@oxy.so/core 1.0.0

package/src/session/__tests__/SessionClient.socketFactory.test.ts

@@ -0,0 +1,81 @@
+import type { DeviceSessionState } from '@oxy.so/contracts';
+import * as socketLoader from '../socketLoader';
+import type { MinimalSocket, SocketIOFactory } from '../socketLoader';
+import { SessionClient, type SessionClientHost } from '../SessionClient';
+
+/**
+ * P0 (bundler-fragility): SessionClient must NOT depend on a runtime dynamic
+ * `import('socket.io-client')` when a consumer (services/auth-sdk) injects the
+ * `io` factory statically. These tests pin the two branches of `connectSocket`:
+ *
+ *  1. `socketFactory` injected  → the injected factory is used and the lazy
+ *     loader (`getSocketIO`) is NEVER invoked (the exact call that fails in the
+ *     Metro/Expo-web + Vite published-dist consumers).
+ *  2. no `socketFactory`        → the lazy loader IS invoked (fallback).
+ */
+
+type Handler = (...args: unknown[]) => void;
+class FakeSocket implements MinimalSocket {
+  connected = false;
+  handlers = new Map<string, Handler[]>();
+  on(event: string, cb: Handler) { const l = this.handlers.get(event) ?? []; l.push(cb); this.handlers.set(event, l); }
+  off(event: string, cb?: Handler) { if (!cb) { this.handlers.delete(event); return; } this.handlers.set(event, (this.handlers.get(event) ?? []).filter((h) => h !== cb)); }
+  emit(_event: string, ..._args: unknown[]) { /* no-op: device socket never emits */ }
+  connect() { this.connected = true; }
+  disconnect() { this.connected = false; }
+}
+
+const STATE = (rev: number): DeviceSessionState => ({ deviceId: 'd1', accounts: [{ accountId: 'a1', sessionId: 's1', authuser: 0 }], activeAccountId: 'a1', revision: rev, updatedAt: 1720000000000 });
+const SYNC = (rev: number) => ({ state: STATE(rev), activeToken: { accessToken: `jwt-${rev}`, expiresAt: 'x' } });
+
+function makeHost(over: Partial<SessionClientHost> = {}): SessionClientHost {
+  return {
+    makeRequest: jest.fn().mockResolvedValue(SYNC(1)),
+    getBaseURL: () => 'http://test.invalid',
+    getAccessToken: () => 'tok',
+    getDeviceCredential: () => null,
+    onTokensChanged: () => () => undefined,
+    setTokens: jest.fn(),
+    getCurrentAccountId: () => 'a1',
+    ...over,
+  };
+}
+
+describe('SessionClient injected socketFactory', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('uses the injected factory and NEVER invokes the lazy loader', async () => {
+    const loaderSpy = jest.spyOn(socketLoader, 'getSocketIO');
+    let created: FakeSocket | null = null;
+    const factory: SocketIOFactory = jest.fn((_uri: string) => {
+      created = new FakeSocket();
+      created.connected = true;
+      return created;
+    });
+
+    const client = new SessionClient(makeHost(), { socketFactory: factory });
+    await client.start();
+
+    expect(factory).toHaveBeenCalledTimes(1);
+    expect(factory).toHaveBeenCalledWith('http://test.invalid', expect.objectContaining({ transports: ['websocket'] }));
+    expect(loaderSpy).not.toHaveBeenCalled();
+    expect(created).not.toBeNull();
+    client.stop();
+  });
+
+  it('falls back to the lazy loader when no factory is injected', async () => {
+    const fake = new FakeSocket();
+    fake.connected = true;
+    const lazyFactory: SocketIOFactory = jest.fn(() => fake);
+    const loaderSpy = jest.spyOn(socketLoader, 'getSocketIO').mockResolvedValue(lazyFactory);
+
+    const client = new SessionClient(makeHost());
+    await client.start();
+
+    expect(loaderSpy).toHaveBeenCalledTimes(1);
+    expect(lazyFactory).toHaveBeenCalledWith('http://test.invalid', expect.objectContaining({ transports: ['websocket'] }));
+    client.stop();
+  });
+});

package/src/session/__tests__/SessionClient.state.test.ts

@@ -0,0 +1,78 @@
+import type { DeviceSessionState } from '@oxy.so/contracts';
+import { SessionClient, type SessionClientHost, type TokenTransport } from '../SessionClient';
+
+function makeHost(): SessionClientHost {
+  return {
+    makeRequest: jest.fn(),
+    getBaseURL: () => 'http://test.invalid',
+    getAccessToken: () => 't',
+    getDeviceCredential: () => null,
+    onTokensChanged: () => () => undefined,
+    setTokens: jest.fn(),
+    getCurrentAccountId: () => null,
+  };
+}
+const STATE = (rev: number, active: string | null = 'a1'): DeviceSessionState => ({
+  deviceId: 'd1', accounts: active ? [{ accountId: 'a1', sessionId: 's1', authuser: 0 }] : [], activeAccountId: active, revision: rev, updatedAt: 1720000000000,
+});
+
+// SessionClient.applyState is protected; a tiny subclass exposes it for the unit test.
+class TestClient extends SessionClient { public apply(raw: unknown): boolean { return this.applyState(raw); } }
+
+describe('SessionClient state', () => {
+  it('starts with null state', () => {
+    expect(new SessionClient(makeHost()).getState()).toBeNull();
+  });
+
+  it('applies a valid state and notifies subscribers', () => {
+    const c = new TestClient(makeHost());
+    const seen: (DeviceSessionState | null)[] = [];
+    c.subscribe((s) => seen.push(s));
+    expect(c.apply(STATE(1))).toBe(true);
+    expect(c.getState()?.revision).toBe(1);
+    expect(seen.at(-1)?.revision).toBe(1);
+  });
+
+  it('ignores a stale or equal revision (last-writer-wins) WITHIN the same device', () => {
+    const c = new TestClient(makeHost());
+    c.apply({ ...STATE(5), deviceId: 'A' });
+    expect(c.apply({ ...STATE(5), deviceId: 'A' })).toBe(false);
+    expect(c.apply({ ...STATE(4), deviceId: 'A' })).toBe(false);
+    expect(c.apply({ ...STATE(6), deviceId: 'A' })).toBe(true);
+    expect(c.getState()?.revision).toBe(6);
+  });
+
+  it('accepts a LOWER-revision state from a DIFFERENT device (revision baseline resets cross-device)', () => {
+    const c = new TestClient(makeHost());
+    // Device A at a high revision.
+    expect(c.apply({ ...STATE(10), deviceId: 'A' })).toBe(true);
+    expect(c.getState()?.deviceId).toBe('A');
+    // Device B, freshly converged (revision 1), must win over device A's
+    // stale-but-higher revision — the cross-device comparison is not monotone.
+    expect(c.apply({ ...STATE(1), deviceId: 'B' })).toBe(true);
+    expect(c.getState()?.deviceId).toBe('B');
+    expect(c.getState()?.revision).toBe(1);
+  });
+
+  it('rejects an invalid (unvalidated) state without applying', () => {
+    const c = new TestClient(makeHost());
+    expect(c.apply({ deviceId: 'd1', accounts: 'nope', revision: 1 })).toBe(false);
+    expect(c.getState()).toBeNull();
+  });
+
+  it('calls transport.ensureActiveToken when a state is applied', () => {
+    const transport: TokenTransport = { ensureActiveToken: jest.fn().mockResolvedValue(undefined) };
+    const c = new TestClient(makeHost(), { transport });
+    c.apply(STATE(1));
+    expect(transport.ensureActiveToken).toHaveBeenCalledWith(expect.objectContaining({ revision: 1 }));
+  });
+
+  it('unsubscribe stops notifications', () => {
+    const c = new TestClient(makeHost());
+    const seen: unknown[] = [];
+    const off = c.subscribe((s) => seen.push(s));
+    off();
+    c.apply(STATE(1));
+    expect(seen).toHaveLength(0);
+  });
+});

package/src/session/__tests__/SessionClient.switchTokenOrder.test.ts

@@ -0,0 +1,170 @@
+import type { DeviceSessionState } from '@oxy.so/contracts';
+import { SessionClient, type SessionClientHost, type TokenTransport } from '../SessionClient';
+import { computeIdentityTag } from '../../utils/cacheKey';
+
+/**
+ * The account-switch 404 race (regression guard).
+ *
+ * When a `session_state` push re-elects the active account from A to B, the
+ * push carries NO token — the app still holds A's bearer. If a subscriber were
+ * notified before B's bearer is planted, a `useCurrentUser`-style refetch would
+ * fire under A's token against B's session and 404.
+ *
+ * INVARIANT: no subscriber is ever notified while the planted bearer identifies
+ * an account OTHER than the observed active account. This test records, at every
+ * notify, the observed active account alongside the account the CURRENT bearer
+ * belongs to (via the same `computeIdentityTag` derivation `applyState` uses)
+ * and asserts they always match — and that the switch notify is DEFERRED until
+ * the mint lands B's token.
+ */
+
+/** A minimal jwt-decode-able token whose `userId` claim is `accountId`. */
+function jwtFor(accountId: string): string {
+  const payload = Buffer.from(JSON.stringify({ userId: accountId })).toString('base64url');
+  return `h.${payload}.s`;
+}
+
+const stateWith = (rev: number, active: string): DeviceSessionState => ({
+  deviceId: 'd1',
+  accounts: [
+    { accountId: 'a1', sessionId: 's-a1', authuser: 0 },
+    { accountId: 'b1', sessionId: 's-b1', authuser: 1 },
+  ],
+  activeAccountId: active,
+  revision: rev,
+  updatedAt: 1720000000000,
+});
+
+class TestClient extends SessionClient {
+  public apply(raw: unknown): boolean {
+    return this.applyState(raw);
+  }
+}
+
+describe('SessionClient — no notify under a mismatched bearer on an account switch', () => {
+  it('defers the switch notify until the mint lands the new active account bearer', async () => {
+    // Mutable planted bearer, starting on account A.
+    let planted: string | null = jwtFor('a1');
+    const host: SessionClientHost = {
+      makeRequest: jest.fn(),
+      getBaseURL: () => 'http://test.invalid',
+      getAccessToken: () => planted,
+      getDeviceCredential: () => null,
+      onTokensChanged: () => () => undefined,
+      setTokens: (token) => {
+        planted = token;
+      },
+      getCurrentAccountId: () => null,
+    };
+
+    // The mint lands the ACTIVE account's bearer, asynchronously (models the
+    // real device-secret mint round trip).
+    const transport: TokenTransport = {
+      ensureActiveToken: jest.fn(async (state: DeviceSessionState) => {
+        await Promise.resolve();
+        if (state.activeAccountId) {
+          planted = jwtFor(state.activeAccountId);
+        }
+      }),
+    };
+
+    const c = new TestClient(host, { transport });
+
+    const observations: Array<{ active: string | null; bearer: string }> = [];
+    c.subscribe((s) => {
+      observations.push({
+        active: s?.activeAccountId ?? null,
+        bearer: computeIdentityTag(host.getAccessToken()),
+      });
+    });
+
+    // Apply A (bearer already A's) → matches → synchronous notify.
+    c.apply(stateWith(1, 'a1'));
+    expect(observations).toEqual([{ active: 'a1', bearer: 'a1' }]);
+
+    // A `session_state` push re-elects B while the bearer is still A's.
+    c.apply(stateWith(2, 'b1'));
+    // The switch notify MUST NOT have fired yet — the bearer is still A's, so a
+    // synchronous notify would let a subscriber observe B under A's token.
+    expect(observations).toEqual([{ active: 'a1', bearer: 'a1' }]);
+
+    // Flush the mint + deferred notify.
+    for (let i = 0; i < 5; i++) {
+      await Promise.resolve();
+    }
+
+    // The mint ran, and the switch notify fired only AFTER B's bearer was planted.
+    expect(transport.ensureActiveToken).toHaveBeenCalledWith(
+      expect.objectContaining({ activeAccountId: 'b1' }),
+    );
+    expect(observations).toContainEqual({ active: 'b1', bearer: 'b1' });
+
+    // At NO notify did the observed active account differ from the bearer's account.
+    for (const o of observations) {
+      expect(o.bearer).toBe(o.active);
+    }
+  });
+
+  it('does not defer when the bearer already belongs to the new active account', () => {
+    let planted: string | null = jwtFor('b1');
+    const host: SessionClientHost = {
+      makeRequest: jest.fn(),
+      getBaseURL: () => 'http://test.invalid',
+      getAccessToken: () => planted,
+      getDeviceCredential: () => null,
+      onTokensChanged: () => () => undefined,
+      setTokens: (token) => {
+        planted = token;
+      },
+      getCurrentAccountId: () => null,
+    };
+    const transport: TokenTransport = { ensureActiveToken: jest.fn().mockResolvedValue(undefined) };
+    const c = new TestClient(host, { transport });
+
+    const seen: Array<string | null> = [];
+    c.subscribe((s) => seen.push(s?.activeAccountId ?? null));
+
+    // Bearer is already B's → the notify is synchronous (no mint-before-notify).
+    c.apply(stateWith(3, 'b1'));
+    expect(seen).toEqual(['b1']);
+  });
+
+  it('reverts state and does not notify when minting fails on an account switch', async () => {
+    let planted: string | null = jwtFor('a1');
+    const host: SessionClientHost = {
+      makeRequest: jest.fn(),
+      getBaseURL: () => 'http://test.invalid',
+      getAccessToken: () => planted,
+      getDeviceCredential: () => null,
+      onTokensChanged: () => () => undefined,
+      setTokens: (token) => {
+        planted = token;
+      },
+      getCurrentAccountId: () => null,
+    };
+
+    const transport: TokenTransport = {
+      ensureActiveToken: jest.fn(async () => {
+        await Promise.resolve();
+        throw new Error('mint failed');
+      }),
+    };
+
+    const c = new TestClient(host, { transport });
+    const seen: Array<string | null> = [];
+    c.subscribe((s) => seen.push(s?.activeAccountId ?? null));
+
+    c.apply(stateWith(1, 'a1'));
+    expect(seen).toEqual(['a1']);
+
+    c.apply(stateWith(2, 'b1'));
+    for (let i = 0; i < 5; i++) {
+      await Promise.resolve();
+    }
+
+    // Still on A — no notify under A's bearer for B's active account.
+    expect(seen).toEqual(['a1']);
+    expect(c.getState()?.activeAccountId).toBe('a1');
+    expect(computeIdentityTag(host.getAccessToken())).toBe('a1');
+  });
+});

package/src/session/__tests__/accountDelegationAccess.test.ts

@@ -0,0 +1,104 @@
+import { ACCOUNT_KINDS } from "@oxy.so/contracts";
+import type { AccountMember } from "../../mixins/OxyServices.accounts";
+import { canSwitchIntoAccount } from "../accountSwitchTargets";
+import { resolveAccountDelegationAccess } from "../accountDelegationAccess";
+
+function membership(
+	permissions: string[],
+	status: AccountMember["status"] = "active",
+): AccountMember {
+	return {
+		_id: "membership-1",
+		accountId: "account-1",
+		memberUserId: "user-1",
+		role: "viewer",
+		permissions,
+		inherit: true,
+		status,
+		source: "direct",
+		createdAt: new Date(0).toISOString(),
+		updatedAt: new Date(0).toISOString(),
+	};
+}
+
+describe("resolveAccountDelegationAccess", () => {
+	it("admits exactly the delegated account kinds for an implicit owner baseline", () => {
+		expect(
+			Object.fromEntries(
+				ACCOUNT_KINDS.map((kind) => [
+					kind,
+					resolveAccountDelegationAccess({ kind, relationship: "owner" }),
+				]),
+			),
+		).toEqual({
+			personal: { hasStanding: true, canActAs: false },
+			organization: { hasStanding: true, canActAs: true },
+			project: { hasStanding: true, canActAs: true },
+			bot: { hasStanding: true, canActAs: true },
+			channel: { hasStanding: true, canActAs: false },
+		});
+	});
+
+	it("keeps bot delegation separate from human account switching", () => {
+		const bot = { kind: "bot" as const, relationship: "owner" as const };
+
+		expect(resolveAccountDelegationAccess(bot)).toEqual({
+			hasStanding: true,
+			canActAs: true,
+		});
+		expect(canSwitchIntoAccount(bot)).toBe(false);
+	});
+
+	it("treats active membership as standing without promoting it to act-as", () => {
+		expect(
+			resolveAccountDelegationAccess({
+				kind: "bot",
+				relationship: "member",
+				callerMembership: membership(["account:read"]),
+			}),
+		).toEqual({ hasStanding: true, canActAs: false });
+	});
+
+	it("uses the effective account:act_as permission for a live member", () => {
+		expect(
+			resolveAccountDelegationAccess({
+				kind: "bot",
+				relationship: "member",
+				callerMembership: membership(["account:read", "account:act_as"]),
+			}),
+		).toEqual({ hasStanding: true, canActAs: true });
+	});
+
+	it("refuses a removed membership even if a stale projection still carries act_as", () => {
+		expect(
+			resolveAccountDelegationAccess({
+				kind: "bot",
+				relationship: "member",
+				callerMembership: membership(["account:act_as"], "removed"),
+			}),
+		).toEqual({ hasStanding: false, canActAs: false });
+	});
+
+	it("honours an explicit permission revoke on an owner membership projection", () => {
+		expect(
+			resolveAccountDelegationAccess({
+				kind: "bot",
+				relationship: "owner",
+				callerMembership: membership(["account:read"]),
+			}),
+		).toEqual({ hasStanding: true, canActAs: false });
+	});
+
+	it("fails closed when the node carries no relationship or kind", () => {
+		expect(resolveAccountDelegationAccess({})).toEqual({
+			hasStanding: false,
+			canActAs: false,
+		});
+		expect(
+			resolveAccountDelegationAccess({ relationship: "member", kind: null }),
+		).toEqual({
+			hasStanding: false,
+			canActAs: false,
+		});
+	});
+});