@oxy.so/core 1.12.1 → 1.13.0

package/dist/esm/i18n/locales/en-US.json

@@ -1934,7 +1934,17 @@
         "warning": "This action cannot be undone. Your account and all associated data will be permanently deleted.",
         "confirmLabel": "Type \"{{username}}\" to confirm",
         "confirm": "Delete Forever",
-        "error": "Failed to delete account"
+        "error": "Failed to delete account",
+        "handoff": {
+            "commonsTitle": "Delete your account in Oxy Commons",
+            "commonsMessage": "Your identity key is kept by Oxy Commons on this device, and deleting your account needs it. Commons will open on Settings > Delete account to finish.",
+            "openCommons": "Open Oxy Commons",
+            "commonsOpenFailed": "Couldn't open Oxy Commons. Open it yourself and go to Settings > Delete account.",
+            "elsewhereTitle": "Delete your account where your identity is",
+            "elsewhereMessage": "Deleting your account needs your identity key, and it isn't on this device. Open Oxy Commons on the device that holds your identity and go to Settings > Delete account, or open {{site}} in a browser that holds it.",
+            "gotIt": "Got it",
+            "identityUnreadable": "Couldn't read this device's identity storage. Unlock your device and try again."
+        }
     },
     "manageAccount": {
         "title": "Manage your Oxy Account",

package/dist/esm/i18n/locales/es-ES.json

@@ -1934,7 +1934,17 @@
         "warning": "Esta acción no se puede deshacer. Tu cuenta y todos los datos asociados se eliminarán de forma permanente.",
         "confirmLabel": "Escribe \"{{username}}\" para confirmar",
         "confirm": "Eliminar para siempre",
-        "error": "No se pudo eliminar la cuenta"
+        "error": "No se pudo eliminar la cuenta",
+        "handoff": {
+            "commonsTitle": "Elimina tu cuenta en Oxy Commons",
+            "commonsMessage": "Tu clave de identidad la guarda Oxy Commons en este dispositivo, y eliminar tu cuenta la necesita. Commons se abrirá en Ajustes > Eliminar cuenta para terminar.",
+            "openCommons": "Abrir Oxy Commons",
+            "commonsOpenFailed": "No se pudo abrir Oxy Commons. Ábrelo tú y ve a Ajustes > Eliminar cuenta.",
+            "elsewhereTitle": "Elimina tu cuenta donde está tu identidad",
+            "elsewhereMessage": "Eliminar tu cuenta necesita tu clave de identidad, y no está en este dispositivo. Abre Oxy Commons en el dispositivo que guarda tu identidad y ve a Ajustes > Eliminar cuenta, o abre {{site}} en un navegador que la guarde.",
+            "gotIt": "Entendido",
+            "identityUnreadable": "No se pudo leer el almacén de identidad de este dispositivo. Desbloquea el dispositivo e inténtalo de nuevo."
+        }
     },
     "manageAccount": {
         "title": "Gestiona tu cuenta de Oxy",

package/dist/esm/i18n/locales/locales/en-US.json

@@ -1934,7 +1934,17 @@
     "warning": "This action cannot be undone. Your account and all associated data will be permanently deleted.",
     "confirmLabel": "Type \"{{username}}\" to confirm",
     "confirm": "Delete Forever",
-    "error": "Failed to delete account"
+    "error": "Failed to delete account",
+    "handoff": {
+      "commonsTitle": "Delete your account in Oxy Commons",
+      "commonsMessage": "Your identity key is kept by Oxy Commons on this device, and deleting your account needs it. Commons will open on Settings > Delete account to finish.",
+      "openCommons": "Open Oxy Commons",
+      "commonsOpenFailed": "Couldn't open Oxy Commons. Open it yourself and go to Settings > Delete account.",
+      "elsewhereTitle": "Delete your account where your identity is",
+      "elsewhereMessage": "Deleting your account needs your identity key, and it isn't on this device. Open Oxy Commons on the device that holds your identity and go to Settings > Delete account, or open {{site}} in a browser that holds it.",
+      "gotIt": "Got it",
+      "identityUnreadable": "Couldn't read this device's identity storage. Unlock your device and try again."
+    }
   },
   "manageAccount": {
     "title": "Manage your Oxy Account",

package/dist/esm/i18n/locales/locales/es-ES.json

@@ -1934,7 +1934,17 @@
     "warning": "Esta acción no se puede deshacer. Tu cuenta y todos los datos asociados se eliminarán de forma permanente.",
     "confirmLabel": "Escribe \"{{username}}\" para confirmar",
     "confirm": "Eliminar para siempre",
-    "error": "No se pudo eliminar la cuenta"
+    "error": "No se pudo eliminar la cuenta",
+    "handoff": {
+      "commonsTitle": "Elimina tu cuenta en Oxy Commons",
+      "commonsMessage": "Tu clave de identidad la guarda Oxy Commons en este dispositivo, y eliminar tu cuenta la necesita. Commons se abrirá en Ajustes > Eliminar cuenta para terminar.",
+      "openCommons": "Abrir Oxy Commons",
+      "commonsOpenFailed": "No se pudo abrir Oxy Commons. Ábrelo tú y ve a Ajustes > Eliminar cuenta.",
+      "elsewhereTitle": "Elimina tu cuenta donde está tu identidad",
+      "elsewhereMessage": "Eliminar tu cuenta necesita tu clave de identidad, y no está en este dispositivo. Abre Oxy Commons en el dispositivo que guarda tu identidad y ve a Ajustes > Eliminar cuenta, o abre {{site}} en un navegador que la guarde.",
+      "gotIt": "Entendido",
+      "identityUnreadable": "No se pudo leer el almacén de identidad de este dispositivo. Desbloquea el dispositivo e inténtalo de nuevo."
+    }
   },
   "manageAccount": {
     "title": "Gestiona tu cuenta de Oxy",

package/dist/esm/index.js

@@ -34,6 +34,7 @@ export { getCommonsApprovalBlockingReason, parseCommonsApprovalExpiresAt, } from
 // Automatic "Sign in with Oxy" delivery selection — ONE pure decision that maps
 // the caller's facts onto exactly one primary route (open Commons / await push / QR).
 export { selectCommonsDelivery, pushTargetsFromDelivery, commonsDeliveryPlatform } from './utils/commonsDelivery.js';
+export { OxyAccountEventError, OXY_ACCOUNT_DELETED_EVENT_URI } from './mixins/OxyServices.utility.js';
 export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData.js';
 // ---------------------------------------------------------------------------
 // User identity and handles

package/dist/esm/mixins/OxyServices.utility.js

@@ -7,6 +7,15 @@ import { jwtDecode } from 'jwt-decode';
 import { loadNodeCrypto } from '@oxy.so/protocol';
 import { logger } from '../logger/index.js';
 import { OXY_SERVICE_ENVIRONMENTS } from '../utils/oxyServiceEnvironment.js';
+/** The SET `events` member Oxy uses for an account deletion. */
+export const OXY_ACCOUNT_DELETED_EVENT_URI = 'https://oxy.so/events/account.deleted';
+/** Why an account event token was refused. `message` never contains the token. */
+export class OxyAccountEventError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'OxyAccountEventError';
+    }
+}
 /**
  * Expected JWT audience for tokens issued by the Oxy auth service.
  */
@@ -133,6 +142,135 @@ export function OxyServicesUtilityMixin(Base) {
                 return null;
             }
         }
+        /**
+         * Verify an account event token from Oxy — the body of an account-event
+         * webhook, or an entry's `token` from `listAccountEvents` — and return the
+         * event. Throws {@link OxyAccountEventError} unless the token is an
+         * EdDSA-signed `secevent+jwt` from Oxy's published key set, issued by
+         * `oxy-auth`, addressed to this application, carrying exactly one known
+         * event. A service token (`typ: JWT`) is refused here, as this token is
+         * refused as a service token.
+         *
+         * Node only (it needs `node:crypto`). The caller must still be idempotent on
+         * `eventId`: Oxy delivers at least once, by push and by pull.
+         */
+        async verifyAccountEvent(token, options = {}) {
+            if (typeof token !== 'string' || token.length === 0 || token.length > 16 * 1024) {
+                throw new OxyAccountEventError('Account event token is missing or oversized');
+            }
+            const parts = token.split('.');
+            if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+                throw new OxyAccountEventError('Account event token is not a compact JWS');
+            }
+            const [headerB64, payloadB64, signatureB64] = parts;
+            let header;
+            let payload;
+            try {
+                header = parseJsonSegment(headerB64);
+                payload = parseJsonSegment(payloadB64);
+            }
+            catch {
+                throw new OxyAccountEventError('Account event token is malformed');
+            }
+            if (Object.keys(header).length !== 3
+                || header.alg !== 'EdDSA'
+                || header.typ !== 'secevent+jwt'
+                || typeof header.kid !== 'string'
+                || !/^[A-Za-z0-9._-]{1,128}$/.test(header.kid)) {
+                throw new OxyAccountEventError('Account event token header is not supported');
+            }
+            const nodeCrypto = await loadNodeCrypto();
+            let jwk;
+            try {
+                jwk = await resolveServiceTokenPublicKey(header.kid, options.jwksUrl ?? new URL('/.well-known/jwks.json', this.getBaseURL()).toString(), this._serviceTokenJwksCache);
+            }
+            catch (error) {
+                throw new OxyAccountEventError(error instanceof Error ? error.message.replace('Service token', 'Account event') : 'Signing key is unavailable');
+            }
+            const signature = Buffer.from(signatureB64, 'base64url');
+            if (signature.toString('base64url') !== signatureB64 || signature.length !== 64) {
+                throw new OxyAccountEventError('Account event token signature is malformed');
+            }
+            let verified = false;
+            try {
+                const publicKey = nodeCrypto.createPublicKey({ key: jwk, format: 'jwk' });
+                verified = nodeCrypto.verify(null, Buffer.from(`${headerB64}.${payloadB64}`), publicKey, signature);
+            }
+            catch {
+                verified = false;
+            }
+            if (!verified)
+                throw new OxyAccountEventError('Account event token signature is invalid');
+            if (payload.iss !== OXY_JWT_ISSUER) {
+                throw new OxyAccountEventError('Account event token issuer is not Oxy');
+            }
+            const audience = options.audience ?? await this._configuredServiceAppId();
+            if (typeof payload.aud !== 'string' || payload.aud !== audience) {
+                throw new OxyAccountEventError('Account event token is addressed to another application');
+            }
+            if (typeof payload.jti !== 'string' || payload.jti.length === 0 || payload.jti.length > 128) {
+                throw new OxyAccountEventError('Account event token has no event id');
+            }
+            if (typeof payload.iat !== 'number' || !Number.isFinite(payload.iat)) {
+                throw new OxyAccountEventError('Account event token has no issue time');
+            }
+            const events = payload.events;
+            if (typeof events !== 'object' || events === null || Array.isArray(events)) {
+                throw new OxyAccountEventError('Account event token carries no events');
+            }
+            const entries = Object.entries(events);
+            const deleted = events[OXY_ACCOUNT_DELETED_EVENT_URI];
+            if (entries.length !== 1 || typeof deleted !== 'object' || deleted === null || Array.isArray(deleted)) {
+                throw new OxyAccountEventError('Account event token carries an unknown event');
+            }
+            const body = deleted;
+            if (typeof body.userId !== 'string' || body.userId.length === 0 || body.userId.length > 128) {
+                throw new OxyAccountEventError('Account event names no account');
+            }
+            if (typeof body.occurredAt !== 'string' || Number.isNaN(Date.parse(body.occurredAt))) {
+                throw new OxyAccountEventError('Account event has no occurrence time');
+            }
+            if (body.username !== undefined && body.username !== null && typeof body.username !== 'string') {
+                throw new OxyAccountEventError('Account event username is malformed');
+            }
+            return {
+                eventId: payload.jti,
+                type: 'account.deleted',
+                userId: body.userId,
+                username: typeof body.username === 'string' ? body.username : null,
+                occurredAt: body.occurredAt,
+                retained: body.retained === true,
+                applicationId: payload.aud,
+                issuedAt: payload.iat,
+            };
+        }
+        /**
+         * One page of account events addressed to this application, oldest first,
+         * from Oxy's pull feed — the reconciliation path behind the webhook. Needs
+         * the service credential (`configureServiceAuth`). Verify each entry's
+         * `token` with {@link verifyAccountEvent} before acting on it.
+         */
+        async listAccountEvents(options = {}) {
+            const serviceToken = await this.getServiceToken();
+            const query = {};
+            if (options.after)
+                query.after = options.after;
+            if (options.limit !== undefined)
+                query.limit = String(options.limit);
+            return this.makeRequest('GET', '/account-events', query, {
+                cache: false,
+                headers: { Authorization: `Bearer ${serviceToken}` },
+            });
+        }
+        /** @internal The `appId` claim of this client's own service token. */
+        async _configuredServiceAppId() {
+            const serviceToken = await this.getServiceToken();
+            const appId = jwtDecode(serviceToken).appId;
+            if (typeof appId !== 'string' || appId.length === 0) {
+                throw new OxyAccountEventError('No audience given and the service credential names no application');
+            }
+            return appId;
+        }
         /**
          * Express.js authentication middleware
          *