@oxy.so/core 1.12.0 → 1.12.1

package/dist/types/mixins/OxyServices.user.d.ts

@@ -97,6 +97,13 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
          */
         _serviceApiKey: string | null;
         _serviceApiSecret: string | null;
+        /**
+         * Whether this process can mint a service token by attesting what it is
+         * (ADR 0026), defined on the auth mixin. A host with no key pair that CAN
+         * attest is a first-party backend exactly like one with a key pair, and
+         * `getUsersByIds` must treat it as one.
+         */
+        _canUseWorkloadIdentity: () => Promise<boolean>;
         /**
          * Get profile by username.
          *
@@ -229,8 +236,10 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
          * caller, and returns the SAME public `{ data: PublicUserProfile[] }`
          * payload (canonical `name.displayName` + `_count`) in every case — no
          * viewer-specific fields. This method picks the path automatically:
-         * - **Service-configured host (backend):** when `configureServiceAuth(apiKey,
-         *   apiSecret)` has been called, the chunk is fetched via `makeServiceRequest`
+         * - **Service host (backend):** when `configureServiceAuth(apiKey,
+         *   apiSecret)` has been called, OR the process can attest its workload
+         *   identity (ADR 0026 — an ECS task with no key pair), the chunk is fetched
+         *   via `makeServiceRequest`
          *   (attaches `Authorization: Bearer <serviceToken>`). This is the
          *   server-to-server feed/notification hydration path (e.g. Mention's
          *   `PostHydrationService`) and is unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "1.12.0",
+  "version": "1.12.1",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/mixins/OxyServices.user.ts

@@ -155,6 +155,14 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
     declare _serviceApiKey: string | null;
     declare _serviceApiSecret: string | null;
 
+    /**
+     * Whether this process can mint a service token by attesting what it is
+     * (ADR 0026), defined on the auth mixin. A host with no key pair that CAN
+     * attest is a first-party backend exactly like one with a key pair, and
+     * `getUsersByIds` must treat it as one.
+     */
+    declare _canUseWorkloadIdentity: () => Promise<boolean>;
+
     /**
      * Get profile by username.
      *
@@ -464,8 +472,10 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
      * caller, and returns the SAME public `{ data: PublicUserProfile[] }`
      * payload (canonical `name.displayName` + `_count`) in every case — no
      * viewer-specific fields. This method picks the path automatically:
-     * - **Service-configured host (backend):** when `configureServiceAuth(apiKey,
-     *   apiSecret)` has been called, the chunk is fetched via `makeServiceRequest`
+     * - **Service host (backend):** when `configureServiceAuth(apiKey,
+     *   apiSecret)` has been called, OR the process can attest its workload
+     *   identity (ADR 0026 — an ECS task with no key pair), the chunk is fetched
+     *   via `makeServiceRequest`
      *   (attaches `Authorization: Bearer <serviceToken>`). This is the
      *   server-to-server feed/notification hydration path (e.g. Mention's
      *   `PostHydrationService`) and is unchanged.
@@ -500,10 +510,17 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
         chunks.push(uniqueIds.slice(i, i + USERS_BY_IDS_CHUNK_SIZE));
       }
 
-      // A backend that called configureServiceAuth() uses the bearer-service
-      // path; any other caller (browser / RN with a user session) uses the
-      // user-bearer path.
-      const useServiceAuth = Boolean(this._serviceApiKey && this._serviceApiSecret);
+      // A backend uses the bearer-service path; any other caller (browser / RN
+      // with a user session) uses the user-bearer path. "A backend" means one
+      // that can get a service token at all — a key pair, OR a task role it can
+      // attest. Asking only about the key pair sent every attested backend down
+      // the user path with no bearer: an anonymous request, charged to the
+      // shared NAT address's per-IP budget and slowed by its 500ms penalty.
+      // Measured from Mention's task (2026-09-25): 520ms per anonymous chunk
+      // against 20ms with the service token, enough to put its 1.5s hydration
+      // deadline out of reach on every cache miss.
+      const useServiceAuth = Boolean(this._serviceApiKey && this._serviceApiSecret)
+        || await this._canUseWorkloadIdentity();
 
       // Run chunks concurrently; a single chunk failure must not sink the rest.
       const settled = await Promise.all(

package/src/mixins/__tests__/getUsersByIds.test.ts

@@ -110,6 +110,33 @@ describe('OxyServices.getUsersByIds — dual-mode auth', () => {
     });
   });
 
+  describe('with an attestable workload identity and no key pair (ADR 0026 backend)', () => {
+    it('uses makeServiceRequest — an attested backend is still a backend', async () => {
+      jest
+        .spyOn(oxy as unknown as { _canUseWorkloadIdentity: () => Promise<boolean> }, '_canUseWorkloadIdentity')
+        .mockResolvedValue(true);
+      makeServiceRequestSpy.mockResolvedValueOnce([makeRawUser('a')]);
+
+      const result = await oxy.getUsersByIds(['a']);
+
+      expect(makeRequestSpy).not.toHaveBeenCalled();
+      expect(makeServiceRequestSpy).toHaveBeenCalledWith('POST', '/users/by-ids', { ids: ['a'] });
+      expect(result).toHaveLength(1);
+    });
+
+    it('stays on the user path when the host cannot attest', async () => {
+      jest
+        .spyOn(oxy as unknown as { _canUseWorkloadIdentity: () => Promise<boolean> }, '_canUseWorkloadIdentity')
+        .mockResolvedValue(false);
+      makeRequestSpy.mockResolvedValueOnce([makeRawUser('a')]);
+
+      await oxy.getUsersByIds(['a']);
+
+      expect(makeServiceRequestSpy).not.toHaveBeenCalled();
+      expect(makeRequestSpy).toHaveBeenCalledWith('POST', '/users/by-ids', { ids: ['a'] }, { cache: false });
+    });
+  });
+
   describe('chunking + resilience (applies to both modes)', () => {
     it('chunks at 100 ids per request on the user path and flattens results', async () => {
       const ids = Array.from({ length: 250 }, (_, i) => `id-${i}`);