@oxy.so/core 1.10.0 → 1.12.0

package/src/models/interfaces.ts

@@ -115,6 +115,13 @@ export interface User {
    * lists, profile search) — the two are separate fields on the User document.
    */
   description?: string;
+  /**
+   * ActivityPub actor URIs this account is also known as — its live,
+   * OAuth-proven linked Mastodon-API accounts. Emitted by
+   * `GET /profiles/username/:username`; a relying app passes it to the shared
+   * actor builder (`@oxy.so/federation`) so its actor publishes it.
+   */
+  alsoKnownAs?: string[];
   phone?: string;
   address?: string;
   /** Legacy free-text birthday, kept for backward compatibility. Prefer `dateOfBirth`. */
@@ -263,7 +270,22 @@ export interface LoginResponse {
 export interface Notification {
   id: string;
   message: string;
-  // Add other notification fields as needed
+  /** One of `OXY_NOTIFICATION_TYPES` (`@oxy.so/contracts`). */
+  type?: string;
+  /**
+   * `system` notifications only (with `message`): the text an Oxy service sent
+   * about the recipient's own account. Render these two instead of composing a
+   * sentence from actor + entity.
+   */
+  title?: string;
+  /** `system` notifications only: an optional deep link (https or the sending app's scheme). */
+  url?: string;
+  /**
+   * What `entityId` names: `post` | `reply` | `profile`, or `app` — an opaque id
+   * in the notifying application's namespace (`system` notifications only).
+   */
+  entityType?: string;
+  entityId?: string;
 }
 
 export interface Wallet {
@@ -666,6 +688,13 @@ export interface ServiceAssetMetadata {
    * play. Treat absence as "no adaptive stream, play the progressive original".
    */
   hlsReadyAt?: string;
+  /**
+   * The Oxy user who owns the file (`null` for a system-owned file such as the
+   * federated media cache). PRESENT ONLY for Oxy's own applications (service
+   * tokens with `tier: 'internal'`), so a first-party service can check that an
+   * asset a user attached is really that user's. Absent for every other caller.
+   */
+  ownerUserId?: string | null;
 }
 
 /**

package/src/server/__tests__/securityHeaders.test.ts

@@ -211,6 +211,13 @@ describe('@oxy.so/core/server buildOxyPagesHeaders on a sensitive origin (ADR 00
     expect(sensitive).toContain('https://api.oxy.so');
     expect(sensitive).toContain("frame-ancestors 'none'");
   });
+
+  it('sends no-transform so the edge never injects the beacon, and only there', () => {
+    expect(buildOxyPagesHeaders({ sensitive: true })).toContain(
+      'Cache-Control: public, max-age=0, must-revalidate, no-transform',
+    );
+    expect(buildOxyPagesHeaders()).not.toContain('Cache-Control');
+  });
 });
 
 describe('@oxy.so/core/server extractInlineScripts', () => {

package/src/server/securityHeaders.ts

@@ -366,6 +366,11 @@ export interface OxyPagesHeadersOptions {
    * the app — is REMOVED from `script-src` and `connect-src`, so third-party
    * measurement cannot run there even when the zone has Web Analytics enabled.
    * A structural block in the policy the page is served with, not a build flag.
+   *
+   * It also sends `Cache-Control: no-transform`, which stops the edge from
+   * injecting the beacon at all — otherwise every page load logs a CSP
+   * violation for a script we never asked for. The rest of the value is Pages'
+   * own default, so caching is unchanged.
    */
   sensitive?: boolean;
   /**
@@ -429,6 +434,9 @@ export function buildOxyPagesHeaders(options: OxyPagesHeadersOptions = {}): stri
   if (options.hsts !== false) {
     lines.push('  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload');
   }
+  if (options.sensitive) {
+    lines.push('  Cache-Control: public, max-age=0, must-revalidate, no-transform');
+  }
   lines.push('');
   return lines.join('\n');
 }

package/src/session/__tests__/accountDialogController.test.ts

@@ -2469,3 +2469,176 @@ it('createAccountDialogController returns an AccountDialogController instance',
 // Ensure the exported type surface is reachable at compile time for binders.
 const _typecheck: MinimalUserData | null = null;
 void _typecheck;
+
+describe('AccountDialogController — choosing a device account row (OxyHQ/oxy#1375 items 20 and 21)', () => {
+  /**
+   * The device's directory as Commons leaves it: `qa` on the device and active,
+   * plus (when `withOrg`) an organization `qa` also operates.
+   */
+  const deviceDirectory = (activeContextId: string | null, withOrg = false) => ({
+    deviceId: 'device-1',
+    revision: 4,
+    activeContextId,
+    updatedAt: 1_720_000_000_000,
+    principals: [
+      {
+        id: 'p-qa',
+        userId: 'qa',
+        authuser: 0,
+        user: { id: 'qa', username: 'qatest0925' },
+        contexts: [
+          {
+            id: 'ctx-qa',
+            accountId: 'qa',
+            kind: 'personal' as const,
+            relationship: 'self' as const,
+            account: { id: 'qa', username: 'qatest0925' },
+            onDevice: true,
+            available: true,
+            active: activeContextId === 'ctx-qa',
+            lastUsedAt: null,
+          },
+          ...(withOrg
+            ? [
+                {
+                  id: 'ctx-qa-org',
+                  accountId: 'org',
+                  kind: 'organization' as const,
+                  relationship: 'owner' as const,
+                  account: { id: 'org', username: 'oxy' },
+                  onDevice: true,
+                  available: true,
+                  active: activeContextId === 'ctx-qa-org',
+                  lastUsedAt: null,
+                },
+              ]
+            : []),
+        ],
+      },
+    ],
+  });
+
+  const sharedSession: SessionLoginResponse = {
+    sessionId: 'sess-shared',
+    deviceId: 'device-1',
+    expiresAt: '2030-01-01T00:00:00Z',
+    accessToken: 'access-shared',
+    user: { id: 'qa', username: 'qatest0925', name: { displayName: 'QA' } },
+  };
+
+  /**
+   * A device that still lists `qa` (Commons holds the shared identity) while
+   * THIS app holds no bearer — Mention after "Sign out".
+   */
+  async function signedOutDevice(options: { withOrg?: boolean } = {}) {
+    const oxy = makeOxy();
+    const urls: string[] = [];
+    const sc = new TestSessionClient({
+      makeRequest: jest.fn(async (_method: string, url: string) => {
+        urls.push(url);
+        if (url === '/session/device/directory') return deviceDirectory('ctx-qa', options.withOrg);
+        if (url === '/session/device/activate') {
+          return { directory: { ...deviceDirectory('ctx-qa-org', true), revision: 5 }, activeToken: null };
+        }
+        return undefined;
+      }),
+      getBaseURL: () => 'http://test.invalid',
+      getAccessToken: () => oxy.getAccessToken(),
+      getDeviceCredential: () => null,
+      onTokensChanged: () => () => undefined,
+      setTokens: jest.fn(),
+      getCurrentAccountId: () => null,
+    });
+    // The directory this client read while it was still signed in.
+    await sc.refreshDirectory();
+    oxy.emitTokenChange(null);
+    const commitSession = jest.fn().mockResolvedValue(undefined);
+    const onSignedIn = jest.fn();
+    const controller = createAccountDialogController({
+      oxyServices: oxy as unknown as OxyServices,
+      sessionClient: sc,
+      clientId: 'oxy_dk_test',
+      commitSession,
+      onSignedIn,
+    });
+    controller.start();
+    await flush();
+    urls.length = 0;
+    return { controller, oxy, sc, urls, commitSession, onSignedIn };
+  }
+
+  it('publishes that this client is signed out while the device still lists an active account', async () => {
+    const { controller } = await signedOutDevice();
+    const snap = controller.getSnapshot();
+    expect(snap.hasSession).toBe(false);
+    // The precondition of the bug: the row the sheet renders reads as "active".
+    expect(snap.activeContext?.contextId).toBe('ctx-qa');
+    controller.destroy();
+  });
+
+  it('signed out, choosing the listed account signs in through the shared identity, like "Continue with Oxy"', async () => {
+    const { controller, oxy, urls, commitSession, onSignedIn } = await signedOutDevice();
+    oxy.signInWithSharedIdentity.mockResolvedValue(sharedSession);
+
+    // It used to short-circuit on "already the active row" and report success,
+    // closing the sheet on an app that was still signed out.
+    expect(await controller.chooseContext('ctx-qa')).toBe('signing-in');
+
+    expect(oxy.signInWithSharedIdentity).toHaveBeenCalledWith({ plantTokens: false });
+    expect(commitSession).toHaveBeenCalledWith(expect.objectContaining({ sessionId: 'sess-shared' }));
+    expect(onSignedIn).toHaveBeenCalledWith(expect.objectContaining({ id: 'qa' }));
+    expect(controller.getSnapshot().hasSession).toBe(true);
+    expect(controller.getSnapshot().signIn.phase).toBe('completed');
+    // The silent mint already landed on the chosen pair: no switch on top.
+    expect(urls).not.toContain('/session/device/activate');
+    controller.destroy();
+  });
+
+  it('signed out with no shared identity, choosing the account starts the same request "Continue with Oxy" does', async () => {
+    const { controller, oxy, onSignedIn } = await signedOutDevice();
+    oxy.signInWithSharedIdentity.mockResolvedValue(null);
+    oxy.startCommonsSignIn.mockResolvedValue({
+      sessionToken: 'secret-tok',
+      authorizeCode: 'AUTH-CODE',
+      qrPayload: 'oxycommons://approve?v=1&code=AUTH-CODE',
+      expiresAt: Date.now() + 300_000,
+      status: 'pending',
+    });
+
+    expect(await controller.chooseContext('ctx-qa')).toBe('signing-in');
+
+    expect(oxy.startCommonsSignIn).toHaveBeenCalledWith({ clientId: 'oxy_dk_test' });
+    expect(controller.getSnapshot().view).toBe('qr');
+    expect(controller.getSnapshot().signIn.phase).toBe('waiting');
+    expect(onSignedIn).not.toHaveBeenCalled();
+    controller.destroy();
+  });
+
+  it('signed out, choosing an organization row signs in and then activates that row', async () => {
+    const { controller, oxy, urls } = await signedOutDevice({ withOrg: true });
+    oxy.signInWithSharedIdentity.mockResolvedValue(sharedSession);
+
+    expect(await controller.chooseContext('ctx-qa-org')).toBe('switched');
+
+    expect(oxy.signInWithSharedIdentity).toHaveBeenCalledTimes(1);
+    expect(urls).toContain('/session/device/activate');
+    expect(controller.getSnapshot().activeContext?.contextId).toBe('ctx-qa-org');
+    controller.destroy();
+  });
+
+  it('signed in, the active row is "current" and any other row is a switch', async () => {
+    const { controller, oxy, urls } = await signedOutDevice({ withOrg: true });
+    oxy.emitTokenChange('access-token');
+    await flush();
+    urls.length = 0;
+    expect(controller.getSnapshot().hasSession).toBe(true);
+
+    expect(await controller.chooseContext('ctx-qa')).toBe('current');
+    expect(urls).not.toContain('/session/device/activate');
+
+    expect(await controller.chooseContext('ctx-qa-org')).toBe('switched');
+    expect(urls).toContain('/session/device/activate');
+    expect(oxy.signInWithSharedIdentity).not.toHaveBeenCalled();
+    controller.destroy();
+  });
+});

package/src/session/__tests__/accountDialogShape.test.ts

@@ -68,6 +68,7 @@ const SNAPSHOT_KEYS = [
   'commonsAvailability',
   'directory',
   'error',
+  'hasSession',
   'loading',
   'removingContextId',
   'removingPrincipalId',

package/src/session/accountDialogController.ts

@@ -310,6 +310,16 @@ export interface AccountDialogSnapshot {
    * table of their own.
    */
   backView: AccountDialogView | null;
+  /**
+   * Whether THIS client is signed in: a bearer is planted.
+   *
+   * Not the same question as "does the directory list anyone". The directory is
+   * the DEVICE's, and a device can go on listing a shared identity (Commons, or a
+   * sibling app) after this app signed out. A host names its sign-in entry, and
+   * whether a listed account reads as the current one, from this — never from
+   * the directory's size.
+   */
+  hasSession: boolean;
   /**
    * The server-authoritative device directory — principals and the contexts
    * each may act as (ADR 0002) — or `null` before the first read.
@@ -337,6 +347,21 @@ export interface AccountDialogSnapshot {
   commonsAvailability: CommonsAvailability;
 }
 
+/**
+ * What {@link AccountDialogController.chooseContext} did with a chosen row.
+ *
+ * - `'current'` — the row is already the active account; nothing to do.
+ * - `'switched'` — the switch to the row happened (signed in; or signed out,
+ *   after the silent sign-in landed on a different pair and the chosen one was
+ *   then activated).
+ * - `'signing-in'` — signed out: the row started "Continue with Oxy", and the
+ *   sign-in flow (its own view, its own completion) owns what happens next —
+ *   including closing the dialog, through `onSignedIn`.
+ * - `'failed'` — the switch was attempted and failed (the reason is `error`).
+ * - `'busy'` — another device mutation is in flight; the press was dropped.
+ */
+export type ContextChoiceOutcome = 'current' | 'switched' | 'signing-in' | 'failed' | 'busy';
+
 /** Construction options for {@link AccountDialogController}. */
 export interface AccountDialogControllerOptions {
   /** The API client. Source of graph accounts, profiles, and the sign-in methods. */
@@ -880,6 +905,45 @@ export class AccountDialogController {
     );
   }
 
+  /**
+   * A device account row was chosen — the one entry point for "use this
+   * account", whether or not anybody is signed in here.
+   *
+   * Signed in, it is a switch: the active row is already the answer
+   * (`'current'`), any other row is {@link activateContext}.
+   *
+   * Signed out, it is NOT a switch. The row is on the list because the DEVICE
+   * still holds that identity (Commons' shared identity, or a sibling app's
+   * session), not because this app does, so there is no bearer to activate a
+   * context with — and the active-row short-circuit used to read that stale
+   * "active" as "already signed in" and close the sheet on a signed-out app
+   * (OxyHQ/oxy#1375 item 20). Choosing the row is "Continue as @handle": the
+   * same {@link signInWithOxy} path as the "Continue with Oxy" button, which
+   * mints silently from the shared identity and otherwise falls back to the
+   * request. When that silent mint lands on a different pair from the one
+   * chosen (a device holding more than one person, or an organization row), the
+   * chosen row is then activated under the new bearer, so the press ends where
+   * it pointed.
+   */
+  async chooseContext(contextId: string): Promise<ContextChoiceOutcome> {
+    if (this.isDeviceMutationInFlight()) return 'busy';
+    if (this.hasSession()) {
+      if (contextId === this.snapshot.activeContext?.contextId) return 'current';
+      return (await this.activateContext(contextId)) ? 'switched' : 'failed';
+    }
+    await this.signInWithOxy();
+    // Only a sign-in that finished here (the silent shared-identity mint) can be
+    // steered to the chosen row; a request still waiting on approval belongs to
+    // whoever approves it.
+    if (this.signIn.phase !== 'completed' || !this.hasSession()) return 'signing-in';
+    const directory = this.sessionClient.getDirectory();
+    const offered = directory?.principals.some((principal) =>
+      principal.contexts.some((context) => context.id === contextId),
+    );
+    if (!offered || resolveActiveContext(directory)?.contextId === contextId) return 'signing-in';
+    return (await this.activateContext(contextId)) ? 'switched' : 'signing-in';
+  }
+
   /**
    * Remove ONE `principal → account` pair, and only that pair.
    *
@@ -1780,6 +1844,7 @@ export class AccountDialogController {
     return {
       view,
       backView: backViewOf(view, hasSession),
+      hasSession,
       directory,
       activeContext: resolveActiveContext(directory),
       loading: this.loading,