@oxy.so/core 1.18.0 → 3.0.0

package/src/mixins/__tests__/OxyServices.deviceBoot.test.ts

@@ -1,124 +0,0 @@
-/**
- * Device-boot mixin tests. Stubs `makeRequest` so the tests run with no network
- * and asserts `mintFromDeviceSecret`'s route/shape, contract validation, and the
- * `skipAuth` flag on the bearer-less mint call, plus `provisionBackgroundCredential`'s
- * route/options, contract validation and its 404-tolerant degrade.
- */
-import type {
-  DeviceBackgroundCredentialResponse,
-  DeviceTokenMintResponse,
-} from '@oxy.so/contracts';
-import { OxyServices } from '../../OxyServices';
-
-describe('OxyServices.deviceBoot', () => {
-  let oxy: OxyServices;
-  let makeRequest: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeRequest = jest.spyOn(oxy, 'makeRequest');
-  });
-
-  afterEach(() => jest.restoreAllMocks());
-
-  describe('mintFromDeviceSecret', () => {
-    const MINT: DeviceTokenMintResponse = {
-      accessToken: 'access-minted',
-      expiresAt: '2030-01-01T00:00:00.000Z',
-      nextDeviceSecret: 'ds-next-secret',
-      state: {
-        deviceId: 'dev-1',
-        accounts: [{ accountId: 'user-1', sessionId: 'sess-1', authuser: 0 }],
-        activeAccountId: 'user-1',
-        revision: 3,
-        updatedAt: 1_700_000_000_000,
-      },
-    };
-
-    it('POSTs deviceId + deviceSecret with skipAuth + retry:false + bypassQueue (no bearer, no cache, single attempt, never queued) and returns the validated mint', async () => {
-      makeRequest.mockResolvedValueOnce(MINT);
-      const result = await oxy.mintFromDeviceSecret('dev-1', 'ds-current-secret');
-      expect(result).toEqual(MINT);
-      // `retry: false` — the scheduler/401 lane own backoff; HttpService's inner
-      // retry here would only multiply cold-boot latency on a slow network.
-      // `bypassQueue: true` — the mint is the control-plane call the auth lane
-      // depends on; it must never wait for a RequestQueue slot (deadlock).
-      expect(makeRequest).toHaveBeenCalledWith(
-        'POST',
-        '/session/device/token',
-        { deviceId: 'dev-1', deviceSecret: 'ds-current-secret' },
-        { cache: false, skipAuth: true, retry: false, bypassQueue: true },
-      );
-    });
-
-    it('throws on an unexpected response shape (missing state / nextDeviceSecret)', async () => {
-      makeRequest.mockResolvedValueOnce({ accessToken: 'a', expiresAt: 'b' });
-      await expect(oxy.mintFromDeviceSecret('dev-1', 'ds')).rejects.toThrow();
-    });
-
-    it('propagates a rejected request (e.g. 401 invalid_device_secret)', async () => {
-      const err = Object.assign(new Error('invalid_device_secret'), { status: 401 });
-      makeRequest.mockRejectedValueOnce(err);
-      await expect(oxy.mintFromDeviceSecret('dev-1', 'ds')).rejects.toThrow('invalid_device_secret');
-    });
-
-    it('propagates a 401 no_active_session so the caller can resolve signed-out', async () => {
-      const err = Object.assign(new Error('no_active_session'), { status: 401 });
-      makeRequest.mockRejectedValueOnce(err);
-      await expect(oxy.mintFromDeviceSecret('dev-1', 'ds')).rejects.toThrow('no_active_session');
-    });
-  });
-
-  describe('provisionBackgroundCredential', () => {
-    const CREDENTIAL: DeviceBackgroundCredentialResponse = {
-      deviceId: 'dev-1',
-      secret: 'bg-secret',
-      accountId: 'user-1',
-      expiresAt: '2030-01-01T00:00:00.000Z',
-    };
-
-    /** `HttpService` annotates its rejections with both `status` and `response.status`. */
-    const httpError = (status: number, message: string) =>
-      Object.assign(new Error(message), {
-        status,
-        response: { status, statusText: message },
-      });
-
-    it('POSTs to the background-credential route with NO body and no cache, and returns the validated credential', async () => {
-      makeRequest.mockResolvedValueOnce(CREDENTIAL);
-      const result = await oxy.provisionBackgroundCredential();
-      expect(result).toEqual(CREDENTIAL);
-      // No body: the server derives BOTH the deviceId and the account from the
-      // validated bearer. Normal authenticated path — no skipAuth (a 401 belongs
-      // in the ordinary re-mint lane), no bypassQueue (not control-plane).
-      expect(makeRequest).toHaveBeenCalledWith(
-        'POST',
-        '/session/device/background-credential',
-        undefined,
-        { cache: false },
-      );
-    });
-
-    it('returns null on 404 (endpoint absent) instead of throwing, so an SDK ahead of the API degrades to "no background session"', async () => {
-      makeRequest.mockRejectedValueOnce(httpError(404, 'HTTP 404: Not Found'));
-      await expect(oxy.provisionBackgroundCredential()).resolves.toBeNull();
-    });
-
-    it('throws on an unexpected response shape (missing secret)', async () => {
-      makeRequest.mockResolvedValueOnce({
-        deviceId: 'dev-1',
-        accountId: 'user-1',
-        expiresAt: '2030-01-01T00:00:00.000Z',
-      });
-      await expect(oxy.provisionBackgroundCredential()).rejects.toThrow();
-    });
-
-    it('propagates a non-404 failure (401 / 500) — only an absent endpoint degrades quietly', async () => {
-      makeRequest.mockRejectedValueOnce(httpError(401, 'unauthorized'));
-      await expect(oxy.provisionBackgroundCredential()).rejects.toThrow('unauthorized');
-
-      makeRequest.mockRejectedValueOnce(httpError(500, 'server exploded'));
-      await expect(oxy.provisionBackgroundCredential()).rejects.toThrow('server exploded');
-    });
-  });
-});

package/src/mixins/__tests__/OxyServices.identity.test.ts

@@ -1,301 +0,0 @@
-/**
- * Identity Mixin tests.
- *
- * Stubs `makeRequest` so the tests run with no network. We assert request shape
- * (method, URL, body, cache options), response unwrapping, the DID derivation,
- * and the cache sweep on every mutation.
- */
-
-import type { AuthMethodsResponse, DidDocument, SignedRecordEnvelope, VerifiedDomain } from '@oxy.so/contracts';
-import { OxyServices } from '../../OxyServices';
-import { KeyManager } from '../../crypto/keyManager';
-import { SignatureService } from '../../crypto/signatureService';
-
-const didDocFixture: DidDocument = {
-  '@context': ['https://www.w3.org/ns/did/v1'],
-  id: 'did:web:oxy.so:u:user-123',
-  controller: ['did:web:oxy.so:u:user-123', 'did:web:oxy.so'],
-  verificationMethod: [],
-  authentication: [],
-  assertionMethod: [],
-  alsoKnownAs: ['acct:nate@oxy.so'],
-  service: [],
-};
-
-const authMethodsFixture: AuthMethodsResponse = {
-  did: 'did:web:oxy.so:u:user-123',
-  methods: [{ type: 'identity', linkedAt: '2026-06-26T00:00:00.000Z', verificationMethodId: '#key-1' }],
-};
-
-const recordFixture: SignedRecordEnvelope = {
-  version: 1,
-  type: 'profile',
-  subject: 'did:web:oxy.so:u:user-123',
-  issuer: 'did:web:oxy.so:u:user-123',
-  record: { displayName: 'Nate' },
-  issuedAt: 1700000000000,
-  publicKey: 'pub-hex',
-  alg: 'ES256K-DER-SHA256',
-  signature: 'sig-hex',
-};
-
-const domainFixture: VerifiedDomain = {
-  domain: 'nate.com',
-  verifiedAt: '2026-06-26T00:00:00.000Z',
-  method: 'dns-txt',
-};
-
-describe('OxyServices.identity', () => {
-  let oxy: OxyServices;
-  let makeRequestSpy: jest.SpyInstance;
-  let clearPrefixSpy: jest.SpyInstance;
-  let clearEntrySpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeRequestSpy = jest.spyOn(oxy, 'makeRequest');
-    clearPrefixSpy = jest.spyOn(oxy, 'clearCacheByPrefix').mockReturnValue(0);
-    clearEntrySpy = jest.spyOn(oxy, 'clearCacheEntry').mockReturnValue(undefined);
-    jest.spyOn(oxy, 'getCurrentUserId').mockReturnValue('user-123');
-  });
-
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  describe('resolveDid', () => {
-    it('GETs the DID document and caches the read', async () => {
-      makeRequestSpy.mockResolvedValue(didDocFixture);
-
-      const result = await oxy.resolveDid('user-123');
-
-      expect(result).toEqual(didDocFixture);
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'GET',
-        '/u/user-123/did.json',
-        undefined,
-        expect.objectContaining({ cache: true }),
-      );
-    });
-
-    it('URL-encodes the userId path segment', async () => {
-      makeRequestSpy.mockResolvedValue(didDocFixture);
-      await oxy.resolveDid('a/b');
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'GET',
-        '/u/a%2Fb/did.json',
-        undefined,
-        expect.anything(),
-      );
-    });
-  });
-
-  describe('getMyDid / getMyDidDocument', () => {
-    it('derives the current user DID', () => {
-      expect(oxy.getMyDid()).toBe('did:web:oxy.so:u:user-123');
-    });
-
-    it('throws when no user is authenticated', () => {
-      jest.spyOn(oxy, 'getCurrentUserId').mockReturnValue(null);
-      expect(() => oxy.getMyDid()).toThrow(/No authenticated user/);
-    });
-
-    it('resolves the current user DID document', async () => {
-      makeRequestSpy.mockResolvedValue(didDocFixture);
-      const result = await oxy.getMyDidDocument();
-      expect(result).toEqual(didDocFixture);
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'GET',
-        '/u/user-123/did.json',
-        undefined,
-        expect.objectContaining({ cache: true }),
-      );
-    });
-  });
-
-  describe('listAuthMethods', () => {
-    it('GETs /auth/methods', async () => {
-      makeRequestSpy.mockResolvedValue(authMethodsFixture);
-      const result = await oxy.listAuthMethods();
-      expect(result).toEqual(authMethodsFixture);
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'GET',
-        '/auth/methods',
-        undefined,
-        expect.objectContaining({ cache: true }),
-      );
-    });
-  });
-
-  describe('removePasskey', () => {
-    it('DELETEs /auth/link/webauthn/:credentialID and sweeps cache', async () => {
-      makeRequestSpy.mockResolvedValue({ success: true, message: 'Passkey unlinked successfully' });
-
-      await oxy.removePasskey('cred-abc');
-
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'DELETE',
-        '/auth/link/webauthn/cred-abc',
-        undefined,
-        expect.objectContaining({ cache: false }),
-      );
-      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
-    });
-
-    it('URL-encodes the credential id', async () => {
-      makeRequestSpy.mockResolvedValue({ success: true, message: 'Passkey unlinked successfully' });
-
-      await oxy.removePasskey('a/b+c=');
-
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'DELETE',
-        '/auth/link/webauthn/a%2Fb%2Bc%3D',
-        undefined,
-        expect.objectContaining({ cache: false }),
-      );
-    });
-  });
-
-  describe('signRecord (client-only)', () => {
-    it('signs with the current user DID as subject and does not hit the network', async () => {
-      const signRecordSpy = jest
-        .spyOn(SignatureService, 'signRecord')
-        .mockResolvedValue(recordFixture);
-
-      const result = await oxy.signRecord('profile', { displayName: 'Nate' });
-
-      expect(signRecordSpy).toHaveBeenCalledWith('profile', 'did:web:oxy.so:u:user-123', {
-        displayName: 'Nate',
-      });
-      expect(result).toEqual(recordFixture);
-      expect(makeRequestSpy).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('publishRecord', () => {
-    it('signs then POSTs the envelope to /identity/records', async () => {
-      jest.spyOn(SignatureService, 'signRecord').mockResolvedValue(recordFixture);
-      makeRequestSpy.mockResolvedValue({ envelope: recordFixture, verified: true });
-
-      const result = await oxy.publishRecord('profile', { displayName: 'Nate' });
-
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'POST',
-        '/identity/records',
-        recordFixture,
-        expect.objectContaining({ cache: false }),
-      );
-      expect(result).toEqual({ envelope: recordFixture, verified: true });
-    });
-  });
-
-  describe('getRecord / verifyRecord', () => {
-    it('GETs and unwraps the record', async () => {
-      makeRequestSpy.mockResolvedValue({ record: recordFixture });
-      const result = await oxy.getRecord('user-123', 'profile');
-      expect(result).toEqual(recordFixture);
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'GET',
-        '/identity/records/user-123/profile',
-        undefined,
-        expect.objectContaining({ cache: true }),
-      );
-    });
-
-    it('GETs the verify verdict', async () => {
-      makeRequestSpy.mockResolvedValue({ verified: true });
-      const result = await oxy.verifyRecord('user-123', 'identity');
-      expect(result).toEqual({ verified: true });
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'GET',
-        '/identity/records/user-123/identity/verify',
-        undefined,
-        expect.objectContaining({ cache: true }),
-      );
-    });
-  });
-
-  describe('exportMyData', () => {
-    it('GETs /users/me/export without caching', async () => {
-      const bundle = { $schema: 'x', did: 'did:web:oxy.so:u:user-123' };
-      makeRequestSpy.mockResolvedValue(bundle);
-      const result = await oxy.exportMyData();
-      expect(result).toEqual(bundle);
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'GET',
-        '/users/me/export',
-        undefined,
-        expect.objectContaining({ cache: false }),
-      );
-    });
-  });
-
-  describe('domains', () => {
-    it('requestDomainVerification POSTs the domain', async () => {
-      const instructions = {
-        domain: 'nate.com',
-        token: 'tok',
-        dns: { name: '_oxy-identity.nate.com', value: 'oxy-domain-verification=tok' },
-        wellKnown: { url: 'https://nate.com/.well-known/oxy-domain', body: 'tok' },
-      };
-      makeRequestSpy.mockResolvedValue(instructions);
-
-      const result = await oxy.requestDomainVerification('nate.com');
-
-      expect(result).toEqual(instructions);
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'POST',
-        '/identity/domains',
-        { domain: 'nate.com' },
-        expect.objectContaining({ cache: false }),
-      );
-    });
-
-    it('verifyDomain POSTs to the verify path and sweeps cache', async () => {
-      makeRequestSpy.mockResolvedValue({ verified: true, domain: domainFixture });
-
-      await oxy.verifyDomain('nate.com');
-
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'POST',
-        '/identity/domains/nate.com/verify',
-        undefined,
-        expect.objectContaining({ cache: false }),
-      );
-      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
-      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
-    });
-
-    it('listDomains GETs and unwraps domains', async () => {
-      makeRequestSpy.mockResolvedValue({ domains: [domainFixture] });
-      const result = await oxy.listDomains();
-      expect(result).toEqual([domainFixture]);
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'GET',
-        '/identity/domains',
-        undefined,
-        expect.objectContaining({ cache: true }),
-      );
-    });
-
-    it('listDomains defaults to an empty array when domains is absent', async () => {
-      makeRequestSpy.mockResolvedValue({});
-      await expect(oxy.listDomains()).resolves.toEqual([]);
-    });
-
-    it('removeDomain DELETEs and sweeps cache', async () => {
-      makeRequestSpy.mockResolvedValue({ success: true });
-
-      await oxy.removeDomain('nate.com');
-
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'DELETE',
-        '/identity/domains/nate.com',
-        undefined,
-        expect.objectContaining({ cache: false }),
-      );
-      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
-      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
-    });
-  });
-});