@oxy.so/core 1.12.1 → 1.16.0

package/dist/esm/server/securityHeaders.js

@@ -313,6 +313,20 @@ const MAX_INLINE_SCRIPT_HASHES = 8;
  * react-native-web's runtime stylesheet, and a style hash would silently switch
  * that off and render every Oxy web app unstyled.)
  */
+/** Passkeys for this origin itself; every other powerful feature off. */
+const SENSITIVE_PERMISSIONS_POLICY = [
+    'publickey-credentials-get=(self)',
+    'publickey-credentials-create=(self)',
+    'camera=()',
+    'microphone=()',
+    'geolocation=()',
+    'payment=()',
+    'usb=()',
+    'serial=()',
+    'hid=()',
+    'bluetooth=()',
+    'display-capture=()',
+].join(', ');
 export function buildOxyPagesHeaders(options = {}) {
     const hashes = [
         ...new Set((options.html ?? []).flatMap(extractInlineScripts).map(inlineScriptCspHash)),
@@ -328,6 +342,8 @@ export function buildOxyPagesHeaders(options = {}) {
         for (const name of ['script-src', 'connect-src']) {
             directives[name] = (directives[name] ?? []).filter((source) => !beacon.has(source));
         }
+        directives['base-uri'] = ["'none'"];
+        directives['form-action'] = ["'none'"];
     }
     const csp = formatOxyCspPolicy(directives);
     const lines = [
@@ -335,13 +351,15 @@ export function buildOxyPagesHeaders(options = {}) {
         `  Content-Security-Policy: ${csp}`,
         '  X-Frame-Options: DENY',
         '  X-Content-Type-Options: nosniff',
-        '  Referrer-Policy: strict-origin-when-cross-origin',
+        `  Referrer-Policy: ${options.sensitive ? 'no-referrer' : 'strict-origin-when-cross-origin'}`,
     ];
     if (options.hsts !== false) {
         lines.push('  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload');
     }
     if (options.sensitive) {
         lines.push('  Cache-Control: public, max-age=0, must-revalidate, no-transform');
+        lines.push(`  Permissions-Policy: ${SENSITIVE_PERMISSIONS_POLICY}`);
+        lines.push('  Cross-Origin-Resource-Policy: same-origin');
     }
     lines.push('');
     return lines.join('\n');

package/dist/esm/session/accountDialogController.js

@@ -36,12 +36,6 @@
  *   - `commonsAvailability` — whether Commons is installed on this device
  *     (native only, via the injected `canOpenApp` probe), so the QR view can
  *     offer a "Get Commons" fallback instead of a same-device dead end.
- *   - `startPasskeyHubSignIn` — on a non-Oxy web origin (where a WebAuthn
- *     ceremony can't run locally, the RP-ID is bound to oxy.so), open a popup
- *     at the auth.oxy.so passkey hub instead, scoped to the SAME device-flow
- *     session `showQr` creates, and complete it via the SAME poll/socket/claim
- *     engine. Falls back to `showQr`'s plain QR rendering if the popup is
- *     blocked.
  *
  * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
  * password, social login, and 2FA were removed ecosystem-wide. Account
@@ -57,7 +51,6 @@
  */
 import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
-import { IDENTITY_WEB_ORIGIN } from '../utils/authWebUrl.js';
 import { getSocketIO } from './socketLoader.js';
 import { resolveActiveContext } from './deviceDirectory.js';
 import { pushTargetsFromDelivery, selectCommonsDelivery, } from '../utils/commonsDelivery.js';
@@ -125,8 +118,8 @@ const IDLE_SIGN_IN_FACTS = {
  */
 const COMPLETED_SIGN_IN_FACTS = { ...IDLE_SIGN_IN_FACTS, phase: 'completed' };
 /** The full flow state for `facts`, stamped with the attempt it belongs to. */
-function buildSignIn(facts, attempt) {
-    return { ...facts, progress: deriveSignInProgress(facts), attempt };
+function buildSignIn(facts, attempt, inline) {
+    return { ...facts, progress: deriveSignInProgress(facts), attempt, inline };
 }
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
@@ -158,7 +151,7 @@ export class AccountDialogController {
          * alongside the three flags above.
          */
         this.exclusiveMutationInFlight = false;
-        this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, 0);
+        this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, 0, false);
         this.commonsAvailability = 'unknown';
         // --- Sign-in device-flow bookkeeping ---
         /**
@@ -187,10 +180,6 @@ export class AccountDialogController {
          * ABANDONED request never blocks the next request's first poll.
          */
         this.pollInFlightToken = null;
-        /** The popup opened by {@link startPasskeyHubSignIn}, or `null`. */
-        this.activePopup = null;
-        /** Watches {@link activePopup}'s `closed` state; see {@link watchPopup}. */
-        this.popupWatchTimer = null;
         // --- Store plumbing ---
         this.unsubscribeSession = null;
         this.unsubscribeTokens = null;
@@ -207,8 +196,6 @@ export class AccountDialogController {
         this.openUrl = options.openUrl;
         this.canOpenApp = options.canOpenApp;
         this.socketFactory = options.socketFactory;
-        this.openPopup = options.openPopup;
-        this.identityOrigin = options.identityOrigin ?? options.hubBaseUrl ?? IDENTITY_WEB_ORIGIN;
         this.platform = options.platform ?? 'unknown';
         this.snapshot = this.computeSnapshot();
     }
@@ -286,7 +273,6 @@ export class AccountDialogController {
         }
         this.clearPollTimer();
         this.closeAuthSessionSocket();
-        this.closeActivePopup();
         this.signInToken = null;
         this.listeners.clear();
     }
@@ -351,12 +337,12 @@ export class AccountDialogController {
         if (this.view === view)
             return;
         this.view = view;
-        // A `'completed'` flow owns no timers, socket, popup, or token — it is only
+        // A `'completed'` flow owns no timers, socket, or token — it is only
         // the terminal "Identity confirmed" the finished surface showed. Moving to
         // another view is a NEW intention, so drop it; otherwise a later `add()`
         // would open on the previous sign-in's terminal state.
         if (this.signIn.phase === 'completed') {
-            this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, this.signInAttempt);
+            this.signIn = this.stampSignIn(IDLE_SIGN_IN_FACTS);
         }
         this.emit();
     }
@@ -673,82 +659,33 @@ export class AccountDialogController {
         await this.startDeviceFlowSession(attempt, { deliver: true });
     }
     /**
-     * Start a NEW attempt the same way the last one was started — "Try again"
-     * repeats the user's choice rather than silently switching method. A failed
-     * passkey-hub attempt reopens the hub popup; a failed "Sign in with Oxy"
-     * retries that; an explicit QR request shows the QR.
+     * The sign-in entry's EMBEDDED QR: a request whose only route is the QR,
+     * started without leaving the current view.
      *
-     * Call it straight from the press handler: the hub route opens its popup
-     * synchronously, before this method's first `await`, so the browser still
-     * attributes it to the click.
+     * Unlike {@link showQr} it runs no delivery selection. The surface starts it
+     * by itself, on mount, so it must not push to the person's phone or open
+     * Commons — nobody asked for either. Any other sign-in the person then
+     * chooses supersedes it (and withdraws its request) like any new attempt.
+     */
+    async startInlineQr() {
+        const attempt = this.beginSignInAttempt('inline-qr');
+        await this.startDeviceFlowSession(attempt, { deliver: false });
+    }
+    /**
+     * Start a NEW attempt the same way the last one was started — "Try again"
+     * repeats the user's choice rather than silently switching method: a failed
+     * "Sign in with Oxy" retries that; an explicit QR request shows the QR.
      */
     retrySignIn() {
         switch (this.signInMethod) {
-            case 'passkey-hub':
-                return this.startPasskeyHubSignIn();
             case 'qr':
                 return this.showQr();
+            case 'inline-qr':
+                return this.startInlineQr();
             default:
                 return this.signInWithOxy();
         }
     }
-    /**
-     * Web-only: sign in (or create an account) with a passkey at the web identity
-     * carrier. The ceremony runs on `id.oxy.so`, never on the calling origin, for
-     * two reasons: a credential minted with `WEBAUTHN_RP_ID=oxy.so` can only be
-     * asserted from `oxy.so`/a subdomain/loopback (a browser-enforced boundary),
-     * and only the identity origin may unseal or create the account's identity
-     * (one identity, two carriers). Opens a popup at `<identityOrigin>/continue`,
-     * scoped to the SAME device-flow
-     * session {@link showQr} would create (same `authorizeCode`/`sessionToken`
-     * pair), and let the SAME poll/socket/claim engine complete it once the hub
-     * authorizes the session (`POST /auth/session/authorize-code/:authorizeCode`,
-     * bearer-authed, server-side — this method never sees or transmits the
-     * secret `sessionToken`).
-     *
-     * The popup MUST be opened synchronously, before any `await`, or the
-     * browser's popup blocker loses the click-gesture attribution and silently
-     * blocks it — so {@link openPopup} is invoked as the very first step, before
-     * the device-flow session (which needs an async call) even exists. If the
-     * popup is blocked (or no `openPopup` was injected), this falls back to
-     * `showQr`'s plain QR rendering — no dead end.
-     */
-    async startPasskeyHubSignIn() {
-        const attempt = this.beginSignInAttempt('passkey-hub');
-        this.setView('qr');
-        const popup = this.openPopup?.() ?? null;
-        if (!popup) {
-            await this.startDeviceFlowSession(attempt, { deliver: true });
-            return;
-        }
-        // Owned by the attempt from the moment it exists, so cancelling while the
-        // session is still being created closes it instead of leaving a blank
-        // window behind.
-        this.activePopup = popup;
-        // The hub popup IS the primary surface here, chosen explicitly by the user —
-        // so this flow does NOT run automatic Commons delivery (ringing the user's
-        // phone because they asked for a passkey would be exactly the "menu of
-        // methods" the one-primary-action rule forbids). The underlying request is
-        // the same `AuthSession`, and its Commons route stays the QR the view
-        // renders beneath the popup.
-        const handle = await this.startDeviceFlowSession(attempt, { deliver: false });
-        // `null` means the attempt failed (its teardown closed the popup) or was
-        // abandoned (the cancel closed it).
-        if (!handle)
-            return;
-        // The user may have closed the popup during the async session creation
-        // above, before any watcher was attached to catch it — guard rather than
-        // navigate a dead window (browsers vary on whether that throws).
-        if (popup.closed) {
-            const pendingCode = this.signIn.authorizeCode;
-            this.failSignIn('cancelled', 'Sign-in was cancelled.');
-            if (pendingCode)
-                void this.withdrawRequest(pendingCode);
-            return;
-        }
-        popup.location.href = `${this.identityOrigin}/continue?code=${encodeURIComponent(handle.authorizeCode)}`;
-        this.watchPopup(popup);
-    }
     /**
      * End whatever attempt is running (withdrawing its request) and begin a new
      * one. Returns the new attempt's identity for the caller to re-check after
@@ -764,9 +701,9 @@ export class AccountDialogController {
         return attempt === this.signInAttempt;
     }
     /**
-     * Shared device-flow session creation for both {@link showQr} (renders the
-     * QR) and {@link startPasskeyHubSignIn} (also opens the hub popup) — the
-     * same `startCommonsSignIn` → poll/socket wiring either way. Returns the
+     * Shared device-flow session creation for {@link signInWithOxy},
+     * {@link showQr} and {@link startInlineQr} — the same `startCommonsSignIn` →
+     * poll/socket wiring every time. Returns the
      * handle on success (already reflected in `signIn`), or `null` when the
      * attempt failed (already set as `signIn.failure`) or was abandoned while the
      * request was being created.
@@ -777,8 +714,8 @@ export class AccountDialogController {
      *   request, a socket, and a poll behind it.
      * @param opts.deliver - Whether to run automatic Commons delivery selection
      *   ({@link resolveDeliveryRoute}). `true` for the normal one-primary-action
-     *   entry; `false` when the caller already owns the primary surface (the
-     *   passkey hub popup), where the request's Commons route is simply the QR.
+     *   entry; `false` for the embedded QR, which the screen starts by itself,
+     *   where the request's Commons route is simply the QR.
      */
     async startDeviceFlowSession(attempt, opts) {
         if (!this.isCurrentAttempt(attempt))
@@ -821,9 +758,9 @@ export class AccountDialogController {
         void this.openAuthSessionSocket(handle.sessionToken);
         this.scheduleNextPoll(handle.sessionToken);
         if (opts.deliver) {
-            // Non-blocking on purpose: the QR/authorizeCode are already renderable
-            // and the popup caller can navigate immediately, while the route (a
-            // local probe plus at most one delivery round-trip) resolves behind it.
+            // Non-blocking on purpose: the QR/authorizeCode are already renderable,
+            // while the route (a local probe plus at most one delivery round-trip)
+            // resolves behind it.
             void this.resolveDeliveryRoute(handle);
         }
         return handle;
@@ -927,49 +864,6 @@ export class AccountDialogController {
             return false;
         }
     }
-    /**
-     * Poll {@link PopupWindowHandle.closed} so a user who dismisses the hub
-     * popup without completing sign-in gets prompt feedback (there is no DOM
-     * event for a cross-origin popup closing — polling is the only mechanism).
-     * Cleared by {@link closeActivePopup}, which every sign-in exit path already
-     * calls.
-     */
-    watchPopup(popup) {
-        this.clearPopupWatchTimer();
-        this.popupWatchTimer = setInterval(() => {
-            if (!popup.closed)
-                return;
-            this.clearPopupWatchTimer();
-            if (this.signIn.phase === 'starting' || this.signIn.phase === 'waiting') {
-                // Closing the surface cancels the REQUEST too, not just this listener.
-                const pendingCode = this.signIn.authorizeCode;
-                this.failSignIn('cancelled', 'Sign-in was cancelled.');
-                if (pendingCode) {
-                    void this.withdrawRequest(pendingCode);
-                }
-            }
-        }, 1000);
-    }
-    clearPopupWatchTimer() {
-        if (this.popupWatchTimer !== null) {
-            clearInterval(this.popupWatchTimer);
-            this.popupWatchTimer = null;
-        }
-    }
-    /** Tear down the popup watch timer and close the popup, if any. Idempotent. */
-    closeActivePopup() {
-        this.clearPopupWatchTimer();
-        const popup = this.activePopup;
-        this.activePopup = null;
-        if (!popup || popup.closed)
-            return;
-        try {
-            popup.close();
-        }
-        catch (error) {
-            logger.debug('[AccountDialogController] popup close failed', { component: 'AccountDialogController' }, error);
-        }
-    }
     /**
      * Resolve whether Commons is installed on this device via the injected
      * `canOpenApp` probe, updating {@link commonsAvailability} as durable,
@@ -999,7 +893,7 @@ export class AccountDialogController {
         this.emit();
     }
     /**
-     * Tear down the active sign-in device flow (timers + socket + popup + token),
+     * Tear down the active sign-in device flow (timers + socket + token),
      * WITHDRAW the request server-side, and reset to idle.
      *
      * Cancellation has to converge in both directions: the surface closing must
@@ -1022,7 +916,6 @@ export class AccountDialogController {
             : null;
         this.clearPollTimer();
         this.closeAuthSessionSocket();
-        this.closeActivePopup();
         this.signInToken = null;
         if (this.signIn.phase !== 'idle') {
             this.setSignIn(IDLE_SIGN_IN_FACTS);
@@ -1221,10 +1114,9 @@ export class AccountDialogController {
             this.signInToken = null;
             this.clearPollTimer();
             this.closeAuthSessionSocket();
-            this.closeActivePopup();
             // Terminal SUCCESS, not idle: the surface gets one honest frame to show
             // "Identity confirmed" before it closes. Cleared on the next view change.
-            this.signIn = buildSignIn(COMPLETED_SIGN_IN_FACTS, this.signInAttempt);
+            this.signIn = this.stampSignIn(COMPLETED_SIGN_IN_FACTS);
             this.view = 'accounts';
             this.emit();
         }
@@ -1251,7 +1143,6 @@ export class AccountDialogController {
     failSignIn(failure, message) {
         this.clearPollTimer();
         this.closeAuthSessionSocket();
-        this.closeActivePopup();
         this.signInToken = null;
         this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'error', error: message, failure });
     }
@@ -1343,9 +1234,13 @@ export class AccountDialogController {
      * to advance without a fact behind it.
      */
     setSignIn(facts) {
-        this.signIn = buildSignIn(facts, this.signInAttempt);
+        this.signIn = this.stampSignIn(facts);
         this.emit();
     }
+    /** `facts` as the current attempt's state. */
+    stampSignIn(facts) {
+        return buildSignIn(facts, this.signInAttempt, this.signInMethod === 'inline-qr');
+    }
     /** Update a subset of the device-flow facts, re-deriving `progress`. */
     patchSignIn(patch) {
         const { phase, authorizeCode, qrPayload, expiresAt, error, failure, route, routeFailed, pushSentAt, openedAt, } = this.signIn;

package/dist/esm/utils/authWebUrl.js

@@ -15,9 +15,10 @@
  */
 export const CENTRAL_IDP_APEX = 'oxy.so';
 /**
- * The web identity carrier's origin — where a person signs in or creates an
- * account with a passkey, and where their self-custody identity is kept sealed
- * under that passkey (one identity, two carriers). Apps open it; they never
- * handle the identity themselves.
+ * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface AND the
+ * web identity carrier: where a person signs in or creates an account with a
+ * passkey from another origin's popup, and the one origin that may create,
+ * open, recover or move their self-custody identity (one identity, two
+ * carriers). Apps open it; they never handle the identity themselves.
  */
-export const IDENTITY_WEB_ORIGIN = `https://id.${CENTRAL_IDP_APEX}`;
+export const AUTH_WEB_ORIGIN = `https://auth.${CENTRAL_IDP_APEX}`;

package/dist/esm/utils/oauthPkce.js

@@ -15,10 +15,11 @@
  * crypto already uses — so these helpers run identically on web, Node, and
  * React Native. No `require()`, so the ESM build stays bundler-clean.
  */
+import { AUTH_WEB_ORIGIN } from './authWebUrl.js';
 import { isNodeJS, isReactNative, loadExpoCrypto, loadNodeCrypto, sha256 } from '@oxy.so/protocol';
 import { logger } from '../logger/index.js';
 /** The central Oxy IdP authorization endpoint used by default. */
-export const OXY_AUTHORIZE_URL = 'https://auth.oxy.so/authorize';
+export const OXY_AUTHORIZE_URL = `${AUTH_WEB_ORIGIN}/authorize`;
 /** Default OAuth scope requested for a "Sign in with Oxy" third-party flow. */
 export const DEFAULT_OAUTH_SCOPE = 'openid profile';
 /**
@@ -137,6 +138,9 @@ export function buildOAuthAuthorizeUrl(params) {
     if (params.responseMode) {
         url.searchParams.set('response_mode', params.responseMode);
     }
+    if (params.screen) {
+        url.searchParams.set('screen', params.screen);
+    }
     return url.toString();
 }
 /** `sessionStorage` key for the OAuth CSRF `state` across an authorize redirect. */