suite (see the sibling
+ * `CryptoReceiveSection.test.tsx` for why that full mount was skipped there too). Mocking it out
+ * here keeps this test to exactly the seam under test — the value of one prop — without
+ * building that mock surface just to prove a boolean derivation.
+ */
+
+const RECIPIENT = "0x1111111111111111111111111111111111111111";
+
+// Captures the props the real AnySpendDeposit passes to <AnySpend>.
+let capturedAnySpendProps: any;
+
+vi.mock("../AnySpend", () => ({
+  AnySpend: (props: any) => {
+    capturedAnySpendProps = props;
+    return <div data-testid="anyspend-mock" />;
+  },
+}));
+
+// Same mock recipe QRDeposit.test.tsx already proved renders the REAL AnySpendDeposit —
+// AnySpendDeposit itself (not just QRDeposit) directly uses these three hooks.
+vi.mock("@b3dotfun/sdk/global-account/react/hooks/useAccountWallet", () => ({
+  useAccountWallet: () => ({ connectedEOAWallet: undefined }),
+}));
+
+vi.mock("@b3dotfun/sdk/global-account/react/hooks/usePortfolioBalance", () => ({
+  usePortfolioBalance: () => ({ data: undefined, isLoading: false, isError: false }),
+  usePortfolioTokenBalance: () => ({ data: undefined, isLoading: false, isError: false }),
+}));
+
+vi.mock("@b3dotfun/sdk/global-account/react/hooks/useTokenData", () => ({
+  useTokenData: () => ({ data: null, isLoading: false }),
+}));
+
+// AnySpendDeposit statically imports AnySpendCustomExactIn too (even though this test's
+// `isCustomDeposit=false` default never renders it), and that module transitively imports the
+// Relay TokenSelector — mock it so the import chain resolves under happy-dom.
+vi.mock("@relayprotocol/relay-kit-ui", () => ({
+  TokenSelector: () => <div data-testid="token-selector" />,
+}));
+
+vi.mock("@stripe/stripe-js", () => ({
+  loadStripe: vi.fn(() => Promise.resolve(null)),
+}));
+
+// Imported lazily so the module-level mocks above are registered before AnySpendDeposit (and
+// its AnySpend/AnySpendCustomExactIn import chain) loads.
+let AnySpendDeposit: typeof import("../AnySpendDeposit").AnySpendDeposit;
+
+beforeAll(async () => {
+  ({ AnySpendDeposit } = await import("../AnySpendDeposit"));
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+  capturedAnySpendProps = undefined;
+});
+
+function renderDeposit(overrides: Record<string, unknown> = {}) {
+  return render(
+    <AnySpendDeposit
+      recipientAddress={RECIPIENT}
+      destinationTokenAddress={USDC_BASE.address}
+      destinationTokenChainId={USDC_BASE.chainId}
+      // Provided so the component lands directly on the "deposit" step (which renders
+      // <AnySpend>) instead of the chain-selection chooser screen.
+      sourceTokenChainId={USDC_BASE.chainId}
+      {...overrides}
+    />,
+  );
+}
+
+describe("AnySpendDeposit — isDepositMode is scoped to the prefill case only (fix round 2)", () => {
+  it("defaultDestinationTokenAmount set -> isDepositMode is true", () => {
+    renderDeposit({ defaultDestinationTokenAmount: "2000000" });
+
+    expect(capturedAnySpendProps).toBeDefined();
+    expect(capturedAnySpendProps.isDepositMode).toBe(true);
+  });
+
+  it("no prefill at all (every other AnySpendDeposit caller: 15+ funding modals) -> isDepositMode is false", () => {
+    renderDeposit();
+
+    expect(capturedAnySpendProps).toBeDefined();
+    expect(capturedAnySpendProps.isDepositMode).toBe(false);
+  });
+
+  it("both destinationTokenAmount (lock) and defaultDestinationTokenAmount (prefill) set -> isDepositMode is still true, but disableAmountInput (derived from destinationTokenAmount) wins downstream in CryptoReceiveSection", () => {
+    renderDeposit({ destinationTokenAmount: "5000000", defaultDestinationTokenAmount: "2000000" });
+
+    expect(capturedAnySpendProps).toBeDefined();
+    expect(capturedAnySpendProps.isDepositMode).toBe(true);
+    // AnySpend derives its own disableAmountInput from destinationTokenAmount (unchanged by this
+    // fix, not part of what AnySpendDeposit passes) — asserting the raw input here so the
+    // precedence claim is checked against what actually reaches <AnySpend>, not assumed.
+    expect(capturedAnySpendProps.destinationTokenAmount).toBe("5000000");
+  });
+});

package/src/anyspend/react/components/common/CryptoReceiveSection.tsx

@@ -106,9 +106,30 @@ export function CryptoReceiveSection({
         )}
       </div>
       {isBuyMode || isDepositMode ? (
-        // Fixed destination token display for buy mode and deposit mode
+        // Fixed destination TOKEN for buy mode and deposit mode. The AMOUNT differs: buy mode
+        // always derives the receive amount from the source pay-in (read-only here), but deposit
+        // mode is the flow where the user states how much to receive directly — so when it's not
+        // locked (no destinationTokenAmount from the caller), render an editable amount input
+        // while keeping the token side fixed/non-interactive (hideTokenSelect).
         <div className={classes?.inputContainer || "flex items-center justify-between"}>
-          <div className={classes?.input || "text-as-primary text-2xl font-bold"}>{dstAmount || "0"}</div>
+          {isDepositMode && !disableAmountInput ? (
+            <OrderTokenAmount
+              address={effectiveRecipientAddress}
+              context="to"
+              inputValue={dstAmount}
+              onChangeInput={onChangeDstAmount || (() => {})}
+              chainId={selectedDstChainId || dstToken.chainId}
+              setChainId={() => {}}
+              token={dstToken}
+              setToken={() => {}}
+              hideTokenSelect
+              className="w-auto flex-1 gap-0 rounded-none border-0 p-0"
+              innerClassName="gap-0"
+              amountClassName={classes?.input || "text-as-primary text-2xl font-bold"}
+            />
+          ) : (
+            <div className={classes?.input || "text-as-primary text-2xl font-bold"}>{dstAmount || "0"}</div>
+          )}
           <div
             className={
               classes?.tokenSelector ||

package/src/anyspend/react/components/common/__tests__/CryptoReceiveSection.test.tsx

@@ -0,0 +1,110 @@
+import { USDC_BASE } from "@b3dotfun/sdk/anyspend";
+import { fireEvent, render, screen } from "@testing-library/react";
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+
+/**
+ * Regression test for the "b3os-deposit prefill is inert" bug: `CryptoReceiveSection`'s
+ * `isBuyMode || isDepositMode` branch rendered the destination amount as a plain, static
+ * `<div>` — never an `<input>` — regardless of `disableAmountInput`. That branch is exactly
+ * what the b3os-deposit page hits (`AnySpend.tsx`'s `isBuyMode` is unconditionally true there,
+ * since `lockDestinationToken` defaults `true`), so `defaultDestinationTokenAmount`'s seeded
+ * value could never actually be edited, no matter how correctly it was threaded/seeded upstream.
+ *
+ * The fix: within that branch, when `isDepositMode && !disableAmountInput`, render the amount
+ * through `OrderTokenAmount` (the same editable-input component the non-buy/non-deposit branch
+ * already uses) with `hideTokenSelect` — token stays fixed, only the amount becomes editable.
+ * `isBuyMode`-only callers (every existing `AnySpend`/`AnySpendCustomExactIn` consumer other
+ * than `AnySpendDeposit`, which never set `isDepositMode`) are unaffected: they keep the
+ * original static `<div>` display verbatim.
+ *
+ * Tested directly against `CryptoReceiveSection` (not the full `AnySpend` render tree): `AnySpend`
+ * pulls in quote-fetching, gas-price, recipient-address-state, and payment-method hooks that
+ * aren't mocked anywhere in the existing SDK test suite, and building that mock surface from
+ * scratch would test a lot of unrelated machinery for no added signal on THIS bug, which lives
+ * entirely inside `CryptoReceiveSection`'s render branch. The `defaultDestinationTokenAmount` ->
+ * `formatUnits` seeding math (`AnySpend.tsx`/`AnySpendCustomExactIn.tsx`) is untouched by this
+ * fix and was verified separately (by reading + typecheck) in the prior round; `dstAmount` below
+ * stands in for whatever already-formatted display string that seeding effect hands to this
+ * component (e.g. `formatUnits(2_000_000n, 6) === "2"`).
+ */
+
+// OrderTokenAmount (used by the editable branch and the pre-existing swap-mode branch)
+// transitively imports the Relay TokenSelector — mock it so the module resolves under
+// happy-dom without a real Relay provider. Mirrors the same mock in QRDeposit.test.tsx.
+vi.mock("@relayprotocol/relay-kit-ui", () => ({
+  TokenSelector: () => <div data-testid="token-selector" />,
+}));
+
+// Imported lazily so the module-level mock above is registered before CryptoReceiveSection
+// (and its OrderTokenAmount -> relay-kit-ui import chain) loads.
+let CryptoReceiveSection: typeof import("../CryptoReceiveSection").CryptoReceiveSection;
+
+beforeAll(async () => {
+  ({ CryptoReceiveSection } = await import("../CryptoReceiveSection"));
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+const noop = () => {};
+
+function renderReceiveSection(overrides: Record<string, unknown> = {}) {
+  const onChangeDstAmount = vi.fn();
+  const utils = render(
+    <CryptoReceiveSection
+      isBuyMode
+      isDepositMode
+      onSelectRecipient={noop}
+      dstAmount="2"
+      dstToken={USDC_BASE}
+      isSrcInputDirty={false}
+      onChangeDstAmount={onChangeDstAmount}
+      {...overrides}
+    />,
+  );
+  return { ...utils, onChangeDstAmount };
+}
+
+describe("CryptoReceiveSection — deposit-mode editable amount (b3os-deposit prefill fix)", () => {
+  it("deposit mode, unlocked: the amount renders as an editable input, seeded with the prefill value, and typing updates it", () => {
+    const { onChangeDstAmount } = renderReceiveSection({ disableAmountInput: false });
+
+    // (a) an editable <input> exists for the amount — the OLD code rendered a plain <div>, no
+    // input at all, in this branch. There is exactly one text input on screen because the token
+    // side is `hideTokenSelect` (no TokenSelector rendered) and recipient selection is a button.
+    const input = screen.getByRole("textbox");
+    expect(input).toBeTruthy();
+
+    // ...and it is NOT disabled/readOnly — the whole point of "editable". (No jest-dom matchers
+    // are configured in this package's vitest setup, so assert the raw DOM properties directly.)
+    expect((input as HTMLInputElement).disabled).toBe(false);
+    expect((input as HTMLInputElement).readOnly).toBe(false);
+
+    // (b) seeded with the (already-formatted) prefill value handed in via `dstAmount` — stands
+    // in for `formatUnits(<raw defaultDestinationTokenAmount>, decimals)` from the seeding effect.
+    expect((input as HTMLInputElement).value).toBe("2");
+
+    // (c) firing a change lets the user actually type a new amount.
+    fireEvent.change(input, { target: { value: "5" } });
+    expect(onChangeDstAmount).toHaveBeenCalledWith("5");
+  });
+
+  it("deposit mode, locked (destinationTokenAmount set -> disableAmountInput=true): the amount stays the static, non-editable display", () => {
+    renderReceiveSection({ disableAmountInput: true });
+
+    // Lock path preserved byte-for-byte: NO <input> is rendered for the amount at all — same as
+    // before this fix, and same as every other `disableAmountInput` caller.
+    expect(screen.queryByRole("textbox")).toBeNull();
+    expect(screen.getByText("2")).toBeTruthy();
+  });
+
+  it("buy mode without deposit mode (every existing AnySpend/AnySpendCustomExactIn caller other than AnySpendDeposit): unaffected — still the static display", () => {
+    // isDepositMode defaults false everywhere except AnySpendDeposit's <AnySpend> render, so this
+    // is the exact prop shape every pre-existing "Buy Mode" consumer passes today.
+    renderReceiveSection({ isDepositMode: false, disableAmountInput: false });
+
+    expect(screen.queryByRole("textbox")).toBeNull();
+    expect(screen.getByText("2")).toBeTruthy();
+  });
+});

package/src/global-account/react/components/B3Provider/BetterAuthProvider.tsx

@@ -64,19 +64,27 @@ const BetterAuthProvider = ({ partnerId }: { partnerId: string }) => {
     const restoreSession = async () => {
       debug("Attempting session restore");
 
+      // A _ba_token in the URL OUTRANKS a cached Feathers JWT: the user just
+      // arrived through a live sign-in link (magic link / OAuth callback), and
+      // restoring a previous identity first would strand them as the wrong
+      // user with the token silently dropped.
+      const incomingBaToken = new URLSearchParams(window.location.search).get("_ba_token");
+
       // 1. Try existing Feathers JWT first (fastest — no network call to Better Auth)
-      try {
-        const response = await app.reAuthenticate();
-        if (response?.user) {
-          debug("Feathers JWT restored", { userId: response.user.userId });
-          setUser(response.user);
-          setIsAuthenticated(true);
-          setIsConnected(true);
-          setIsAuthenticating(false);
-          return;
+      if (!incomingBaToken) {
+        try {
+          const response = await app.reAuthenticate();
+          if (response?.user) {
+            debug("Feathers JWT restored", { userId: response.user.userId });
+            setUser(response.user);
+            setIsAuthenticated(true);
+            setIsConnected(true);
+            setIsAuthenticating(false);
+            return;
+          }
+        } catch {
+          debug("No existing Feathers JWT");
         }
-      } catch {
-        debug("No existing Feathers JWT");
       }
 
       // 2. Check for _ba_token in URL (OAuth callback with third-party cookie bypass).
@@ -121,6 +129,22 @@ const BetterAuthProvider = ({ partnerId }: { partnerId: string }) => {
           return;
         } catch (err) {
           debug("_ba_token exchange failed", err);
+          // A dead injected token (expired link param, revoked session) must
+          // not strand a user who HAS a valid cached session — fall back to
+          // the reAuthenticate lane the token's presence skipped.
+          try {
+            const cached = await app.reAuthenticate();
+            if (cached?.user) {
+              debug("Fell back to cached Feathers JWT after _ba_token failure", { userId: cached.user.userId });
+              setUser(cached.user);
+              setIsAuthenticated(true);
+              setIsConnected(true);
+              setIsAuthenticating(false);
+              return;
+            }
+          } catch {
+            debug("No cached session to fall back to");
+          }
         }
       }