@oxy.so/core 1.13.0 → 1.18.0

package/dist/cjs/mixins/OxyServices.user.js

@@ -535,6 +535,35 @@ function OxyServicesUserMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * WebAuthn request options to delete a PASSKEY account (ADR 0029 D3): its own
+         * passkeys, user verification required, and a challenge bound to it. Opaque —
+         * hand them to the browser's authentication ceremony, on auth.oxy.so. An
+         * account with a Commons key deletes with {@link deleteAccount} instead.
+         */
+        async getAccountDeletionOptions() {
+            try {
+                return await this.makeRequest('POST', '/users/me/delete/options', undefined, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Delete a PASSKEY account permanently, with an assertion by one of its
+         * passkeys over {@link getAccountDeletionOptions}' challenge.
+         *
+         * @param confirmText - Must equal the user's username (verified server-side)
+         * @param assertion - The ceremony's opaque `AuthenticationResponseJSON`
+         */
+        async deleteAccountWithPasskey(confirmText, assertion) {
+            try {
+                return await this.makeRequest('DELETE', '/users/me', { confirmText, assertion }, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
         /**
          * Invalidate every cached read a follow/unfollow write invalidates.
          *
@@ -844,11 +873,13 @@ function OxyServicesUserMixin(Base) {
             }
         }
         /**
-         * Get notifications
+         * One page of the signed-in user's Oxy notifications, newest first
+         * (`GET /notifications`), with the unread count across all pages.
          */
-        async getNotifications() {
+        async getNotifications(params = {}) {
+            const query = (0, apiUtils_1.buildQueryParams)({ page: params.page, limit: params.limit });
             return this.withAuthRetry(async () => {
-                return await this.makeRequest('GET', '/notifications', undefined, {
+                return await this.makeRequest('GET', '/notifications', query, {
                     cache: false, // Don't cache notifications - always get fresh data
                 });
             }, 'getNotifications');
@@ -861,7 +892,7 @@ function OxyServicesUserMixin(Base) {
                 const res = await this.makeRequest('GET', '/notifications/unread-count', undefined, {
                     cache: false, // Don't cache unread count - always get fresh data
                 });
-                return res.count;
+                return res.unreadCount;
             }
             catch (error) {
                 throw this.handleError(error);
@@ -876,18 +907,22 @@ function OxyServicesUserMixin(Base) {
          */
         async createNotification(data) {
             try {
-                return await this.makeRequest('POST', '/notifications', data, { cache: false });
+                const res = await this.makeRequest('POST', '/notifications', data, { cache: false });
+                return res.notification;
             }
             catch (error) {
                 throw this.handleError(error);
             }
         }
         /**
-         * Mark notification as read
+         * Mark one of the signed-in user's notifications read and return it as
+         * stored. Scoped to the recipient server-side, so it is also the
+         * authoritative read of a notification by id: a foreign or unknown id 404s.
          */
         async markNotificationAsRead(notificationId) {
             try {
-                await this.makeRequest('PUT', `/notifications/${notificationId}/read`, undefined, { cache: false });
+                const res = await this.makeRequest('PUT', `/notifications/${encodeURIComponent(notificationId)}/read`, undefined, { cache: false });
+                return res.notification;
             }
             catch (error) {
                 throw this.handleError(error);

package/dist/cjs/server/securityHeaders.js

@@ -326,6 +326,20 @@ const MAX_INLINE_SCRIPT_HASHES = 8;
  * react-native-web's runtime stylesheet, and a style hash would silently switch
  * that off and render every Oxy web app unstyled.)
  */
+/** Passkeys for this origin itself; every other powerful feature off. */
+const SENSITIVE_PERMISSIONS_POLICY = [
+    'publickey-credentials-get=(self)',
+    'publickey-credentials-create=(self)',
+    'camera=()',
+    'microphone=()',
+    'geolocation=()',
+    'payment=()',
+    'usb=()',
+    'serial=()',
+    'hid=()',
+    'bluetooth=()',
+    'display-capture=()',
+].join(', ');
 function buildOxyPagesHeaders(options = {}) {
     const hashes = [
         ...new Set((options.html ?? []).flatMap(extractInlineScripts).map(inlineScriptCspHash)),
@@ -341,6 +355,8 @@ function buildOxyPagesHeaders(options = {}) {
         for (const name of ['script-src', 'connect-src']) {
             directives[name] = (directives[name] ?? []).filter((source) => !beacon.has(source));
         }
+        directives['base-uri'] = ["'none'"];
+        directives['form-action'] = ["'none'"];
     }
     const csp = formatOxyCspPolicy(directives);
     const lines = [
@@ -348,13 +364,15 @@ function buildOxyPagesHeaders(options = {}) {
         `  Content-Security-Policy: ${csp}`,
         '  X-Frame-Options: DENY',
         '  X-Content-Type-Options: nosniff',
-        '  Referrer-Policy: strict-origin-when-cross-origin',
+        `  Referrer-Policy: ${options.sensitive ? 'no-referrer' : 'strict-origin-when-cross-origin'}`,
     ];
     if (options.hsts !== false) {
         lines.push('  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload');
     }
     if (options.sensitive) {
         lines.push('  Cache-Control: public, max-age=0, must-revalidate, no-transform');
+        lines.push(`  Permissions-Policy: ${SENSITIVE_PERMISSIONS_POLICY}`);
+        lines.push('  Cross-Origin-Resource-Policy: same-origin');
     }
     lines.push('');
     return lines.join('\n');

package/dist/cjs/session/accountDialogController.js

@@ -37,12 +37,6 @@
  *   - `commonsAvailability` — whether Commons is installed on this device
  *     (native only, via the injected `canOpenApp` probe), so the QR view can
  *     offer a "Get Commons" fallback instead of a same-device dead end.
- *   - `startPasskeyHubSignIn` — on a non-Oxy web origin (where a WebAuthn
- *     ceremony can't run locally, the RP-ID is bound to oxy.so), open a popup
- *     at the auth.oxy.so passkey hub instead, scoped to the SAME device-flow
- *     session `showQr` creates, and complete it via the SAME poll/socket/claim
- *     engine. Falls back to `showQr`'s plain QR rendering if the popup is
- *     blocked.
  *
  * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
  * password, social login, and 2FA were removed ecosystem-wide. Account
@@ -62,7 +56,6 @@ exports.backViewOf = backViewOf;
 exports.createAccountDialogController = createAccountDialogController;
 const logger_1 = require("../logger");
 const errorUtils_1 = require("../utils/errorUtils");
-const authWebUrl_1 = require("../utils/authWebUrl");
 const socketLoader_1 = require("./socketLoader");
 const deviceDirectory_1 = require("./deviceDirectory");
 const commonsDelivery_1 = require("../utils/commonsDelivery");
@@ -130,8 +123,8 @@ const IDLE_SIGN_IN_FACTS = {
  */
 const COMPLETED_SIGN_IN_FACTS = { ...IDLE_SIGN_IN_FACTS, phase: 'completed' };
 /** The full flow state for `facts`, stamped with the attempt it belongs to. */
-function buildSignIn(facts, attempt) {
-    return { ...facts, progress: deriveSignInProgress(facts), attempt };
+function buildSignIn(facts, attempt, inline) {
+    return { ...facts, progress: deriveSignInProgress(facts), attempt, inline };
 }
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
@@ -163,7 +156,7 @@ class AccountDialogController {
          * alongside the three flags above.
          */
         this.exclusiveMutationInFlight = false;
-        this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, 0);
+        this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, 0, false);
         this.commonsAvailability = 'unknown';
         // --- Sign-in device-flow bookkeeping ---
         /**
@@ -192,10 +185,6 @@ class AccountDialogController {
          * ABANDONED request never blocks the next request's first poll.
          */
         this.pollInFlightToken = null;
-        /** The popup opened by {@link startPasskeyHubSignIn}, or `null`. */
-        this.activePopup = null;
-        /** Watches {@link activePopup}'s `closed` state; see {@link watchPopup}. */
-        this.popupWatchTimer = null;
         // --- Store plumbing ---
         this.unsubscribeSession = null;
         this.unsubscribeTokens = null;
@@ -212,8 +201,6 @@ class AccountDialogController {
         this.openUrl = options.openUrl;
         this.canOpenApp = options.canOpenApp;
         this.socketFactory = options.socketFactory;
-        this.openPopup = options.openPopup;
-        this.identityOrigin = options.identityOrigin ?? options.hubBaseUrl ?? authWebUrl_1.IDENTITY_WEB_ORIGIN;
         this.platform = options.platform ?? 'unknown';
         this.snapshot = this.computeSnapshot();
     }
@@ -291,7 +278,6 @@ class AccountDialogController {
         }
         this.clearPollTimer();
         this.closeAuthSessionSocket();
-        this.closeActivePopup();
         this.signInToken = null;
         this.listeners.clear();
     }
@@ -356,12 +342,12 @@ class AccountDialogController {
         if (this.view === view)
             return;
         this.view = view;
-        // A `'completed'` flow owns no timers, socket, popup, or token — it is only
+        // A `'completed'` flow owns no timers, socket, or token — it is only
         // the terminal "Identity confirmed" the finished surface showed. Moving to
         // another view is a NEW intention, so drop it; otherwise a later `add()`
         // would open on the previous sign-in's terminal state.
         if (this.signIn.phase === 'completed') {
-            this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, this.signInAttempt);
+            this.signIn = this.stampSignIn(IDLE_SIGN_IN_FACTS);
         }
         this.emit();
     }
@@ -678,82 +664,33 @@ class AccountDialogController {
         await this.startDeviceFlowSession(attempt, { deliver: true });
     }
     /**
-     * Start a NEW attempt the same way the last one was started — "Try again"
-     * repeats the user's choice rather than silently switching method. A failed
-     * passkey-hub attempt reopens the hub popup; a failed "Sign in with Oxy"
-     * retries that; an explicit QR request shows the QR.
+     * The sign-in entry's EMBEDDED QR: a request whose only route is the QR,
+     * started without leaving the current view.
      *
-     * Call it straight from the press handler: the hub route opens its popup
-     * synchronously, before this method's first `await`, so the browser still
-     * attributes it to the click.
+     * Unlike {@link showQr} it runs no delivery selection. The surface starts it
+     * by itself, on mount, so it must not push to the person's phone or open
+     * Commons — nobody asked for either. Any other sign-in the person then
+     * chooses supersedes it (and withdraws its request) like any new attempt.
+     */
+    async startInlineQr() {
+        const attempt = this.beginSignInAttempt('inline-qr');
+        await this.startDeviceFlowSession(attempt, { deliver: false });
+    }
+    /**
+     * Start a NEW attempt the same way the last one was started — "Try again"
+     * repeats the user's choice rather than silently switching method: a failed
+     * "Sign in with Oxy" retries that; an explicit QR request shows the QR.
      */
     retrySignIn() {
         switch (this.signInMethod) {
-            case 'passkey-hub':
-                return this.startPasskeyHubSignIn();
             case 'qr':
                 return this.showQr();
+            case 'inline-qr':
+                return this.startInlineQr();
             default:
                 return this.signInWithOxy();
         }
     }
-    /**
-     * Web-only: sign in (or create an account) with a passkey at the web identity
-     * carrier. The ceremony runs on `id.oxy.so`, never on the calling origin, for
-     * two reasons: a credential minted with `WEBAUTHN_RP_ID=oxy.so` can only be
-     * asserted from `oxy.so`/a subdomain/loopback (a browser-enforced boundary),
-     * and only the identity origin may unseal or create the account's identity
-     * (one identity, two carriers). Opens a popup at `<identityOrigin>/continue`,
-     * scoped to the SAME device-flow
-     * session {@link showQr} would create (same `authorizeCode`/`sessionToken`
-     * pair), and let the SAME poll/socket/claim engine complete it once the hub
-     * authorizes the session (`POST /auth/session/authorize-code/:authorizeCode`,
-     * bearer-authed, server-side — this method never sees or transmits the
-     * secret `sessionToken`).
-     *
-     * The popup MUST be opened synchronously, before any `await`, or the
-     * browser's popup blocker loses the click-gesture attribution and silently
-     * blocks it — so {@link openPopup} is invoked as the very first step, before
-     * the device-flow session (which needs an async call) even exists. If the
-     * popup is blocked (or no `openPopup` was injected), this falls back to
-     * `showQr`'s plain QR rendering — no dead end.
-     */
-    async startPasskeyHubSignIn() {
-        const attempt = this.beginSignInAttempt('passkey-hub');
-        this.setView('qr');
-        const popup = this.openPopup?.() ?? null;
-        if (!popup) {
-            await this.startDeviceFlowSession(attempt, { deliver: true });
-            return;
-        }
-        // Owned by the attempt from the moment it exists, so cancelling while the
-        // session is still being created closes it instead of leaving a blank
-        // window behind.
-        this.activePopup = popup;
-        // The hub popup IS the primary surface here, chosen explicitly by the user —
-        // so this flow does NOT run automatic Commons delivery (ringing the user's
-        // phone because they asked for a passkey would be exactly the "menu of
-        // methods" the one-primary-action rule forbids). The underlying request is
-        // the same `AuthSession`, and its Commons route stays the QR the view
-        // renders beneath the popup.
-        const handle = await this.startDeviceFlowSession(attempt, { deliver: false });
-        // `null` means the attempt failed (its teardown closed the popup) or was
-        // abandoned (the cancel closed it).
-        if (!handle)
-            return;
-        // The user may have closed the popup during the async session creation
-        // above, before any watcher was attached to catch it — guard rather than
-        // navigate a dead window (browsers vary on whether that throws).
-        if (popup.closed) {
-            const pendingCode = this.signIn.authorizeCode;
-            this.failSignIn('cancelled', 'Sign-in was cancelled.');
-            if (pendingCode)
-                void this.withdrawRequest(pendingCode);
-            return;
-        }
-        popup.location.href = `${this.identityOrigin}/continue?code=${encodeURIComponent(handle.authorizeCode)}`;
-        this.watchPopup(popup);
-    }
     /**
      * End whatever attempt is running (withdrawing its request) and begin a new
      * one. Returns the new attempt's identity for the caller to re-check after
@@ -769,9 +706,9 @@ class AccountDialogController {
         return attempt === this.signInAttempt;
     }
     /**
-     * Shared device-flow session creation for both {@link showQr} (renders the
-     * QR) and {@link startPasskeyHubSignIn} (also opens the hub popup) — the
-     * same `startCommonsSignIn` → poll/socket wiring either way. Returns the
+     * Shared device-flow session creation for {@link signInWithOxy},
+     * {@link showQr} and {@link startInlineQr} — the same `startCommonsSignIn` →
+     * poll/socket wiring every time. Returns the
      * handle on success (already reflected in `signIn`), or `null` when the
      * attempt failed (already set as `signIn.failure`) or was abandoned while the
      * request was being created.
@@ -782,8 +719,8 @@ class AccountDialogController {
      *   request, a socket, and a poll behind it.
      * @param opts.deliver - Whether to run automatic Commons delivery selection
      *   ({@link resolveDeliveryRoute}). `true` for the normal one-primary-action
-     *   entry; `false` when the caller already owns the primary surface (the
-     *   passkey hub popup), where the request's Commons route is simply the QR.
+     *   entry; `false` for the embedded QR, which the screen starts by itself,
+     *   where the request's Commons route is simply the QR.
      */
     async startDeviceFlowSession(attempt, opts) {
         if (!this.isCurrentAttempt(attempt))
@@ -826,9 +763,9 @@ class AccountDialogController {
         void this.openAuthSessionSocket(handle.sessionToken);
         this.scheduleNextPoll(handle.sessionToken);
         if (opts.deliver) {
-            // Non-blocking on purpose: the QR/authorizeCode are already renderable
-            // and the popup caller can navigate immediately, while the route (a
-            // local probe plus at most one delivery round-trip) resolves behind it.
+            // Non-blocking on purpose: the QR/authorizeCode are already renderable,
+            // while the route (a local probe plus at most one delivery round-trip)
+            // resolves behind it.
             void this.resolveDeliveryRoute(handle);
         }
         return handle;
@@ -932,49 +869,6 @@ class AccountDialogController {
             return false;
         }
     }
-    /**
-     * Poll {@link PopupWindowHandle.closed} so a user who dismisses the hub
-     * popup without completing sign-in gets prompt feedback (there is no DOM
-     * event for a cross-origin popup closing — polling is the only mechanism).
-     * Cleared by {@link closeActivePopup}, which every sign-in exit path already
-     * calls.
-     */
-    watchPopup(popup) {
-        this.clearPopupWatchTimer();
-        this.popupWatchTimer = setInterval(() => {
-            if (!popup.closed)
-                return;
-            this.clearPopupWatchTimer();
-            if (this.signIn.phase === 'starting' || this.signIn.phase === 'waiting') {
-                // Closing the surface cancels the REQUEST too, not just this listener.
-                const pendingCode = this.signIn.authorizeCode;
-                this.failSignIn('cancelled', 'Sign-in was cancelled.');
-                if (pendingCode) {
-                    void this.withdrawRequest(pendingCode);
-                }
-            }
-        }, 1000);
-    }
-    clearPopupWatchTimer() {
-        if (this.popupWatchTimer !== null) {
-            clearInterval(this.popupWatchTimer);
-            this.popupWatchTimer = null;
-        }
-    }
-    /** Tear down the popup watch timer and close the popup, if any. Idempotent. */
-    closeActivePopup() {
-        this.clearPopupWatchTimer();
-        const popup = this.activePopup;
-        this.activePopup = null;
-        if (!popup || popup.closed)
-            return;
-        try {
-            popup.close();
-        }
-        catch (error) {
-            logger_1.logger.debug('[AccountDialogController] popup close failed', { component: 'AccountDialogController' }, error);
-        }
-    }
     /**
      * Resolve whether Commons is installed on this device via the injected
      * `canOpenApp` probe, updating {@link commonsAvailability} as durable,
@@ -1004,7 +898,7 @@ class AccountDialogController {
         this.emit();
     }
     /**
-     * Tear down the active sign-in device flow (timers + socket + popup + token),
+     * Tear down the active sign-in device flow (timers + socket + token),
      * WITHDRAW the request server-side, and reset to idle.
      *
      * Cancellation has to converge in both directions: the surface closing must
@@ -1027,7 +921,6 @@ class AccountDialogController {
             : null;
         this.clearPollTimer();
         this.closeAuthSessionSocket();
-        this.closeActivePopup();
         this.signInToken = null;
         if (this.signIn.phase !== 'idle') {
             this.setSignIn(IDLE_SIGN_IN_FACTS);
@@ -1226,10 +1119,9 @@ class AccountDialogController {
             this.signInToken = null;
             this.clearPollTimer();
             this.closeAuthSessionSocket();
-            this.closeActivePopup();
             // Terminal SUCCESS, not idle: the surface gets one honest frame to show
             // "Identity confirmed" before it closes. Cleared on the next view change.
-            this.signIn = buildSignIn(COMPLETED_SIGN_IN_FACTS, this.signInAttempt);
+            this.signIn = this.stampSignIn(COMPLETED_SIGN_IN_FACTS);
             this.view = 'accounts';
             this.emit();
         }
@@ -1256,7 +1148,6 @@ class AccountDialogController {
     failSignIn(failure, message) {
         this.clearPollTimer();
         this.closeAuthSessionSocket();
-        this.closeActivePopup();
         this.signInToken = null;
         this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'error', error: message, failure });
     }
@@ -1348,9 +1239,13 @@ class AccountDialogController {
      * to advance without a fact behind it.
      */
     setSignIn(facts) {
-        this.signIn = buildSignIn(facts, this.signInAttempt);
+        this.signIn = this.stampSignIn(facts);
         this.emit();
     }
+    /** `facts` as the current attempt's state. */
+    stampSignIn(facts) {
+        return buildSignIn(facts, this.signInAttempt, this.signInMethod === 'inline-qr');
+    }
     /** Update a subset of the device-flow facts, re-deriving `progress`. */
     patchSignIn(patch) {
         const { phase, authorizeCode, qrPayload, expiresAt, error, failure, route, routeFailed, pushSentAt, openedAt, } = this.signIn;

package/dist/cjs/utils/authWebUrl.js

@@ -10,7 +10,7 @@
  * past the SSO/FedCM teardown.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IDENTITY_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = void 0;
+exports.AUTH_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = void 0;
 /**
  * The registrable apex (eTLD+1) of the Oxy ecosystem's central Identity
  * Provider, reachable at `auth.${CENTRAL_IDP_APEX}`. Single source of truth so
@@ -18,9 +18,9 @@ exports.IDENTITY_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = void 0;
  */
 exports.CENTRAL_IDP_APEX = 'oxy.so';
 /**
- * The web identity carrier's origin — where a person signs in or creates an
- * account with a passkey, and where their self-custody identity is kept sealed
- * under that passkey (one identity, two carriers). Apps open it; they never
- * handle the identity themselves.
+ * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface and the
+ * one origin that asserts Oxy passkeys: where a person signs in, creates,
+ * recovers or deletes a web account, in the window an app opens (ADR 0029).
+ * Apps open it; they never run the passkey themselves.
  */
-exports.IDENTITY_WEB_ORIGIN = `https://id.${exports.CENTRAL_IDP_APEX}`;
+exports.AUTH_WEB_ORIGIN = `https://auth.${exports.CENTRAL_IDP_APEX}`;

package/dist/cjs/utils/oauthPkce.js

@@ -29,10 +29,11 @@ exports.consumeOAuthReturnPath = consumeOAuthReturnPath;
 exports.persistOAuthHandshake = persistOAuthHandshake;
 exports.readOAuthHandshake = readOAuthHandshake;
 exports.clearOAuthHandshake = clearOAuthHandshake;
+const authWebUrl_1 = require("./authWebUrl");
 const protocol_1 = require("@oxy.so/protocol");
 const logger_1 = require("../logger");
 /** The central Oxy IdP authorization endpoint used by default. */
-exports.OXY_AUTHORIZE_URL = 'https://auth.oxy.so/authorize';
+exports.OXY_AUTHORIZE_URL = `${authWebUrl_1.AUTH_WEB_ORIGIN}/authorize`;
 /** Default OAuth scope requested for a "Sign in with Oxy" third-party flow. */
 exports.DEFAULT_OAUTH_SCOPE = 'openid profile';
 /**
@@ -151,6 +152,9 @@ function buildOAuthAuthorizeUrl(params) {
     if (params.responseMode) {
         url.searchParams.set('response_mode', params.responseMode);
     }
+    if (params.screen) {
+        url.searchParams.set('screen', params.screen);
+    }
     return url.toString();
 }
 /** `sessionStorage` key for the OAuth CSRF `state` across an authorize redirect. */