@oxy.so/core 1.0.0

package/src/session/__tests__/SessionClient.additive.test.ts

@@ -0,0 +1,153 @@
+import type { DeviceSessionState } from '@oxy.so/contracts';
+import { SessionClient, type SessionClientHost, type SessionStateOrigin } from '../SessionClient';
+import { createMemoryAuthStateStore } from '../authStateStore';
+
+const stateWith = (rev: number, active: string | null, accountIds: string[]): DeviceSessionState => ({
+  deviceId: 'd1',
+  accounts: accountIds.map((id, i) => ({ accountId: id, sessionId: `s-${id}`, authuser: i })),
+  activeAccountId: active,
+  revision: rev,
+  updatedAt: 1720000000000,
+});
+
+const sync = (state: DeviceSessionState) => ({ state, activeToken: { accessToken: `jwt-${state.revision}`, expiresAt: 'x' } });
+
+function makeHost(makeRequest: jest.Mock, currentAccountId: string | null = null): SessionClientHost {
+  return {
+    makeRequest,
+    getBaseURL: () => 'http://test.invalid',
+    getAccessToken: () => 't',
+    getDeviceCredential: () => null,
+    onTokensChanged: () => () => undefined,
+    setTokens: jest.fn(),
+    getCurrentAccountId: () => currentAccountId,
+  };
+}
+
+class TestClient extends SessionClient {
+  public apply(raw: unknown): boolean {
+    return this.applyState(raw);
+  }
+
+  public applyWith(raw: unknown, origin: SessionStateOrigin): boolean {
+    return this.applyState(raw, origin);
+  }
+}
+
+describe('SessionClient.registerAndActivate', () => {
+  it('adds then switches to the explicit target when it is not already active', async () => {
+    const makeRequest = jest
+      .fn()
+      // add → device set has a1 active, a2 present but not active
+      .mockResolvedValueOnce(sync(stateWith(1, 'a1', ['a1', 'a2'])))
+      // switch → a2 becomes active
+      .mockResolvedValueOnce(sync(stateWith(2, 'a2', ['a1', 'a2'])));
+    const c = new SessionClient(makeHost(makeRequest));
+
+    await c.registerAndActivate('a2');
+
+    expect(makeRequest).toHaveBeenNthCalledWith(1, 'POST', '/session/device/add', undefined, { cache: false });
+    expect(makeRequest).toHaveBeenNthCalledWith(2, 'POST', '/session/device/switch', { accountId: 'a2' }, { cache: false });
+    expect(c.getState()?.activeAccountId).toBe('a2');
+    c.stop();
+  });
+
+  it('falls back to the host current-account ref when no target is passed', async () => {
+    const makeRequest = jest
+      .fn()
+      .mockResolvedValueOnce(sync(stateWith(1, 'a1', ['a1', 'a2'])))
+      .mockResolvedValueOnce(sync(stateWith(2, 'a2', ['a1', 'a2'])));
+    const c = new SessionClient(makeHost(makeRequest, 'a2'));
+
+    await c.registerAndActivate();
+
+    expect(makeRequest).toHaveBeenNthCalledWith(2, 'POST', '/session/device/switch', { accountId: 'a2' }, { cache: false });
+    c.stop();
+  });
+
+  it('does NOT switch when the added account is already active', async () => {
+    const makeRequest = jest.fn().mockResolvedValueOnce(sync(stateWith(1, 'a1', ['a1'])));
+    const c = new SessionClient(makeHost(makeRequest));
+
+    await c.registerAndActivate('a1');
+
+    expect(makeRequest).toHaveBeenCalledTimes(1);
+    expect(makeRequest).toHaveBeenCalledWith('POST', '/session/device/add', undefined, { cache: false });
+    c.stop();
+  });
+});
+
+describe('SessionClient onUnauthenticated', () => {
+  it('fires when an applied state has zero accounts (device signout-all)', () => {
+    const onUnauthenticated = jest.fn();
+    const c = new TestClient(makeHost(jest.fn()), { onUnauthenticated });
+
+    c.apply(stateWith(1, 'a1', ['a1']));
+    expect(onUnauthenticated).not.toHaveBeenCalled();
+
+    c.apply(stateWith(2, null, []));
+    expect(onUnauthenticated).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not fire for a stale (non-applied) empty state', () => {
+    const onUnauthenticated = jest.fn();
+    const c = new TestClient(makeHost(jest.fn()), { onUnauthenticated });
+
+    c.apply(stateWith(5, 'a1', ['a1']));
+    // revision 4 <= 5 → rejected, so onUnauthenticated must NOT fire.
+    c.apply(stateWith(4, null, []));
+    expect(onUnauthenticated).not.toHaveBeenCalled();
+  });
+
+  it('passes the applied-state ORIGIN through to onUnauthenticated', () => {
+    const onUnauthenticated = jest.fn();
+    const c = new TestClient(makeHost(jest.fn()), { onUnauthenticated });
+
+    // A socket-pushed empty state → `push` origin.
+    c.applyWith(stateWith(1, null, []), 'push');
+    expect(onUnauthenticated).toHaveBeenLastCalledWith('push');
+
+    // A direct REST response empty state → `request` origin.
+    c.applyWith(stateWith(2, null, []), 'request');
+    expect(onUnauthenticated).toHaveBeenLastCalledWith('request');
+  });
+});
+
+describe('SessionClient onUnauthenticated — durable credential guard (bug #4)', () => {
+  const CRED = { sessionId: 's1', userId: 'a1', deviceId: 'dev-1', deviceSecret: 'ds-1' };
+
+  // Mirror the provider's origin-gated wipe: erase the durable credential ONLY on
+  // a `request`-origin verdict, never on a (possibly transient) `push`.
+  function wireGuardedStore() {
+    const store = createMemoryAuthStateStore();
+    const onUnauthenticated = (origin: SessionStateOrigin) => {
+      if (origin === 'request') void store.clear();
+    };
+    return { store, onUnauthenticated };
+  }
+
+  it('a transient socket-pushed accounts===0 does NOT wipe the durable credential', async () => {
+    const { store, onUnauthenticated } = wireGuardedStore();
+    await store.save(CRED);
+    const c = new TestClient(makeHost(jest.fn()), { onUnauthenticated });
+
+    // A `push`-origin empty state (e.g. a reconnect race on another device).
+    c.applyWith(stateWith(2, null, []), 'push');
+    await Promise.resolve();
+
+    // The device credential survives — a reload can still restore the session.
+    expect(await store.load()).toEqual(CRED);
+  });
+
+  it('a real (request-origin) sign-out DOES wipe the durable credential', async () => {
+    const { store, onUnauthenticated } = wireGuardedStore();
+    await store.save(CRED);
+    const c = new TestClient(makeHost(jest.fn()), { onUnauthenticated });
+
+    // A `request`-origin empty state = the REST sign-out response.
+    c.applyWith(stateWith(2, null, []), 'request');
+    await Promise.resolve();
+
+    expect(await store.load()).toBeNull();
+  });
+});

package/src/session/__tests__/SessionClient.broadcastChannel.test.ts

@@ -0,0 +1,114 @@
+/**
+ * SessionClient same-origin `BroadcastChannel` cross-tab state propagation.
+ *
+ * This is the AUTHENTICATED-only survivor of the zero-cookie cutover: when one
+ * authenticated tab commits an account switch / sign-out, same-origin siblings
+ * re-sync their device state instantly without waiting on the socket. The
+ * signed-out "self-acquire on sibling sign-in" wake is gone (sockets are now
+ * bearer-only), so every case here runs with a bearer present.
+ */
+import type { DeviceSessionState } from '@oxy.so/contracts';
+
+type Handler = (...args: unknown[]) => void;
+class FakeSocket {
+  connected = false;
+  handlers = new Map<string, Handler[]>();
+  on(event: string, cb: Handler) { const l = this.handlers.get(event) ?? []; l.push(cb); this.handlers.set(event, l); }
+  off(event: string, cb?: Handler) { if (!cb) { this.handlers.delete(event); return; } this.handlers.set(event, (this.handlers.get(event) ?? []).filter((h) => h !== cb)); }
+  connect() { this.connected = true; this.trigger('connect'); }
+  disconnect() { this.connected = false; }
+  trigger(event: string, ...args: unknown[]) { for (const h of this.handlers.get(event) ?? []) h(...args); }
+}
+let fakeSocket: FakeSocket;
+const ioMock = jest.fn((_uri: string, opts?: Record<string, unknown>) => {
+  if (!opts || opts.autoConnect !== false) fakeSocket.connected = true;
+  return fakeSocket;
+});
+jest.mock('socket.io-client', () => ({ __esModule: true, io: (...args: unknown[]) => ioMock(...(args as [string, Record<string, unknown>?])) }));
+
+// A same-name in-process BroadcastChannel bus: postMessage delivers to every
+// OTHER open channel of the same name (never the sender) — matching the spec.
+type BusEntry = { name: string; onmessage: ((event: { data: unknown }) => void) | null };
+const bus = new Set<BusEntry>();
+class FakeBroadcastChannel {
+  private entry: BusEntry;
+  constructor(public name: string) { this.entry = { name, onmessage: null }; bus.add(this.entry); }
+  get onmessage(): ((event: { data: unknown }) => void) | null { return this.entry.onmessage; }
+  set onmessage(cb: ((event: { data: unknown }) => void) | null) { this.entry.onmessage = cb; }
+  postMessage(data: unknown) {
+    for (const e of bus) {
+      if (e === this.entry || e.name !== this.name) continue;
+      e.onmessage?.({ data });
+    }
+  }
+  close() { bus.delete(this.entry); }
+}
+
+import { SessionClient, type SessionClientHost } from '../SessionClient';
+
+const STATE = (rev: number, accounts = [{ accountId: 'a1', sessionId: 's1', authuser: 0 }]): DeviceSessionState =>
+  ({ deviceId: 'd1', accounts, activeAccountId: accounts[0]?.accountId ?? null, revision: rev, updatedAt: 1720000000000 });
+const SYNC = (rev: number) => ({ state: STATE(rev), activeToken: { accessToken: `jwt-${rev}`, expiresAt: 'x' } });
+
+function makeHost(over: Partial<SessionClientHost> = {}): SessionClientHost {
+  return {
+    makeRequest: jest.fn().mockResolvedValue(SYNC(1)),
+    getBaseURL: () => 'http://test.invalid',
+    getAccessToken: () => 'tok',
+    getDeviceCredential: () => null,
+    onTokensChanged: () => () => undefined,
+    setTokens: jest.fn(),
+    getCurrentAccountId: () => 'a1',
+    ...over,
+  };
+}
+
+const flush = async () => { await Promise.resolve(); await Promise.resolve(); };
+
+beforeEach(() => {
+  fakeSocket = new FakeSocket();
+  ioMock.mockClear();
+  bus.clear();
+  (globalThis as { BroadcastChannel?: unknown }).BroadcastChannel = FakeBroadcastChannel as unknown;
+});
+afterEach(() => {
+  (globalThis as { BroadcastChannel?: unknown }).BroadcastChannel = undefined;
+});
+
+describe('SessionClient BroadcastChannel cross-tab re-sync (authenticated)', () => {
+  it('a local mutation wakes an authenticated same-origin sibling to re-sync (bootstrap)', async () => {
+    const bMakeRequest = jest.fn().mockResolvedValue(SYNC(1));
+    const b = new SessionClient(makeHost({ makeRequest: bMakeRequest, getAccessToken: () => 'tok-b' }), {});
+    await b.start();
+    bMakeRequest.mockClear();
+    const a = new SessionClient(makeHost({ getAccessToken: () => 'tok-a' }), {});
+    await a.start();
+    await a.addCurrentAccount();
+    await flush();
+    expect(bMakeRequest).toHaveBeenCalledWith('GET', '/session/device/state', undefined, { cache: false });
+    a.stop();
+    b.stop();
+  });
+
+  it('does not re-sync the posting tab from its own commit ping (no self-loop)', async () => {
+    const makeRequest = jest.fn().mockResolvedValue(SYNC(1));
+    const a = new SessionClient(makeHost({ makeRequest, getAccessToken: () => 'tok-a' }), {});
+    await a.start();
+    makeRequest.mockClear();
+    // `addCurrentAccount` POSTs then posts a commit ping; the ping never echoes
+    // to the sender, so this tab must NOT re-fetch its own device state.
+    await a.addCurrentAccount();
+    await flush();
+    expect(makeRequest).not.toHaveBeenCalledWith('GET', '/session/device/state', undefined, { cache: false });
+    a.stop();
+  });
+
+  it('is a no-op on platforms without BroadcastChannel (native)', async () => {
+    (globalThis as { BroadcastChannel?: unknown }).BroadcastChannel = undefined;
+    const c = new SessionClient(makeHost({ getAccessToken: () => 'tok' }), {});
+    await c.start();
+    // Mutations must not throw when BroadcastChannel is absent.
+    await expect(c.switchAccount('a1')).resolves.toBeUndefined();
+    c.stop();
+  });
+});

package/src/session/__tests__/SessionClient.diagnostics.test.ts

@@ -0,0 +1,91 @@
+import type { DeviceSessionState } from '@oxy.so/contracts';
+import { SessionClient, type SessionClientHost } from '../SessionClient';
+import { logger } from '../../logger';
+
+const STATE = (rev: number): DeviceSessionState => ({
+  deviceId: 'd1', accounts: [{ accountId: 'a1', sessionId: 's1', authuser: 0 }], activeAccountId: 'a1', revision: rev, updatedAt: 1720000000000,
+});
+
+function makeHost(makeRequest: jest.Mock): SessionClientHost {
+  return {
+    makeRequest,
+    getBaseURL: () => 'http://test.invalid',
+    getAccessToken: () => 't',
+    getDeviceCredential: () => null,
+    onTokensChanged: () => () => undefined,
+    setTokens: jest.fn(),
+    getCurrentAccountId: () => null,
+  };
+}
+
+describe('SessionClient sync diagnostics', () => {
+  let warnSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+  });
+
+  it('logs the failing zod issue path + code when a nested field is the wrong type', async () => {
+    // authuser must be a non-negative integer; a string trips invalid_type at accounts[0].authuser.
+    const badAuthuser = { accountId: 'a1', sessionId: 's1', authuser: 'not-a-number' };
+    const state = { ...STATE(3), accounts: [badAuthuser] };
+    const makeRequest = jest.fn().mockResolvedValueOnce({ state, activeToken: null });
+    const c = new SessionClient(makeHost(makeRequest));
+
+    await c.bootstrap();
+
+    expect(c.getState()).toBeNull();
+    expect(warnSpy).toHaveBeenCalledWith(
+      '[SessionClient] discarded invalid session sync',
+      expect.objectContaining({ component: 'SessionClient' }),
+    );
+    const context = warnSpy.mock.calls[0][1];
+    expect(context.issues).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ path: 'state.accounts.0.authuser', code: 'invalid_type' }),
+      ]),
+    );
+    // invalid_type issues carry TYPE names (safe), not values.
+    const authuserIssue = context.issues.find((i: { path: string }) => i.path === 'state.accounts.0.authuser');
+    expect(authuserIssue.received).toBe('string');
+    expect(authuserIssue.expected).toBe('number');
+    // Top-level envelope keys are summarized to catch drift.
+    expect(context.keys).toEqual(['state', 'activeToken']);
+  });
+
+  it('never leaks token-like values into the logged diagnostics', async () => {
+    // A valid-looking accessToken alongside an otherwise-invalid state must not surface in the log.
+    const secretToken = 'jwt-SUPER-SECRET-ACCESS-TOKEN-abc123';
+    const makeRequest = jest.fn().mockResolvedValueOnce({
+      state: { deviceId: 'd1' /* missing required fields */ },
+      activeToken: { accessToken: secretToken, expiresAt: 'x' },
+    });
+    const c = new SessionClient(makeHost(makeRequest));
+
+    await c.bootstrap();
+
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const serialized = JSON.stringify(warnSpy.mock.calls[0]);
+    expect(serialized).not.toContain(secretToken);
+    expect(serialized).not.toContain('SUPER-SECRET');
+  });
+
+  it('reports envelope drift via keys and a top-level invalid_type when raw is undefined', async () => {
+    const makeRequest = jest.fn().mockResolvedValueOnce(undefined);
+    const c = new SessionClient(makeHost(makeRequest));
+
+    await c.bootstrap();
+
+    const context = warnSpy.mock.calls[0][1];
+    expect(context.keys).toEqual([]);
+    expect(context.issues).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ path: '', code: 'invalid_type', expected: 'object', received: 'undefined' }),
+      ]),
+    );
+  });
+});