@oxy.so/core 1.18.0 → 3.0.0

package/src/server/auth.ts

@@ -1,6 +1,5 @@
 import type { NextFunction, Request, RequestHandler, Response } from 'express';
-import type { OxyServices } from '../OxyServices';
-import type { OxyAuthRefusal } from '../mixins/OxyServices.utility';
+import type { AuthMiddlewareOptions, OxyAuthRefusal, OxyMiddleware } from './middleware';
 import { logger } from '../logger';
 import { OXY_SERVICE_ENVIRONMENTS, type OxyServiceEnvironment } from '../utils/oxyServiceEnvironment';
 
@@ -59,11 +58,11 @@ export interface OxyAuthenticatedRequest extends OxyAuthRequest {
 
 export interface OxyAuthMiddlewareOptions {
   /**
-   * Options forwarded to `oxy.auth()`.
+   * Options forwarded to `server.middleware.auth()`.
    * `optional` is forced to `true` by the composed helpers so route guards can
    * produce one consistent 401 shape.
    */
-  auth?: Parameters<OxyServices['auth']>[0];
+  auth?: AuthMiddlewareOptions;
 }
 
 function normalizeId(value: string | null | undefined): string | null {
@@ -224,7 +223,7 @@ export function getRequiredOxyUserId(req: Request): string {
  * Why the credential on this request was refused, or `null` when none was
  * presented (or it was accepted).
  *
- * Set by `oxy.auth()` — including the `optional: true` mount the composed
+ * Set by `server.middleware.auth()` — including the `optional: true` mount the composed
  * helpers use, where a refusal otherwise leaves no trace: the request simply
  * arrives unauthenticated and the host answers its own generic 401. Hosts log
  * this beside their own 401; it is diagnostic and **must not be put into a
@@ -264,11 +263,16 @@ export function requireOxyAuth(req: Request, res: Response, next: NextFunction):
   next();
 }
 
+/** What the composed helpers need of an `OxyServer`: its `middleware.auth`. */
+export interface OxyAuthHost {
+  readonly middleware: Pick<OxyMiddleware, 'auth'>;
+}
+
 export function createOptionalOxyAuth(
-  oxy: OxyServices,
+  oxy: OxyAuthHost,
   options: OxyAuthMiddlewareOptions = {},
 ): RequestHandler {
-  const resolveSession = oxy.auth({ ...options.auth, optional: true });
+  const resolveSession = oxy.middleware.auth({ ...options.auth, optional: true }) as unknown as RequestHandler;
 
   return (req, res, next) => {
     if (getOxyUserId(req)) {
@@ -287,7 +291,7 @@ export function createOptionalOxyAuth(
 }
 
 export function createOxyAuthMiddleware(
-  oxy: OxyServices,
+  oxy: OxyAuthHost,
   options: OxyAuthMiddlewareOptions = {},
 ): RequestHandler {
   const resolveSession = createOptionalOxyAuth(oxy, options);

package/src/server/index.ts

@@ -6,15 +6,37 @@
  *
  * @example
  * ```ts
- * import { createOxyRateLimit } from '@oxy.so/core/server';
- * import { oxyClient } from '@oxy.so/core';
+ * import { OxyServer, createOxyAuthMiddleware, createOxyRateLimit } from '@oxy.so/core/server';
  *
- * const oxy = oxyClient({ apiUrl: 'https://api.oxy.so' });
+ * const oxy = new OxyServer({ baseURL: 'https://api.oxy.so', serviceAuth: { apiKey, apiSecret } });
  *
  * app.use(createOxyRateLimit(oxy, { store: redisStore }));
+ * app.use('/api', createOxyAuthMiddleware(oxy));
  * ```
  */
 
+// The backend client: OxyServices plus the service-token lane, middleware,
+// account events and the service-only namespace methods.
+export { OxyServer, ServiceCredentialMismatchError, ANONYMOUS_SERVICE_TOKEN_RETRY_MS } from './OxyServer';
+export type { OxyServerConfig, ServiceTokenResponse } from './OxyServer';
+export {
+  ServerAgencyApi,
+  ServerAssetsApi,
+  ServerLinkedAccountsApi,
+  ServerNotificationsApi,
+  ServerReputationApi,
+} from './namespaces';
+export { OxyAccountEventError, OXY_ACCOUNT_DELETED_EVENT_URI } from './middleware';
+export type {
+  AuthMiddlewareOptions,
+  OxyAccountEvent,
+  OxyAccountEventFeedItem,
+  OxyAccountEventFeedPage,
+  OxyMiddleware,
+  ServiceActingAsVerification,
+  ServiceApp,
+  VerifyAccountEventOptions,
+} from './middleware';
 export {
   createOptionalOxyAuth,
   createOxyAuthMiddleware,
@@ -29,6 +51,7 @@ export {
   requireOxyAuth,
   OXY_SERVICE_ENVIRONMENTS,
 } from './auth';
+export type { OxyAuthHost } from './auth';
 export type {
   OxyAuthenticatedRequest,
   OxyAuthRefusal,
@@ -152,7 +175,7 @@ export type {
   OxyUserInvalidationHandlerOptions,
 } from './userInvalidation';
 // The identity-key enumeration itself is platform-neutral (`src/utils/`) so the
-// client mixins and this Node-only subscriber sweep the SAME list — a second
+// client namespaces and this Node-only subscriber sweep the SAME list — a second
 // copy is what let `updateAccount` and `updateProfile` drift apart.
 export { evictOxyIdentityCache, oxyUserByIdCacheKey, OXY_IDENTITY_CACHE_PREFIXES } from '../utils/identityCacheSweep';
 export type { OxyIdentityCacheEvictor } from '../utils/identityCacheSweep';
@@ -162,7 +185,7 @@ export type { OxyIdentityCacheEvictor } from '../utils/identityCacheSweep';
 // Pure host handling (no browser deps), so it is safe on the server subpath and
 // lets `@oxy.so/api` derive `auth.<apex>` without duplicating PSL logic.
 export { registrableApex } from '../utils/registrableApex';
-export { isOfficialWebOrigin } from '../utils/officialOrigins';
+export { isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin } from '../utils/officialOrigins';
 
 export { createEcosystemTraffic } from './traffic';
 export type { EcosystemTrafficOptions } from './traffic';