@oxy.so/core 1.18.1 → 3.0.0

package/src/mixins/__tests__/onTokensChanged.test.ts

@@ -1,129 +0,0 @@
-/**
- * `OxyServices.onTokensChanged` token-mirroring subscription tests.
- *
- * `onTokensChanged(listener)` is the single hook @oxy.so/services' OxyProvider
- * uses to keep the shared `oxyClient` singleton's token store in lockstep with
- * whichever OxyServices instance actually owns the session. It must fire on
- * EVERY access-token mutation — explicit `setTokens`, `clearTokens`, and the
- * token-planting auth flows (`verifyChallenge` / `claimSessionByToken`) which
- * route through `setTokens` internally — passing the resulting token or `null`.
- *
- * These tests exercise the listener against a real OxyServices instance. The
- * one network-dependent path (`verifyChallenge`) stubs `makeRequest` so the
- * internal planting is observed end-to-end through the public subscription.
- */
-
-import { OxyServices } from '../../OxyServices';
-
-function makeOxy(): OxyServices {
-  return new OxyServices({ baseURL: 'https://api.oxy.so' });
-}
-
-describe('OxyServices.onTokensChanged', () => {
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  it('fires with the access token on setTokens', () => {
-    const oxy = makeOxy();
-    const listener = jest.fn();
-    oxy.onTokensChanged(listener);
-
-    oxy.setTokens('access_1');
-
-    expect(listener).toHaveBeenCalledTimes(1);
-    expect(listener).toHaveBeenCalledWith('access_1');
-  });
-
-  it('fires with null on clearTokens', () => {
-    const oxy = makeOxy();
-    oxy.setTokens('access_1');
-
-    const listener = jest.fn();
-    oxy.onTokensChanged(listener);
-
-    oxy.clearTokens();
-
-    expect(listener).toHaveBeenCalledTimes(1);
-    expect(listener).toHaveBeenCalledWith(null);
-  });
-
-  it('reflects the live token on every change (set → set → clear)', () => {
-    const oxy = makeOxy();
-    const seen: Array<string | null> = [];
-    oxy.onTokensChanged((token) => seen.push(token));
-
-    oxy.setTokens('access_1');
-    oxy.setTokens('access_2');
-    oxy.clearTokens();
-
-    expect(seen).toEqual(['access_1', 'access_2', null]);
-  });
-
-  it('stops firing after the returned unsubscribe is called', () => {
-    const oxy = makeOxy();
-    const listener = jest.fn();
-    const unsubscribe = oxy.onTokensChanged(listener);
-
-    oxy.setTokens('access_1');
-    expect(listener).toHaveBeenCalledTimes(1);
-
-    unsubscribe();
-    oxy.setTokens('access_2');
-    oxy.clearTokens();
-
-    // No further notifications after unsubscribe.
-    expect(listener).toHaveBeenCalledTimes(1);
-  });
-
-  it('notifies multiple independent listeners without clobbering', () => {
-    const oxy = makeOxy();
-    const a = jest.fn();
-    const b = jest.fn();
-    oxy.onTokensChanged(a);
-    oxy.onTokensChanged(b);
-
-    oxy.setTokens('access_1');
-
-    expect(a).toHaveBeenCalledWith('access_1');
-    expect(b).toHaveBeenCalledWith('access_1');
-  });
-
-  it('isolates a throwing listener so others (and the auth flow) still proceed', () => {
-    const oxy = makeOxy();
-    const bad = jest.fn(() => {
-      throw new Error('listener boom');
-    });
-    const good = jest.fn();
-    oxy.onTokensChanged(bad);
-    oxy.onTokensChanged(good);
-
-    // Must not throw out of setTokens.
-    expect(() => oxy.setTokens('access_1')).not.toThrow();
-    expect(good).toHaveBeenCalledWith('access_1');
-  });
-
-  it('fires when verifyChallenge plants the first token from /auth/verify', async () => {
-    const oxy = makeOxy();
-    const listener = jest.fn();
-    oxy.onTokensChanged(listener);
-
-    jest.spyOn(oxy, 'makeRequest').mockImplementation(async (_method, url) => {
-      if (url === '/auth/verify') {
-        return {
-          sessionId: 'sess_1',
-          deviceId: 'dev_1',
-          expiresAt: new Date(Date.now() + 60_000).toISOString(),
-          accessToken: 'access_verify',
-          user: { id: 'user_1', username: 'tester' },
-        } as never;
-      }
-      throw new Error(`unexpected request to ${url}`);
-    });
-
-    await oxy.verifyChallenge('pubkey', 'challenge', 'sig', 123, 'Device', 'fp');
-
-    // The planted token propagated through the subscription with no extra call.
-    expect(listener).toHaveBeenCalledWith('access_verify');
-  });
-});

package/src/mixins/__tests__/preSessionSkipAuth.test.ts

@@ -1,284 +0,0 @@
-/**
- * Regression: every purely pre-session public SDK endpoint must pass `skipAuth`
- * so a pending refresh handler cannot self-await (see httpServiceAuthSelfAwait).
- */
-import { OxyServices } from '../../OxyServices';
-import { SignatureService } from '../../crypto/signatureService';
-
-describe('pre-session public endpoints use skipAuth', () => {
-  let oxy: OxyServices;
-  let makeRequest: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeRequest = jest.spyOn(oxy, 'makeRequest').mockResolvedValue({} as never);
-  });
-
-  afterEach(() => jest.restoreAllMocks());
-
-  it('lookupUsername skips auth preflight', async () => {
-    await oxy.lookupUsername('alice');
-    expect(makeRequest).toHaveBeenCalledWith(
-      'GET',
-      '/auth/lookup/alice',
-      undefined,
-      expect.objectContaining({ skipAuth: true }),
-    );
-  });
-
-  it('getPublicApplication skips auth preflight', async () => {
-    makeRequest.mockResolvedValueOnce({ application: { id: 'app-1', name: 'App' } });
-    await oxy.getPublicApplication('oxy_dk_test');
-    expect(makeRequest).toHaveBeenCalledWith(
-      'GET',
-      '/auth/oauth/client/oxy_dk_test',
-      undefined,
-      expect.objectContaining({ skipAuth: true }),
-    );
-  });
-
-  it('claimSessionByToken skips auth preflight', async () => {
-    makeRequest.mockResolvedValueOnce({
-      accessToken: 'tok',
-      sessionId: 's1',
-      deviceId: 'd1',
-      expiresAt: '2030-01-01T00:00:00.000Z',
-      user: { id: 'u1', username: 'u' },
-    });
-    await oxy.claimSessionByToken('secret-session-token');
-    expect(makeRequest).toHaveBeenCalledWith(
-      'POST',
-      '/auth/session/claim',
-      { sessionToken: 'secret-session-token' },
-      expect.objectContaining({ skipAuth: true, retry: false }),
-    );
-  });
-
-  it('startCommonsSignIn skips auth preflight', async () => {
-    jest.spyOn(Date, 'now').mockReturnValue(1700000000000);
-    const generateChallenge = jest
-      .spyOn(SignatureService, 'generateChallenge')
-      .mockResolvedValue('secret-session-token');
-    makeRequest.mockResolvedValueOnce({
-      authorizeCode: 'code-1',
-      qrPayload: 'oxycommons://approve?v=1&code=code-1',
-      status: 'pending',
-    });
-    await oxy.startCommonsSignIn({ clientId: 'oxy_dk_test' });
-    expect(makeRequest).toHaveBeenCalledWith(
-      'POST',
-      '/auth/session/create',
-      expect.objectContaining({ sessionToken: 'secret-session-token', clientId: 'oxy_dk_test' }),
-      expect.objectContaining({ cache: false, skipAuth: true }),
-    );
-    generateChallenge.mockRestore();
-  });
-
-  it('getUserByPublicKey skips auth preflight', async () => {
-    makeRequest.mockResolvedValueOnce({ id: 'u1', username: 'alice' });
-    await oxy.getUserByPublicKey('abc123');
-    expect(makeRequest).toHaveBeenCalledWith(
-      'GET',
-      '/auth/user/abc123',
-      undefined,
-      expect.objectContaining({ skipAuth: true }),
-    );
-  });
-
-  it('webauthnRegisterOptions skips auth preflight on signup (username provided)', async () => {
-    await oxy.webauthnRegisterOptions({ username: 'alice' });
-    expect(makeRequest).toHaveBeenCalledWith(
-      'POST',
-      '/auth/webauthn/register/options',
-      { username: 'alice' },
-      expect.objectContaining({ skipAuth: true }),
-    );
-  });
-
-  it('webauthnRegisterVerify skips auth preflight on signup (username in envelope)', async () => {
-    makeRequest.mockResolvedValueOnce({
-      sessionId: 's1',
-      deviceId: 'd1',
-      accessToken: 'tok',
-      expiresAt: '2030-01-01T00:00:00.000Z',
-      deviceSecret: 'ds',
-      user: { id: 'u1', username: 'alice' },
-    });
-    await oxy.webauthnRegisterVerify({ id: 'cred' }, { username: 'alice' });
-    expect(makeRequest).toHaveBeenCalledWith(
-      'POST',
-      '/auth/webauthn/register/verify',
-      expect.objectContaining({ username: 'alice' }),
-      expect.objectContaining({ skipAuth: true }),
-    );
-  });
-
-  it('getServiceToken skips auth preflight', async () => {
-    makeRequest.mockResolvedValueOnce({ token: 'svc-tok', expiresIn: 3600 });
-    await oxy.getServiceToken('oxy_dk_svc', 'secret-value');
-    expect(makeRequest).toHaveBeenCalledWith(
-      'POST',
-      '/auth/service-token',
-      { apiKey: 'oxy_dk_svc', apiSecret: 'secret-value' },
-      expect.objectContaining({ skipAuth: true, cache: false, retry: false }),
-    );
-  });
-
-  it('exchangeOAuthCode skips auth preflight and sends an RFC 6749 form request', async () => {
-    makeRequest.mockResolvedValueOnce({
-      access_token: 'tok',
-      token_type: 'Bearer',
-      expires_in: 900,
-      session_id: 's1',
-      deviceId: 'd1',
-      deviceSecret: 'ds_secret',
-      user: { id: 'u1' },
-    });
-    await oxy.exchangeOAuthCode({
-      code: 'code-1',
-      clientId: 'oxy_dk_test',
-      redirectUri: 'https://app.example/callback',
-      codeVerifier: 'verifier',
-    });
-    expect(makeRequest).toHaveBeenCalledWith(
-      'POST',
-      '/auth/oauth/token',
-      expect.any(URLSearchParams),
-      expect.objectContaining({ skipAuth: true }),
-    );
-    // The body is the standard §4.1.3 request: snake_case names, an explicit
-    // grant type, and nothing camelCase that only Oxy's old endpoint understood.
-    const body = makeRequest.mock.calls[0][2] as URLSearchParams;
-    expect(Object.fromEntries(body.entries())).toEqual({
-      grant_type: 'authorization_code',
-      code: 'code-1',
-      redirect_uri: 'https://app.example/callback',
-      client_id: 'oxy_dk_test',
-      code_verifier: 'verifier',
-    });
-  });
-
-  // A third-party grant is meant to be ISOLATED from the browser's shared
-  // DeviceSession, so the token endpoint must be free to return no device
-  // credential. Core used to require the pair, which made that omission
-  // unshippable: every third-party sign-in through the SDK would have collapsed
-  // into a silent `exchange-failed` (issue #954).
-  it('exchangeOAuthCode accepts a device-less grant and still plants the token', async () => {
-    makeRequest.mockResolvedValueOnce({
-      access_token: 'tok',
-      token_type: 'Bearer',
-      expires_in: 900,
-      session_id: 's1',
-      user: { id: 'u1', username: 'alice' },
-    });
-
-    const result = await oxy.exchangeOAuthCode({
-      code: 'code-1',
-      clientId: 'oxy_dk_test',
-      redirectUri: 'https://app.example/callback',
-      codeVerifier: 'verifier',
-    });
-
-    expect(result).toMatchObject({
-      sessionId: 's1',
-      accessToken: 'tok',
-      user: { id: 'u1', username: 'alice' },
-    });
-    // Absent, not `undefined`-valued: a device-less grant carries no device keys
-    // at all, so nothing downstream can read one and persist an empty credential.
-    expect(result).not.toHaveProperty('deviceId');
-    expect(result).not.toHaveProperty('deviceSecret');
-    expect(oxy.getAccessToken()).toBe('tok');
-  });
-
-  it('exchangeOAuthCode accepts a deviceId with no deviceSecret', async () => {
-    makeRequest.mockResolvedValueOnce({
-      access_token: 'tok',
-      token_type: 'Bearer',
-      expires_in: 900,
-      session_id: 's1',
-      deviceId: 'd1',
-      user: { id: 'u1' },
-    });
-
-    const result = await oxy.exchangeOAuthCode({
-      code: 'code-1',
-      clientId: 'oxy_dk_test',
-      redirectUri: 'https://app.example/callback',
-      codeVerifier: 'verifier',
-    });
-
-    expect(result).toMatchObject({ sessionId: 's1', deviceId: 'd1' });
-    expect(result).not.toHaveProperty('deviceSecret');
-  });
-
-  // The device pair left the guard; what identifies the session did NOT. Without
-  // these two the whole guard could be deleted and every test above would stay
-  // green — `sessionId` would silently become `undefined` on the returned session.
-  it.each([
-    ['session_id', { access_token: 'tok', expires_in: 900, user: { id: 'u1' } }],
-    ['user', { access_token: 'tok', expires_in: 900, session_id: 's1' }],
-  ])('exchangeOAuthCode still rejects a response missing %s', async (_field, response) => {
-    makeRequest.mockResolvedValueOnce(response);
-    await expect(
-      oxy.exchangeOAuthCode({
-        code: 'code-1',
-        clientId: 'oxy_dk_test',
-        redirectUri: 'https://app.example/callback',
-        codeVerifier: 'verifier',
-      }),
-    ).rejects.toThrow(/incomplete session payload/i);
-  });
-
-  it('exchangeOAuthCode reads the FLAT RFC 6749 §5.1 response', async () => {
-    makeRequest.mockResolvedValueOnce({
-      access_token: 'tok',
-      token_type: 'Bearer',
-      expires_in: 900,
-      scope: 'profile:read',
-      session_id: 's1',
-      deviceId: 'd1',
-      deviceSecret: 'ds_secret',
-      user: { id: 'u1', username: 'alice', avatar: 'file-1' },
-    });
-
-    const result = await oxy.exchangeOAuthCode({
-      code: 'code-1',
-      clientId: 'oxy_dk_test',
-      redirectUri: 'https://app.example/callback',
-      codeVerifier: 'verifier',
-    });
-
-    expect(result).toMatchObject({
-      sessionId: 's1',
-      deviceId: 'd1',
-      deviceSecret: 'ds_secret',
-      accessToken: 'tok',
-      user: { id: 'u1', username: 'alice', avatar: 'file-1' },
-    });
-  });
-
-  it('getOAuthUserInfo reads the flat OIDC userinfo response', async () => {
-    makeRequest.mockResolvedValueOnce({
-      sub: '507f1f77bcf86cd799439011',
-      preferred_username: 'alice',
-      name: 'Alice Example',
-      picture: 'https://api.oxy.so/assets/file-1/stream',
-    });
-
-    const result = await oxy.getOAuthUserInfo();
-
-    expect(makeRequest).toHaveBeenCalledWith(
-      'GET',
-      '/auth/oauth/userinfo',
-      undefined,
-      expect.objectContaining({ cache: false }),
-    );
-    expect(result).toEqual({
-      sub: '507f1f77bcf86cd799439011',
-      preferred_username: 'alice',
-      name: 'Alice Example',
-      picture: 'https://api.oxy.so/assets/file-1/stream',
-    });
-  });
-});

package/src/mixins/__tests__/privacyCacheInvalidation.test.ts

@@ -1,155 +0,0 @@
-/**
- * Privacy / list cache-invalidation tests.
- *
- * The privacy reads cache their GET responses (identity-scoped):
- *  - `getBlockedUsers()`     → `GET:/privacy/blocked`        (~1 min TTL)
- *  - `getRestrictedUsers()`  → `GET:/privacy/restricted`     (~1 min TTL)
- *  - `getPrivacySettings(id)`→ `GET:/privacy/<id>/privacy`   (~2 min TTL)
- *
- * Each corresponding write MUST invalidate the matching cached GET, otherwise a
- * consumer that re-reads within the TTL window observes the STALE pre-write
- * value (mirrors the follow/unfollow follow-status invalidation contract).
- */
-
-import { OxyServices } from '../../OxyServices';
-
-/** Build a non-verified JWT whose payload decodes to the given claims. */
-function makeJwt(payload: Record<string, unknown>): string {
-  const b64url = (obj: Record<string, unknown>): string =>
-    Buffer.from(JSON.stringify(obj)).toString('base64url');
-  const fullPayload = { exp: Math.floor(Date.now() / 1000) + 3600, ...payload };
-  return `${b64url({ alg: 'none', typ: 'JWT' })}.${b64url(fullPayload)}.sig`;
-}
-
-/** A JSON `Response` mimicking the API's `{ data: ... }` success envelope. */
-function jsonResponse(data: unknown): Response {
-  return new Response(JSON.stringify({ data }), {
-    status: 200,
-    headers: { 'content-type': 'application/json' },
-  });
-}
-
-describe('privacy cache invalidation', () => {
-  let originalFetch: typeof globalThis.fetch;
-  let fetchMock: jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
-  let oxy: OxyServices;
-
-  beforeEach(() => {
-    originalFetch = globalThis.fetch;
-    fetchMock = jest.fn();
-    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    oxy.httpService.setTokens(makeJwt({ userId: 'me' }));
-  });
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.clearAllMocks();
-  });
-
-  it('busts the cached blocked list after blockUser', async () => {
-    // 1) Warm the cache: empty blocked list.
-    fetchMock.mockResolvedValueOnce(jsonResponse([]));
-    expect(await oxy.getBlockedUsers()).toEqual([]);
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    // A second read within the TTL is a cache hit (no extra network call).
-    await oxy.getBlockedUsers();
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    // 2) Block a user — must invalidate the cached list.
-    fetchMock.mockResolvedValueOnce(jsonResponse({ message: 'ok' }));
-    await oxy.blockUser('target-1');
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-
-    // 3) Re-read MUST re-fetch and observe the new entry.
-    fetchMock.mockResolvedValueOnce(jsonResponse([{ blockedId: 'target-1' }]));
-    const after = await oxy.getBlockedUsers();
-    expect(fetchMock).toHaveBeenCalledTimes(3);
-    expect(after).toEqual([{ blockedId: 'target-1' }]);
-  });
-
-  it('busts the cached blocked list after unblockUser', async () => {
-    fetchMock.mockResolvedValueOnce(jsonResponse([{ blockedId: 'target-1' }]));
-    await oxy.getBlockedUsers();
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ message: 'ok' }));
-    await oxy.unblockUser('target-1');
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse([]));
-    expect(await oxy.getBlockedUsers()).toEqual([]);
-    expect(fetchMock).toHaveBeenCalledTimes(3);
-  });
-
-  it('busts the cached restricted list after restrictUser / unrestrictUser', async () => {
-    fetchMock.mockResolvedValueOnce(jsonResponse([]));
-    await oxy.getRestrictedUsers();
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ message: 'ok' }));
-    await oxy.restrictUser('target-2');
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse([{ restrictedId: 'target-2' }]));
-    expect(await oxy.getRestrictedUsers()).toEqual([{ restrictedId: 'target-2' }]);
-    expect(fetchMock).toHaveBeenCalledTimes(3);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ message: 'ok' }));
-    await oxy.unrestrictUser('target-2');
-    expect(fetchMock).toHaveBeenCalledTimes(4);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse([]));
-    expect(await oxy.getRestrictedUsers()).toEqual([]);
-    expect(fetchMock).toHaveBeenCalledTimes(5);
-  });
-
-  it('busts the cached privacy settings (same id) after updatePrivacySettings', async () => {
-    // Warm the settings cache for an explicit id (avoids a getCurrentUser call).
-    fetchMock.mockResolvedValueOnce(jsonResponse({ isPrivateAccount: false }));
-    expect(await oxy.getPrivacySettings('me')).toEqual({ isPrivateAccount: false });
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    // Cache hit on the second read.
-    await oxy.getPrivacySettings('me');
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    // Update — must invalidate `GET:/privacy/me/privacy`.
-    fetchMock.mockResolvedValueOnce(jsonResponse({ isPrivateAccount: true }));
-    await oxy.updatePrivacySettings({ isPrivateAccount: true }, 'me');
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-
-    // Re-read MUST re-fetch and observe the new value.
-    fetchMock.mockResolvedValueOnce(jsonResponse({ isPrivateAccount: true }));
-    const after = await oxy.getPrivacySettings('me');
-    expect(fetchMock).toHaveBeenCalledTimes(3);
-    expect(after).toEqual({ isPrivateAccount: true });
-  });
-
-  it('invalidates the exact logical keys on block/restrict/settings writes', async () => {
-    const clearSpy = jest.spyOn(oxy, 'clearCacheEntry');
-    const clearPrefixSpy = jest.spyOn(oxy, 'clearCacheByPrefix');
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ message: 'ok' }));
-    await oxy.blockUser('u1');
-    expect(clearSpy).toHaveBeenCalledWith('GET:/privacy/blocked');
-    expect(clearSpy).toHaveBeenCalledWith('GET:/users/me/graph');
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ message: 'ok' }));
-    await oxy.restrictUser('u2');
-    expect(clearSpy).toHaveBeenCalledWith('GET:/privacy/restricted');
-    expect(clearSpy).toHaveBeenCalledWith('GET:/users/me/graph');
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ isPrivateAccount: true }));
-    await oxy.updatePrivacySettings({ isPrivateAccount: true }, 'me');
-    expect(clearSpy).toHaveBeenCalledWith('GET:/privacy/me/privacy');
-    expect(clearSpy).toHaveBeenCalledWith('GET:/users/me');
-    expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/session/user/');
-    expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
-    expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/profiles/username/');
-
-    clearSpy.mockRestore();
-    clearPrefixSpy.mockRestore();
-  });
-});