@oxy.so/core 1.18.1 → 3.0.0

package/src/session/__tests__/SessionClient.socketFactory.test.ts

@@ -1,81 +0,0 @@
-import type { DeviceSessionState } from '@oxy.so/contracts';
-import * as socketLoader from '../socketLoader';
-import type { MinimalSocket, SocketIOFactory } from '../socketLoader';
-import { SessionClient, type SessionClientHost } from '../SessionClient';
-
-/**
- * P0 (bundler-fragility): SessionClient must NOT depend on a runtime dynamic
- * `import('socket.io-client')` when a consumer (services/auth-sdk) injects the
- * `io` factory statically. These tests pin the two branches of `connectSocket`:
- *
- *  1. `socketFactory` injected  → the injected factory is used and the lazy
- *     loader (`getSocketIO`) is NEVER invoked (the exact call that fails in the
- *     Metro/Expo-web + Vite published-dist consumers).
- *  2. no `socketFactory`        → the lazy loader IS invoked (fallback).
- */
-
-type Handler = (...args: unknown[]) => void;
-class FakeSocket implements MinimalSocket {
-  connected = false;
-  handlers = new Map<string, Handler[]>();
-  on(event: string, cb: Handler) { const l = this.handlers.get(event) ?? []; l.push(cb); this.handlers.set(event, l); }
-  off(event: string, cb?: Handler) { if (!cb) { this.handlers.delete(event); return; } this.handlers.set(event, (this.handlers.get(event) ?? []).filter((h) => h !== cb)); }
-  emit(_event: string, ..._args: unknown[]) { /* no-op: device socket never emits */ }
-  connect() { this.connected = true; }
-  disconnect() { this.connected = false; }
-}
-
-const STATE = (rev: number): DeviceSessionState => ({ deviceId: 'd1', accounts: [{ accountId: 'a1', sessionId: 's1', authuser: 0 }], activeAccountId: 'a1', revision: rev, updatedAt: 1720000000000 });
-const SYNC = (rev: number) => ({ state: STATE(rev), activeToken: { accessToken: `jwt-${rev}`, expiresAt: 'x' } });
-
-function makeHost(over: Partial<SessionClientHost> = {}): SessionClientHost {
-  return {
-    makeRequest: jest.fn().mockResolvedValue(SYNC(1)),
-    getBaseURL: () => 'http://test.invalid',
-    getAccessToken: () => 'tok',
-    getDeviceCredential: () => null,
-    onTokensChanged: () => () => undefined,
-    setTokens: jest.fn(),
-    getCurrentAccountId: () => 'a1',
-    ...over,
-  };
-}
-
-describe('SessionClient injected socketFactory', () => {
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  it('uses the injected factory and NEVER invokes the lazy loader', async () => {
-    const loaderSpy = jest.spyOn(socketLoader, 'getSocketIO');
-    let created: FakeSocket | null = null;
-    const factory: SocketIOFactory = jest.fn((_uri: string) => {
-      created = new FakeSocket();
-      created.connected = true;
-      return created;
-    });
-
-    const client = new SessionClient(makeHost(), { socketFactory: factory });
-    await client.start();
-
-    expect(factory).toHaveBeenCalledTimes(1);
-    expect(factory).toHaveBeenCalledWith('http://test.invalid', expect.objectContaining({ transports: ['websocket'] }));
-    expect(loaderSpy).not.toHaveBeenCalled();
-    expect(created).not.toBeNull();
-    client.stop();
-  });
-
-  it('falls back to the lazy loader when no factory is injected', async () => {
-    const fake = new FakeSocket();
-    fake.connected = true;
-    const lazyFactory: SocketIOFactory = jest.fn(() => fake);
-    const loaderSpy = jest.spyOn(socketLoader, 'getSocketIO').mockResolvedValue(lazyFactory);
-
-    const client = new SessionClient(makeHost());
-    await client.start();
-
-    expect(loaderSpy).toHaveBeenCalledTimes(1);
-    expect(lazyFactory).toHaveBeenCalledWith('http://test.invalid', expect.objectContaining({ transports: ['websocket'] }));
-    client.stop();
-  });
-});

package/src/session/__tests__/SessionClient.state.test.ts

@@ -1,78 +0,0 @@
-import type { DeviceSessionState } from '@oxy.so/contracts';
-import { SessionClient, type SessionClientHost, type TokenTransport } from '../SessionClient';
-
-function makeHost(): SessionClientHost {
-  return {
-    makeRequest: jest.fn(),
-    getBaseURL: () => 'http://test.invalid',
-    getAccessToken: () => 't',
-    getDeviceCredential: () => null,
-    onTokensChanged: () => () => undefined,
-    setTokens: jest.fn(),
-    getCurrentAccountId: () => null,
-  };
-}
-const STATE = (rev: number, active: string | null = 'a1'): DeviceSessionState => ({
-  deviceId: 'd1', accounts: active ? [{ accountId: 'a1', sessionId: 's1', authuser: 0 }] : [], activeAccountId: active, revision: rev, updatedAt: 1720000000000,
-});
-
-// SessionClient.applyState is protected; a tiny subclass exposes it for the unit test.
-class TestClient extends SessionClient { public apply(raw: unknown): boolean { return this.applyState(raw); } }
-
-describe('SessionClient state', () => {
-  it('starts with null state', () => {
-    expect(new SessionClient(makeHost()).getState()).toBeNull();
-  });
-
-  it('applies a valid state and notifies subscribers', () => {
-    const c = new TestClient(makeHost());
-    const seen: (DeviceSessionState | null)[] = [];
-    c.subscribe((s) => seen.push(s));
-    expect(c.apply(STATE(1))).toBe(true);
-    expect(c.getState()?.revision).toBe(1);
-    expect(seen.at(-1)?.revision).toBe(1);
-  });
-
-  it('ignores a stale or equal revision (last-writer-wins) WITHIN the same device', () => {
-    const c = new TestClient(makeHost());
-    c.apply({ ...STATE(5), deviceId: 'A' });
-    expect(c.apply({ ...STATE(5), deviceId: 'A' })).toBe(false);
-    expect(c.apply({ ...STATE(4), deviceId: 'A' })).toBe(false);
-    expect(c.apply({ ...STATE(6), deviceId: 'A' })).toBe(true);
-    expect(c.getState()?.revision).toBe(6);
-  });
-
-  it('accepts a LOWER-revision state from a DIFFERENT device (revision baseline resets cross-device)', () => {
-    const c = new TestClient(makeHost());
-    // Device A at a high revision.
-    expect(c.apply({ ...STATE(10), deviceId: 'A' })).toBe(true);
-    expect(c.getState()?.deviceId).toBe('A');
-    // Device B, freshly converged (revision 1), must win over device A's
-    // stale-but-higher revision — the cross-device comparison is not monotone.
-    expect(c.apply({ ...STATE(1), deviceId: 'B' })).toBe(true);
-    expect(c.getState()?.deviceId).toBe('B');
-    expect(c.getState()?.revision).toBe(1);
-  });
-
-  it('rejects an invalid (unvalidated) state without applying', () => {
-    const c = new TestClient(makeHost());
-    expect(c.apply({ deviceId: 'd1', accounts: 'nope', revision: 1 })).toBe(false);
-    expect(c.getState()).toBeNull();
-  });
-
-  it('calls transport.ensureActiveToken when a state is applied', () => {
-    const transport: TokenTransport = { ensureActiveToken: jest.fn().mockResolvedValue(undefined) };
-    const c = new TestClient(makeHost(), { transport });
-    c.apply(STATE(1));
-    expect(transport.ensureActiveToken).toHaveBeenCalledWith(expect.objectContaining({ revision: 1 }));
-  });
-
-  it('unsubscribe stops notifications', () => {
-    const c = new TestClient(makeHost());
-    const seen: unknown[] = [];
-    const off = c.subscribe((s) => seen.push(s));
-    off();
-    c.apply(STATE(1));
-    expect(seen).toHaveLength(0);
-  });
-});

package/src/session/__tests__/SessionClient.switchTokenOrder.test.ts

@@ -1,170 +0,0 @@
-import type { DeviceSessionState } from '@oxy.so/contracts';
-import { SessionClient, type SessionClientHost, type TokenTransport } from '../SessionClient';
-import { computeIdentityTag } from '../../utils/cacheKey';
-
-/**
- * The account-switch 404 race (regression guard).
- *
- * When a `session_state` push re-elects the active account from A to B, the
- * push carries NO token — the app still holds A's bearer. If a subscriber were
- * notified before B's bearer is planted, a `useCurrentUser`-style refetch would
- * fire under A's token against B's session and 404.
- *
- * INVARIANT: no subscriber is ever notified while the planted bearer identifies
- * an account OTHER than the observed active account. This test records, at every
- * notify, the observed active account alongside the account the CURRENT bearer
- * belongs to (via the same `computeIdentityTag` derivation `applyState` uses)
- * and asserts they always match — and that the switch notify is DEFERRED until
- * the mint lands B's token.
- */
-
-/** A minimal jwt-decode-able token whose `userId` claim is `accountId`. */
-function jwtFor(accountId: string): string {
-  const payload = Buffer.from(JSON.stringify({ userId: accountId })).toString('base64url');
-  return `h.${payload}.s`;
-}
-
-const stateWith = (rev: number, active: string): DeviceSessionState => ({
-  deviceId: 'd1',
-  accounts: [
-    { accountId: 'a1', sessionId: 's-a1', authuser: 0 },
-    { accountId: 'b1', sessionId: 's-b1', authuser: 1 },
-  ],
-  activeAccountId: active,
-  revision: rev,
-  updatedAt: 1720000000000,
-});
-
-class TestClient extends SessionClient {
-  public apply(raw: unknown): boolean {
-    return this.applyState(raw);
-  }
-}
-
-describe('SessionClient — no notify under a mismatched bearer on an account switch', () => {
-  it('defers the switch notify until the mint lands the new active account bearer', async () => {
-    // Mutable planted bearer, starting on account A.
-    let planted: string | null = jwtFor('a1');
-    const host: SessionClientHost = {
-      makeRequest: jest.fn(),
-      getBaseURL: () => 'http://test.invalid',
-      getAccessToken: () => planted,
-      getDeviceCredential: () => null,
-      onTokensChanged: () => () => undefined,
-      setTokens: (token) => {
-        planted = token;
-      },
-      getCurrentAccountId: () => null,
-    };
-
-    // The mint lands the ACTIVE account's bearer, asynchronously (models the
-    // real device-secret mint round trip).
-    const transport: TokenTransport = {
-      ensureActiveToken: jest.fn(async (state: DeviceSessionState) => {
-        await Promise.resolve();
-        if (state.activeAccountId) {
-          planted = jwtFor(state.activeAccountId);
-        }
-      }),
-    };
-
-    const c = new TestClient(host, { transport });
-
-    const observations: Array<{ active: string | null; bearer: string }> = [];
-    c.subscribe((s) => {
-      observations.push({
-        active: s?.activeAccountId ?? null,
-        bearer: computeIdentityTag(host.getAccessToken()),
-      });
-    });
-
-    // Apply A (bearer already A's) → matches → synchronous notify.
-    c.apply(stateWith(1, 'a1'));
-    expect(observations).toEqual([{ active: 'a1', bearer: 'a1' }]);
-
-    // A `session_state` push re-elects B while the bearer is still A's.
-    c.apply(stateWith(2, 'b1'));
-    // The switch notify MUST NOT have fired yet — the bearer is still A's, so a
-    // synchronous notify would let a subscriber observe B under A's token.
-    expect(observations).toEqual([{ active: 'a1', bearer: 'a1' }]);
-
-    // Flush the mint + deferred notify.
-    for (let i = 0; i < 5; i++) {
-      await Promise.resolve();
-    }
-
-    // The mint ran, and the switch notify fired only AFTER B's bearer was planted.
-    expect(transport.ensureActiveToken).toHaveBeenCalledWith(
-      expect.objectContaining({ activeAccountId: 'b1' }),
-    );
-    expect(observations).toContainEqual({ active: 'b1', bearer: 'b1' });
-
-    // At NO notify did the observed active account differ from the bearer's account.
-    for (const o of observations) {
-      expect(o.bearer).toBe(o.active);
-    }
-  });
-
-  it('does not defer when the bearer already belongs to the new active account', () => {
-    let planted: string | null = jwtFor('b1');
-    const host: SessionClientHost = {
-      makeRequest: jest.fn(),
-      getBaseURL: () => 'http://test.invalid',
-      getAccessToken: () => planted,
-      getDeviceCredential: () => null,
-      onTokensChanged: () => () => undefined,
-      setTokens: (token) => {
-        planted = token;
-      },
-      getCurrentAccountId: () => null,
-    };
-    const transport: TokenTransport = { ensureActiveToken: jest.fn().mockResolvedValue(undefined) };
-    const c = new TestClient(host, { transport });
-
-    const seen: Array<string | null> = [];
-    c.subscribe((s) => seen.push(s?.activeAccountId ?? null));
-
-    // Bearer is already B's → the notify is synchronous (no mint-before-notify).
-    c.apply(stateWith(3, 'b1'));
-    expect(seen).toEqual(['b1']);
-  });
-
-  it('reverts state and does not notify when minting fails on an account switch', async () => {
-    let planted: string | null = jwtFor('a1');
-    const host: SessionClientHost = {
-      makeRequest: jest.fn(),
-      getBaseURL: () => 'http://test.invalid',
-      getAccessToken: () => planted,
-      getDeviceCredential: () => null,
-      onTokensChanged: () => () => undefined,
-      setTokens: (token) => {
-        planted = token;
-      },
-      getCurrentAccountId: () => null,
-    };
-
-    const transport: TokenTransport = {
-      ensureActiveToken: jest.fn(async () => {
-        await Promise.resolve();
-        throw new Error('mint failed');
-      }),
-    };
-
-    const c = new TestClient(host, { transport });
-    const seen: Array<string | null> = [];
-    c.subscribe((s) => seen.push(s?.activeAccountId ?? null));
-
-    c.apply(stateWith(1, 'a1'));
-    expect(seen).toEqual(['a1']);
-
-    c.apply(stateWith(2, 'b1'));
-    for (let i = 0; i < 5; i++) {
-      await Promise.resolve();
-    }
-
-    // Still on A — no notify under A's bearer for B's active account.
-    expect(seen).toEqual(['a1']);
-    expect(c.getState()?.activeAccountId).toBe('a1');
-    expect(computeIdentityTag(host.getAccessToken())).toBe('a1');
-  });
-});

package/src/session/__tests__/accountDelegationAccess.test.ts

@@ -1,104 +0,0 @@
-import { ACCOUNT_KINDS } from "@oxy.so/contracts";
-import type { AccountMember } from "../../mixins/OxyServices.accounts";
-import { canSwitchIntoAccount } from "../accountSwitchTargets";
-import { resolveAccountDelegationAccess } from "../accountDelegationAccess";
-
-function membership(
-	permissions: string[],
-	status: AccountMember["status"] = "active",
-): AccountMember {
-	return {
-		_id: "membership-1",
-		accountId: "account-1",
-		memberUserId: "user-1",
-		role: "viewer",
-		permissions,
-		inherit: true,
-		status,
-		source: "direct",
-		createdAt: new Date(0).toISOString(),
-		updatedAt: new Date(0).toISOString(),
-	};
-}
-
-describe("resolveAccountDelegationAccess", () => {
-	it("admits exactly the delegated account kinds for an implicit owner baseline", () => {
-		expect(
-			Object.fromEntries(
-				ACCOUNT_KINDS.map((kind) => [
-					kind,
-					resolveAccountDelegationAccess({ kind, relationship: "owner" }),
-				]),
-			),
-		).toEqual({
-			personal: { hasStanding: true, canActAs: false },
-			organization: { hasStanding: true, canActAs: true },
-			project: { hasStanding: true, canActAs: true },
-			bot: { hasStanding: true, canActAs: true },
-			channel: { hasStanding: true, canActAs: false },
-		});
-	});
-
-	it("keeps bot delegation separate from human account switching", () => {
-		const bot = { kind: "bot" as const, relationship: "owner" as const };
-
-		expect(resolveAccountDelegationAccess(bot)).toEqual({
-			hasStanding: true,
-			canActAs: true,
-		});
-		expect(canSwitchIntoAccount(bot)).toBe(false);
-	});
-
-	it("treats active membership as standing without promoting it to act-as", () => {
-		expect(
-			resolveAccountDelegationAccess({
-				kind: "bot",
-				relationship: "member",
-				callerMembership: membership(["account:read"]),
-			}),
-		).toEqual({ hasStanding: true, canActAs: false });
-	});
-
-	it("uses the effective account:act_as permission for a live member", () => {
-		expect(
-			resolveAccountDelegationAccess({
-				kind: "bot",
-				relationship: "member",
-				callerMembership: membership(["account:read", "account:act_as"]),
-			}),
-		).toEqual({ hasStanding: true, canActAs: true });
-	});
-
-	it("refuses a removed membership even if a stale projection still carries act_as", () => {
-		expect(
-			resolveAccountDelegationAccess({
-				kind: "bot",
-				relationship: "member",
-				callerMembership: membership(["account:act_as"], "removed"),
-			}),
-		).toEqual({ hasStanding: false, canActAs: false });
-	});
-
-	it("honours an explicit permission revoke on an owner membership projection", () => {
-		expect(
-			resolveAccountDelegationAccess({
-				kind: "bot",
-				relationship: "owner",
-				callerMembership: membership(["account:read"]),
-			}),
-		).toEqual({ hasStanding: true, canActAs: false });
-	});
-
-	it("fails closed when the node carries no relationship or kind", () => {
-		expect(resolveAccountDelegationAccess({})).toEqual({
-			hasStanding: false,
-			canActAs: false,
-		});
-		expect(
-			resolveAccountDelegationAccess({ relationship: "member", kind: null }),
-		).toEqual({
-			hasStanding: false,
-			canActAs: false,
-		});
-	});
-});