@oxy.so/core 1.11.0 → 1.12.0

package/dist/types/index.d.ts

@@ -130,7 +130,7 @@ export { isSwitchTargetAccount, canSwitchIntoAccount, } from './session/accountS
 export { resolveAccountDelegationAccess } from './session/accountDelegationAccess';
 export type { AccountDelegationAccess, AccountDelegationNode, } from './session/accountDelegationAccess';
 export { AccountDialogController, createAccountDialogController, } from './session/accountDialogController';
-export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, PopupWindowHandle, SignInFailureReason, SignInFlowPhase, SignInFlowState, SignInProgress, } from './session/accountDialogController';
+export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, ContextChoiceOutcome, PopupWindowHandle, SignInFailureReason, SignInFlowPhase, SignInFlowState, SignInProgress, } from './session/accountDialogController';
 export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, } from './session/authStateStore';
 export type { PersistedAuthState, AuthStateStore, NativeKeyValueStorage, } from './session/authStateStore';
 export { createSharedMirroringAuthStateStore, decideSharedDeviceJoin, decideSharedDevicePublish, normalizeSharedDeviceSessionRead, publishProvenDeviceCredential, readLocalDeviceCredential, } from './session/sharedDeviceCredential';

package/dist/types/session/accountDialogController.d.ts

@@ -233,6 +233,16 @@ export interface AccountDialogSnapshot {
      * table of their own.
      */
     backView: AccountDialogView | null;
+    /**
+     * Whether THIS client is signed in: a bearer is planted.
+     *
+     * Not the same question as "does the directory list anyone". The directory is
+     * the DEVICE's, and a device can go on listing a shared identity (Commons, or a
+     * sibling app) after this app signed out. A host names its sign-in entry, and
+     * whether a listed account reads as the current one, from this — never from
+     * the directory's size.
+     */
+    hasSession: boolean;
     /**
      * The server-authoritative device directory — principals and the contexts
      * each may act as (ADR 0002) — or `null` before the first read.
@@ -259,6 +269,20 @@ export interface AccountDialogSnapshot {
     /** Whether Commons is installed on this device. See {@link CommonsAvailability}. */
     commonsAvailability: CommonsAvailability;
 }
+/**
+ * What {@link AccountDialogController.chooseContext} did with a chosen row.
+ *
+ * - `'current'` — the row is already the active account; nothing to do.
+ * - `'switched'` — the switch to the row happened (signed in; or signed out,
+ *   after the silent sign-in landed on a different pair and the chosen one was
+ *   then activated).
+ * - `'signing-in'` — signed out: the row started "Continue with Oxy", and the
+ *   sign-in flow (its own view, its own completion) owns what happens next —
+ *   including closing the dialog, through `onSignedIn`.
+ * - `'failed'` — the switch was attempted and failed (the reason is `error`).
+ * - `'busy'` — another device mutation is in flight; the press was dropped.
+ */
+export type ContextChoiceOutcome = 'current' | 'switched' | 'signing-in' | 'failed' | 'busy';
 /** Construction options for {@link AccountDialogController}. */
 export interface AccountDialogControllerOptions {
     /** The API client. Source of graph accounts, profiles, and the sign-in methods. */
@@ -525,6 +549,27 @@ export declare class AccountDialogController {
      * device mutation is in flight ({@link isDeviceMutationInFlight}).
      */
     activateContext(contextId: string): Promise<boolean>;
+    /**
+     * A device account row was chosen — the one entry point for "use this
+     * account", whether or not anybody is signed in here.
+     *
+     * Signed in, it is a switch: the active row is already the answer
+     * (`'current'`), any other row is {@link activateContext}.
+     *
+     * Signed out, it is NOT a switch. The row is on the list because the DEVICE
+     * still holds that identity (Commons' shared identity, or a sibling app's
+     * session), not because this app does, so there is no bearer to activate a
+     * context with — and the active-row short-circuit used to read that stale
+     * "active" as "already signed in" and close the sheet on a signed-out app
+     * (OxyHQ/oxy#1375 item 20). Choosing the row is "Continue as @handle": the
+     * same {@link signInWithOxy} path as the "Continue with Oxy" button, which
+     * mints silently from the shared identity and otherwise falls back to the
+     * request. When that silent mint lands on a different pair from the one
+     * chosen (a device holding more than one person, or an organization row), the
+     * chosen row is then activated under the new bearer, so the press ends where
+     * it pointed.
+     */
+    chooseContext(contextId: string): Promise<ContextChoiceOutcome>;
     /**
      * Remove ONE `principal → account` pair, and only that pair.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/index.ts

@@ -819,6 +819,7 @@ export type {
     AccountDialogSnapshot,
     AccountDialogView,
     CommonsAvailability,
+    ContextChoiceOutcome,
     PopupWindowHandle,
     SignInFailureReason,
     SignInFlowPhase,

package/src/session/__tests__/accountDialogController.test.ts

@@ -2469,3 +2469,176 @@ it('createAccountDialogController returns an AccountDialogController instance',
 // Ensure the exported type surface is reachable at compile time for binders.
 const _typecheck: MinimalUserData | null = null;
 void _typecheck;
+
+describe('AccountDialogController — choosing a device account row (OxyHQ/oxy#1375 items 20 and 21)', () => {
+  /**
+   * The device's directory as Commons leaves it: `qa` on the device and active,
+   * plus (when `withOrg`) an organization `qa` also operates.
+   */
+  const deviceDirectory = (activeContextId: string | null, withOrg = false) => ({
+    deviceId: 'device-1',
+    revision: 4,
+    activeContextId,
+    updatedAt: 1_720_000_000_000,
+    principals: [
+      {
+        id: 'p-qa',
+        userId: 'qa',
+        authuser: 0,
+        user: { id: 'qa', username: 'qatest0925' },
+        contexts: [
+          {
+            id: 'ctx-qa',
+            accountId: 'qa',
+            kind: 'personal' as const,
+            relationship: 'self' as const,
+            account: { id: 'qa', username: 'qatest0925' },
+            onDevice: true,
+            available: true,
+            active: activeContextId === 'ctx-qa',
+            lastUsedAt: null,
+          },
+          ...(withOrg
+            ? [
+                {
+                  id: 'ctx-qa-org',
+                  accountId: 'org',
+                  kind: 'organization' as const,
+                  relationship: 'owner' as const,
+                  account: { id: 'org', username: 'oxy' },
+                  onDevice: true,
+                  available: true,
+                  active: activeContextId === 'ctx-qa-org',
+                  lastUsedAt: null,
+                },
+              ]
+            : []),
+        ],
+      },
+    ],
+  });
+
+  const sharedSession: SessionLoginResponse = {
+    sessionId: 'sess-shared',
+    deviceId: 'device-1',
+    expiresAt: '2030-01-01T00:00:00Z',
+    accessToken: 'access-shared',
+    user: { id: 'qa', username: 'qatest0925', name: { displayName: 'QA' } },
+  };
+
+  /**
+   * A device that still lists `qa` (Commons holds the shared identity) while
+   * THIS app holds no bearer — Mention after "Sign out".
+   */
+  async function signedOutDevice(options: { withOrg?: boolean } = {}) {
+    const oxy = makeOxy();
+    const urls: string[] = [];
+    const sc = new TestSessionClient({
+      makeRequest: jest.fn(async (_method: string, url: string) => {
+        urls.push(url);
+        if (url === '/session/device/directory') return deviceDirectory('ctx-qa', options.withOrg);
+        if (url === '/session/device/activate') {
+          return { directory: { ...deviceDirectory('ctx-qa-org', true), revision: 5 }, activeToken: null };
+        }
+        return undefined;
+      }),
+      getBaseURL: () => 'http://test.invalid',
+      getAccessToken: () => oxy.getAccessToken(),
+      getDeviceCredential: () => null,
+      onTokensChanged: () => () => undefined,
+      setTokens: jest.fn(),
+      getCurrentAccountId: () => null,
+    });
+    // The directory this client read while it was still signed in.
+    await sc.refreshDirectory();
+    oxy.emitTokenChange(null);
+    const commitSession = jest.fn().mockResolvedValue(undefined);
+    const onSignedIn = jest.fn();
+    const controller = createAccountDialogController({
+      oxyServices: oxy as unknown as OxyServices,
+      sessionClient: sc,
+      clientId: 'oxy_dk_test',
+      commitSession,
+      onSignedIn,
+    });
+    controller.start();
+    await flush();
+    urls.length = 0;
+    return { controller, oxy, sc, urls, commitSession, onSignedIn };
+  }
+
+  it('publishes that this client is signed out while the device still lists an active account', async () => {
+    const { controller } = await signedOutDevice();
+    const snap = controller.getSnapshot();
+    expect(snap.hasSession).toBe(false);
+    // The precondition of the bug: the row the sheet renders reads as "active".
+    expect(snap.activeContext?.contextId).toBe('ctx-qa');
+    controller.destroy();
+  });
+
+  it('signed out, choosing the listed account signs in through the shared identity, like "Continue with Oxy"', async () => {
+    const { controller, oxy, urls, commitSession, onSignedIn } = await signedOutDevice();
+    oxy.signInWithSharedIdentity.mockResolvedValue(sharedSession);
+
+    // It used to short-circuit on "already the active row" and report success,
+    // closing the sheet on an app that was still signed out.
+    expect(await controller.chooseContext('ctx-qa')).toBe('signing-in');
+
+    expect(oxy.signInWithSharedIdentity).toHaveBeenCalledWith({ plantTokens: false });
+    expect(commitSession).toHaveBeenCalledWith(expect.objectContaining({ sessionId: 'sess-shared' }));
+    expect(onSignedIn).toHaveBeenCalledWith(expect.objectContaining({ id: 'qa' }));
+    expect(controller.getSnapshot().hasSession).toBe(true);
+    expect(controller.getSnapshot().signIn.phase).toBe('completed');
+    // The silent mint already landed on the chosen pair: no switch on top.
+    expect(urls).not.toContain('/session/device/activate');
+    controller.destroy();
+  });
+
+  it('signed out with no shared identity, choosing the account starts the same request "Continue with Oxy" does', async () => {
+    const { controller, oxy, onSignedIn } = await signedOutDevice();
+    oxy.signInWithSharedIdentity.mockResolvedValue(null);
+    oxy.startCommonsSignIn.mockResolvedValue({
+      sessionToken: 'secret-tok',
+      authorizeCode: 'AUTH-CODE',
+      qrPayload: 'oxycommons://approve?v=1&code=AUTH-CODE',
+      expiresAt: Date.now() + 300_000,
+      status: 'pending',
+    });
+
+    expect(await controller.chooseContext('ctx-qa')).toBe('signing-in');
+
+    expect(oxy.startCommonsSignIn).toHaveBeenCalledWith({ clientId: 'oxy_dk_test' });
+    expect(controller.getSnapshot().view).toBe('qr');
+    expect(controller.getSnapshot().signIn.phase).toBe('waiting');
+    expect(onSignedIn).not.toHaveBeenCalled();
+    controller.destroy();
+  });
+
+  it('signed out, choosing an organization row signs in and then activates that row', async () => {
+    const { controller, oxy, urls } = await signedOutDevice({ withOrg: true });
+    oxy.signInWithSharedIdentity.mockResolvedValue(sharedSession);
+
+    expect(await controller.chooseContext('ctx-qa-org')).toBe('switched');
+
+    expect(oxy.signInWithSharedIdentity).toHaveBeenCalledTimes(1);
+    expect(urls).toContain('/session/device/activate');
+    expect(controller.getSnapshot().activeContext?.contextId).toBe('ctx-qa-org');
+    controller.destroy();
+  });
+
+  it('signed in, the active row is "current" and any other row is a switch', async () => {
+    const { controller, oxy, urls } = await signedOutDevice({ withOrg: true });
+    oxy.emitTokenChange('access-token');
+    await flush();
+    urls.length = 0;
+    expect(controller.getSnapshot().hasSession).toBe(true);
+
+    expect(await controller.chooseContext('ctx-qa')).toBe('current');
+    expect(urls).not.toContain('/session/device/activate');
+
+    expect(await controller.chooseContext('ctx-qa-org')).toBe('switched');
+    expect(urls).toContain('/session/device/activate');
+    expect(oxy.signInWithSharedIdentity).not.toHaveBeenCalled();
+    controller.destroy();
+  });
+});

package/src/session/__tests__/accountDialogShape.test.ts

@@ -68,6 +68,7 @@ const SNAPSHOT_KEYS = [
   'commonsAvailability',
   'directory',
   'error',
+  'hasSession',
   'loading',
   'removingContextId',
   'removingPrincipalId',

package/src/session/accountDialogController.ts

@@ -310,6 +310,16 @@ export interface AccountDialogSnapshot {
    * table of their own.
    */
   backView: AccountDialogView | null;
+  /**
+   * Whether THIS client is signed in: a bearer is planted.
+   *
+   * Not the same question as "does the directory list anyone". The directory is
+   * the DEVICE's, and a device can go on listing a shared identity (Commons, or a
+   * sibling app) after this app signed out. A host names its sign-in entry, and
+   * whether a listed account reads as the current one, from this — never from
+   * the directory's size.
+   */
+  hasSession: boolean;
   /**
    * The server-authoritative device directory — principals and the contexts
    * each may act as (ADR 0002) — or `null` before the first read.
@@ -337,6 +347,21 @@ export interface AccountDialogSnapshot {
   commonsAvailability: CommonsAvailability;
 }
 
+/**
+ * What {@link AccountDialogController.chooseContext} did with a chosen row.
+ *
+ * - `'current'` — the row is already the active account; nothing to do.
+ * - `'switched'` — the switch to the row happened (signed in; or signed out,
+ *   after the silent sign-in landed on a different pair and the chosen one was
+ *   then activated).
+ * - `'signing-in'` — signed out: the row started "Continue with Oxy", and the
+ *   sign-in flow (its own view, its own completion) owns what happens next —
+ *   including closing the dialog, through `onSignedIn`.
+ * - `'failed'` — the switch was attempted and failed (the reason is `error`).
+ * - `'busy'` — another device mutation is in flight; the press was dropped.
+ */
+export type ContextChoiceOutcome = 'current' | 'switched' | 'signing-in' | 'failed' | 'busy';
+
 /** Construction options for {@link AccountDialogController}. */
 export interface AccountDialogControllerOptions {
   /** The API client. Source of graph accounts, profiles, and the sign-in methods. */
@@ -880,6 +905,45 @@ export class AccountDialogController {
     );
   }
 
+  /**
+   * A device account row was chosen — the one entry point for "use this
+   * account", whether or not anybody is signed in here.
+   *
+   * Signed in, it is a switch: the active row is already the answer
+   * (`'current'`), any other row is {@link activateContext}.
+   *
+   * Signed out, it is NOT a switch. The row is on the list because the DEVICE
+   * still holds that identity (Commons' shared identity, or a sibling app's
+   * session), not because this app does, so there is no bearer to activate a
+   * context with — and the active-row short-circuit used to read that stale
+   * "active" as "already signed in" and close the sheet on a signed-out app
+   * (OxyHQ/oxy#1375 item 20). Choosing the row is "Continue as @handle": the
+   * same {@link signInWithOxy} path as the "Continue with Oxy" button, which
+   * mints silently from the shared identity and otherwise falls back to the
+   * request. When that silent mint lands on a different pair from the one
+   * chosen (a device holding more than one person, or an organization row), the
+   * chosen row is then activated under the new bearer, so the press ends where
+   * it pointed.
+   */
+  async chooseContext(contextId: string): Promise<ContextChoiceOutcome> {
+    if (this.isDeviceMutationInFlight()) return 'busy';
+    if (this.hasSession()) {
+      if (contextId === this.snapshot.activeContext?.contextId) return 'current';
+      return (await this.activateContext(contextId)) ? 'switched' : 'failed';
+    }
+    await this.signInWithOxy();
+    // Only a sign-in that finished here (the silent shared-identity mint) can be
+    // steered to the chosen row; a request still waiting on approval belongs to
+    // whoever approves it.
+    if (this.signIn.phase !== 'completed' || !this.hasSession()) return 'signing-in';
+    const directory = this.sessionClient.getDirectory();
+    const offered = directory?.principals.some((principal) =>
+      principal.contexts.some((context) => context.id === contextId),
+    );
+    if (!offered || resolveActiveContext(directory)?.contextId === contextId) return 'signing-in';
+    return (await this.activateContext(contextId)) ? 'switched' : 'signing-in';
+  }
+
   /**
    * Remove ONE `principal → account` pair, and only that pair.
    *
@@ -1780,6 +1844,7 @@ export class AccountDialogController {
     return {
       view,
       backView: backViewOf(view, hasSession),
+      hasSession,
       directory,
       activeContext: resolveActiveContext(directory),
       loading: this.loading,