@oxy.so/core 1.9.0 → 1.10.0

package/src/OxyServices.base.ts

@@ -212,10 +212,12 @@ export class OxyServicesBase {
   }
 
   /**
-   * Clear stored authentication tokens
+   * Clear stored authentication tokens and end the local session: a re-mint
+   * already in flight plants nothing, and no new one runs until a token is set
+   * again (see `HttpService.endSession`).
    */
   public clearTokens(): void {
-    this.httpService.clearTokens();
+    this.httpService.endSession();
     this._cachedUserId = undefined;
     this._cachedAccessToken = null;
   }

package/src/__tests__/httpServiceFormEncoded.test.ts

@@ -46,8 +46,8 @@ describe('HttpService form-urlencoded bodies', () => {
   });
 
   /**
-   * POST a form body and return the token-endpoint call. Selected by URL
-   * because an unauthenticated write is preceded by a `GET /csrf-token`.
+   * POST a form body and return the token-endpoint call. Selected by URL so
+   * any preflight a future change adds cannot shift the call under test.
    */
   async function postForm(body: URLSearchParams): Promise<FetchCall> {
     const calls: FetchCall[] = [];
@@ -111,9 +111,6 @@ describe('HttpService form-urlencoded bodies', () => {
   it('prefers OAuth error_description over the bare error code', async () => {
     globalThis.fetch = async (input) => {
       const url = String(input);
-      if (url.endsWith('/csrf-token')) {
-        return jsonResponse({ csrfToken: 'csrf-test' });
-      }
       return new Response(
         JSON.stringify({
           error: 'invalid_grant',

package/src/__tests__/{httpServiceCsrf.test.ts → httpServiceWrites.test.ts}

@@ -31,7 +31,12 @@ function readHeaders(init: RequestInit | undefined): Record<string, string> {
   return headers as Record<string, string>;
 }
 
-describe('HttpService CSRF behavior', () => {
+/**
+ * Writes carry exactly one credential: the bearer, when there is one. Oxy's API
+ * has no CSRF layer (issue #1044) and the SDK neither fetches `/csrf-token` nor
+ * sends `X-CSRF-Token` / `X-Native-App`, for its own API or a linked one.
+ */
+describe('HttpService writes', () => {
   const originalFetch = globalThis.fetch;
 
   afterEach(() => {
@@ -39,13 +44,18 @@ describe('HttpService CSRF behavior', () => {
     jest.restoreAllMocks();
   });
 
-  it('does not fetch csrf-token before bearer-authenticated writes', async () => {
+  function recordFetches(respond: (url: string) => Response = () => jsonResponse({ ok: true })): FetchCall[] {
     const calls: FetchCall[] = [];
     globalThis.fetch = async (input, init) => {
       const url = String(input);
       calls.push({ url, init });
-      return jsonResponse({ ok: true });
+      return respond(url);
     };
+    return calls;
+  }
+
+  it('sends a bearer-authenticated write as a single request', async () => {
+    const calls = recordFetches();
 
     const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
     const accessToken = createJwt({
@@ -56,20 +66,31 @@ describe('HttpService CSRF behavior', () => {
 
     await http.post('/posts', { text: 'hello' });
 
-    expect(calls).toHaveLength(1);
-    expect(calls[0].url).toBe('https://api.mention.earth/posts');
+    expect(calls.map((call) => call.url)).toEqual(['https://api.mention.earth/posts']);
     const headers = readHeaders(calls[0].init);
     expect(headers.Authorization).toBe(`Bearer ${accessToken}`);
     expect(headers['X-CSRF-Token']).toBeUndefined();
+    expect(headers['X-Native-App']).toBeUndefined();
+  });
+
+  it('sends a write without a bearer as a single request with no CSRF preflight', async () => {
+    const calls = recordFetches();
+
+    const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
+
+    await http.post('/users/by-ids', { ids: ['user_1'] });
+
+    // POSITIVE CONTROL: the write itself went out, so the absence below is not
+    // the absence of any request at all.
+    expect(calls.map((call) => call.url)).toEqual(['https://api.oxy.so/users/by-ids']);
+    const headers = readHeaders(calls[0].init);
+    expect(headers.Authorization).toBeUndefined();
+    expect(headers['X-CSRF-Token']).toBeUndefined();
+    expect(headers['X-Native-App']).toBeUndefined();
   });
 
   it('keeps a valid near-expiry bearer token when preflight refresh cannot refresh', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      const url = String(input);
-      calls.push({ url, init });
-      return jsonResponse({ ok: true });
-    };
+    const calls = recordFetches();
 
     const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
     const accessToken = createJwt({
@@ -86,26 +107,12 @@ describe('HttpService CSRF behavior', () => {
     await http.post('/posts', { text: 'hello' });
 
     expect(refreshAttempts).toBe(1);
-    expect(calls).toHaveLength(1);
-    expect(calls[0].url).toBe('https://api.mention.earth/posts');
-    const headers = readHeaders(calls[0].init);
-    expect(headers.Authorization).toBe(`Bearer ${accessToken}`);
-    expect(headers['X-CSRF-Token']).toBeUndefined();
+    expect(calls.map((call) => call.url)).toEqual(['https://api.mention.earth/posts']);
+    expect(readHeaders(calls[0].init).Authorization).toBe(`Bearer ${accessToken}`);
   });
 
   it('does not use an expired bearer token when preflight refresh cannot refresh', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      const url = String(input);
-      calls.push({ url, init });
-      if (url.endsWith('/csrf-token')) {
-        return new Response(JSON.stringify({ csrfToken: 'csrf_1' }), {
-          status: 200,
-          headers: { 'content-type': 'application/json' },
-        });
-      }
-      return jsonResponse({ ok: true });
-    };
+    const calls = recordFetches();
 
     const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
     const accessToken = createJwt({
@@ -122,48 +129,28 @@ describe('HttpService CSRF behavior', () => {
     await http.post('/posts', { text: 'hello' });
 
     expect(refreshAttempts).toBe(1);
-    expect(calls.map((call) => call.url)).toEqual([
-      'https://api.mention.earth/csrf-token',
-      'https://api.mention.earth/posts',
-    ]);
-    const headers = readHeaders(calls[1].init);
-    expect(headers.Authorization).toBeUndefined();
-    expect(headers['X-CSRF-Token']).toBe('csrf_1');
+    expect(calls.map((call) => call.url)).toEqual(['https://api.mention.earth/posts']);
+    expect(readHeaders(calls[0].init).Authorization).toBeUndefined();
   });
 
-  it('still fetches csrf-token for cookie-authenticated writes without bearer', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      const url = String(input);
-      calls.push({ url, init });
-      if (url.endsWith('/csrf-token')) {
-        return new Response(JSON.stringify({ csrfToken: 'csrf_1' }), {
-          status: 200,
+  it('does not retry a 403, whatever its code says', async () => {
+    const calls = recordFetches(
+      () =>
+        new Response(JSON.stringify({ code: 'CSRF_TOKEN_INVALID' }), {
+          status: 403,
+          statusText: 'Forbidden',
           headers: { 'content-type': 'application/json' },
-        });
-      }
-      return jsonResponse({ ok: true });
-    };
+        }),
+    );
 
     const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
 
-    await http.post('/posts', { text: 'hello' });
-
-    expect(calls.map((call) => call.url)).toEqual([
-      'https://api.mention.earth/csrf-token',
-      'https://api.mention.earth/posts',
-    ]);
-    const headers = readHeaders(calls[1].init);
-    expect(headers.Authorization).toBeUndefined();
-    expect(headers['X-CSRF-Token']).toBe('csrf_1');
+    await expect(http.post('/posts', { text: 'hello' })).rejects.toBeDefined();
+    expect(calls.map((call) => call.url)).toEqual(['https://api.mention.earth/posts']);
   });
 
   it('includes credentials for configured API origin requests', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      calls.push({ url: String(input), init });
-      return jsonResponse({ ok: true });
-    };
+    const calls = recordFetches();
 
     const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
 
@@ -175,11 +162,7 @@ describe('HttpService CSRF behavior', () => {
   });
 
   it('omits credentials for caller-supplied absolute URLs outside the configured API origin', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      calls.push({ url: String(input), init });
-      return jsonResponse({ ok: true });
-    };
+    const calls = recordFetches();
 
     const http = new HttpService({ baseURL: 'https://api.oxy.so', enableRetry: false });
 
@@ -189,47 +172,4 @@ describe('HttpService CSRF behavior', () => {
     expect(calls[0].url).toBe('https://attacker.oxy.so/collect');
     expect(calls[0].init?.credentials).toBe('omit');
   });
-
-  it('bypasses request deduplication for the internal CSRF retry', async () => {
-    const calls: FetchCall[] = [];
-    let csrfFetches = 0;
-    let postFetches = 0;
-
-    globalThis.fetch = async (input, init) => {
-      const url = String(input);
-      calls.push({ url, init });
-
-      if (url.endsWith('/csrf-token')) {
-        csrfFetches += 1;
-        return new Response(JSON.stringify({ csrfToken: `csrf_${csrfFetches}` }), {
-          status: 200,
-          headers: { 'content-type': 'application/json' },
-        });
-      }
-
-      postFetches += 1;
-      if (postFetches === 1) {
-        return new Response(JSON.stringify({ code: 'CSRF_TOKEN_INVALID' }), {
-          status: 403,
-          statusText: 'Forbidden',
-          headers: { 'content-type': 'application/json' },
-        });
-      }
-
-      return jsonResponse({ ok: true });
-    };
-
-    const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
-
-    await expect(http.post('/posts', { text: 'hello' })).resolves.toEqual({ ok: true });
-    expect(calls.map((call) => call.url)).toEqual([
-      'https://api.mention.earth/csrf-token',
-      'https://api.mention.earth/posts',
-      'https://api.mention.earth/csrf-token',
-      'https://api.mention.earth/posts',
-    ]);
-
-    expect(readHeaders(calls[1].init)['X-CSRF-Token']).toBe('csrf_1');
-    expect(readHeaders(calls[3].init)['X-CSRF-Token']).toBe('csrf_2');
-  });
 });

package/src/__tests__/inSessionRefresh.test.ts

@@ -233,6 +233,59 @@ describe('HttpService in-session refresh handler', () => {
   });
 });
 
+describe('HttpService.endSession — a sign-out outranks a refresh', () => {
+  it('plants nothing when the session ends while a re-mint is in flight', async () => {
+    const oldToken = createJwt({ userId: 'u', exp: farFutureExp(), jti: 'old' });
+    const lateToken = createJwt({ userId: 'u', exp: farFutureExp(), jti: 'late' });
+    const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
+    http.setTokens(oldToken);
+
+    let finish!: (token: string | null) => void;
+    http.setAuthRefreshHandler(
+      () =>
+        new Promise((resolve) => {
+          finish = resolve;
+        }),
+    );
+    const seen: Array<string | null> = [];
+    http.addTokenChangeListener((token) => seen.push(token));
+
+    const pending = http.refreshAccessToken('preflight');
+    http.endSession();
+    finish(lateToken);
+
+    await expect(pending).resolves.toBeNull();
+    expect(http.getAccessToken()).toBeNull();
+    expect(seen).toEqual([null]);
+  });
+
+  it('abandons only what was in flight: a later re-mint (another tab signed in) still runs', async () => {
+    const http = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
+    const fresh = createJwt({ userId: 'u', exp: farFutureExp(), jti: 'fresh' });
+    const handler = jest.fn(async () => fresh);
+    http.setAuthRefreshHandler(handler);
+
+    http.endSession();
+    expect(http.hasSessionEnded()).toBe(true);
+    await expect(http.refreshAccessToken('preflight')).resolves.toBe(fresh);
+    expect(http.getAccessToken()).toBe(fresh);
+    expect(http.hasSessionEnded()).toBe(false);
+  });
+
+  it('is what OxyServices.clearTokens does; a plain HttpService.clearTokens (a mirror) is not', () => {
+    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+    const before = oxy.httpService.getSessionEpoch();
+    oxy.clearTokens();
+    expect(oxy.httpService.getSessionEpoch()).toBe(before + 1);
+    expect(oxy.httpService.hasSessionEnded()).toBe(true);
+
+    const mirror = new HttpService({ baseURL: 'https://api.mention.earth', enableRetry: false });
+    mirror.clearTokens();
+    expect(mirror.getSessionEpoch()).toBe(0);
+    expect(mirror.hasSessionEnded()).toBe(false);
+  });
+});
+
 describe('OxyServices.getAccessTokenExpiry', () => {
   it('returns the JWT exp (seconds) of the current access token', () => {
     const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });

package/src/__tests__/linkedClient.test.ts

@@ -208,13 +208,6 @@ describe('OxyServices.createLinkedClient', () => {
       const url = String(input);
       calls.push({ url, init });
 
-      if (url.endsWith('/csrf-token')) {
-        return new Response(JSON.stringify({ csrfToken: 'csrf_1' }), {
-          status: 200,
-          headers: { 'content-type': 'application/json' },
-        });
-      }
-
       if (url.endsWith('/api/queue/current')) {
         queueWriteAttempts += 1;
         if (queueWriteAttempts === 1) {

package/src/__tests__/nearExpiryMintStorm.test.ts

@@ -0,0 +1,165 @@
+/**
+ * The near-expiry mint storm that signed a busy app out (OxyHQ/Mention#1140).
+ *
+ * What the server does: `POST /session/device/token` answers with the session's
+ * STORED access token for as long as that token has not expired, and mints a
+ * new one only once it is past `exp`. The mint is budgeted at 30/min per device.
+ *
+ * What the client did with that: the scheduler and the request-time preflight
+ * both re-mint 60s before `exp`. The server handed the same token back, which
+ * counted as a success (no cooldown), so the scheduler re-armed at its 1s floor
+ * and every request re-ran the preflight: ~30 mints in the token's last minute,
+ * then a 429, whose 60s cooldown straddled the real expiry. The next request
+ * carried no bearer, drew a 401, found the refresh cooling down, and the
+ * HttpService cleared the token — which the provider reads as a sign-out.
+ *
+ * Production logs for the device showed exactly this: a burst of ~30 mints at
+ * ~1.4s intervals every ~16 minutes, a single mint ~78s later (the scheduler's
+ * 5+10+20+40s backoff through the 60s rate-limit cooldown), and a sign-out on
+ * the one cycle where the app was in active use across the expiry.
+ *
+ * This suite simulates that server against the real HttpService, refresh
+ * scheduler and 401 lane.
+ */
+import { OxyServices } from '../OxyServices';
+import { startTokenRefreshScheduler } from '../session/refresh';
+
+const TOKEN_TTL_SECONDS = 15 * 60;
+const MINT_BUDGET_PER_MINUTE = 30;
+
+function createJwt(payload: Record<string, unknown>): string {
+  const encode = (value: unknown): string => Buffer.from(JSON.stringify(value)).toString('base64url');
+  return `${encode({ alg: 'HS256', typ: 'JWT' })}.${encode(payload)}.signature`;
+}
+
+function expOf(token: string): number {
+  const [, payload] = token.split('.');
+  return (JSON.parse(Buffer.from(payload, 'base64url').toString()) as { exp: number }).exp;
+}
+
+/**
+ * The device mint as the server implements it, including its rate limiter.
+ *
+ * `rotateWithinSeconds` is how close to `exp` the stored token may be before the
+ * server rotates instead of handing it back: `0` is the server as it was (it
+ * rotated only a token already past `exp`), a positive value is the fixed one.
+ */
+function createMintServer(rotateWithinSeconds: number): {
+  mint: () => { status: 200; token: string } | { status: 429 };
+  storedToken: () => string;
+  mints: number[];
+  rateLimited: number;
+} {
+  let serial = 0;
+  const issue = (): string => {
+    serial += 1;
+    return createJwt({ userId: 'u', jti: `t${serial}`, exp: Math.floor(Date.now() / 1000) + TOKEN_TTL_SECONDS });
+  };
+  let stored = issue();
+  const mints: number[] = [];
+  const state = { rateLimited: 0 };
+  return {
+    mint: () => {
+      const now = Date.now();
+      if (mints.filter((at) => now - at < 60_000).length >= MINT_BUDGET_PER_MINUTE) {
+        state.rateLimited += 1;
+        return { status: 429 };
+      }
+      mints.push(now);
+      // `getAccessToken`: hand back the stored token unless it has expired.
+      if (expOf(stored) - Math.floor(now / 1000) < (rotateWithinSeconds > 0 ? rotateWithinSeconds : 0)) {
+        stored = issue();
+      }
+      return { status: 200, token: stored };
+    },
+    storedToken: () => stored,
+    mints,
+    get rateLimited() {
+      return state.rateLimited;
+    },
+  };
+}
+
+describe('a busy app across an access token expiry', () => {
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    jest.useRealTimers();
+  });
+
+  async function runBusyApp(rotateWithinSeconds: number): Promise<{
+    tokenEvents: Array<string | null>;
+    finalToken: string | null;
+    server: ReturnType<typeof createMintServer>;
+  }> {
+    jest.useFakeTimers({ now: new Date('2026-09-25T13:48:00Z') });
+    const server = createMintServer(rotateWithinSeconds);
+
+    // The app's own API: 401 without a live bearer, as any resource server does.
+    globalThis.fetch = (async (_input: unknown, init?: RequestInit) => {
+      const headers = (init?.headers ?? {}) as Record<string, string>;
+      const bearer = headers.Authorization ?? headers.authorization;
+      const token = bearer?.startsWith('Bearer ') ? bearer.slice(7) : null;
+      if (!token || expOf(token) <= Math.floor(Date.now() / 1000)) {
+        return new Response(JSON.stringify({ error: 'Unauthorized' }), {
+          status: 401,
+          headers: { 'content-type': 'application/json' },
+        });
+      }
+      return new Response(JSON.stringify({ data: { ok: true } }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      });
+    }) as typeof fetch;
+
+    const oxy = new OxyServices({ baseURL: 'https://api.mention.earth', enableCache: false, enableRetry: false });
+    oxy.setTokens(server.storedToken());
+    oxy.httpService.setAuthRefreshHandler(async (reason) => {
+      const answer = server.mint();
+      if (answer.status === 429) {
+        // What `refreshDeviceSecretArm` does with a 429.
+        oxy.httpService.noteRefreshRateLimited();
+        return null;
+      }
+      oxy.setTokens(answer.token);
+      return answer.token;
+    });
+
+    const tokenEvents: Array<string | null> = [];
+    oxy.onTokensChanged((token) => tokenEvents.push(token));
+    const scheduler = startTokenRefreshScheduler(oxy);
+
+    // Twenty minutes of an app in use: a request every 700ms, straight across
+    // the first token's expiry at 14:03:00.
+    for (let elapsed = 0; elapsed < 20 * 60_000; elapsed += 700) {
+      await oxy.httpService.get('/feed').catch(() => undefined);
+      await jest.advanceTimersByTimeAsync(700);
+    }
+    scheduler.dispose();
+    return { tokenEvents, finalToken: oxy.getAccessToken(), server };
+  }
+
+  it('against the server that hands back an unexpired token: never cleared, never rate limited', async () => {
+    const { tokenEvents, finalToken, server } = await runBusyApp(0);
+
+    // Before the fix: ~30 mints of the same token, a 429, then the token was
+    // cleared (a run of `null` events) and the app was signed out.
+    expect(tokenEvents).not.toContain(null);
+    expect(finalToken).not.toBeNull();
+    expect(server.rateLimited).toBe(0);
+    // One rotation. The server still hands the expired token back for the
+    // second it expires in (it compares `exp < now`), which costs a few mints in
+    // that one second — nowhere near the budget.
+    expect(server.mints.length).toBeLessThan(MINT_BUDGET_PER_MINUTE / 3);
+  });
+
+  it('against the server that rotates a token near expiry: one mint per rotation', async () => {
+    const { tokenEvents, finalToken, server } = await runBusyApp(120);
+
+    expect(tokenEvents).not.toContain(null);
+    expect(finalToken).not.toBeNull();
+    expect(server.rateLimited).toBe(0);
+    expect(server.mints).toHaveLength(1);
+  });
+});

package/src/boot/__tests__/sessionColdBoot.identity.test.ts

@@ -104,7 +104,7 @@ function makeOxy(overrides: OxyOverrides = {}): { oxy: OxyServices; setTokens: j
       overrides.requestChallenge
       ?? (async () => ({ challenge: 'chal-1', expiresAt: '2030-01-01T00:00:00.000Z' })),
     verifyChallenge: overrides.verifyChallenge ?? (async () => IDENTITY_SESSION),
-    httpService: { runSingleFlightDeviceSecretMint: makeMintSingleFlight() },
+    httpService: { runSingleFlightDeviceSecretMint: makeMintSingleFlight(), getSessionEpoch: () => 0 },
   } as unknown as OxyServices;
   return { oxy, setTokens };
 }

package/src/boot/__tests__/sessionColdBoot.sharedDevice.test.ts

@@ -79,7 +79,7 @@ function makeOxy(overrides: {
     setTokens,
     mintFromDeviceSecret,
     signInWithSharedIdentity,
-    httpService: { runSingleFlightDeviceSecretMint: makeMintSingleFlight() },
+    httpService: { runSingleFlightDeviceSecretMint: makeMintSingleFlight(), getSessionEpoch: () => 0 },
   } as unknown as OxyServices;
   return { oxy, setTokens, mintFromDeviceSecret, signInWithSharedIdentity };
 }

package/src/boot/__tests__/sessionColdBoot.test.ts

@@ -45,7 +45,7 @@ function makeOxy(overrides: OxyOverrides = {}): { oxy: OxyServices; setTokens: j
         throw new Error('mintFromDeviceSecret not stubbed');
       }),
     // The device-secret-mint step runs through the client's single-flight.
-    httpService: { runSingleFlightDeviceSecretMint: makeMintSingleFlight() },
+    httpService: { runSingleFlightDeviceSecretMint: makeMintSingleFlight(), getSessionEpoch: () => 0 },
   } as unknown as OxyServices;
   return { oxy, setTokens };
 }

package/src/boot/sessionColdBoot.ts

@@ -326,6 +326,9 @@ export async function runSessionColdBoot(
             { component: 'sessionColdBoot', method: 'device-secret-mint' },
           );
           return { kind: 'skip' };
+        case 'session-ended':
+          // Signed out while the boot was minting; the arm planted nothing.
+          return { kind: 'skip' };
         case 'no-secret':
           return { kind: 'skip' };
       }

package/src/mixins/OxyServices.user.ts

@@ -470,10 +470,7 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
      *   `PostHydrationService`) and is unchanged.
      * - **Plain client (browser / React Native with a user session):** when no
      *   service credentials are configured, the chunk is fetched via
-     *   `makeRequest`, which attaches the configured user bearer. oxy-api's CSRF
-     *   middleware skips bearer-authenticated writes, and `makeRequest` only
-     *   fetches a CSRF token for cookie-only (no-bearer) state-changing requests,
-     *   so the user-bearer POST is sent without CSRF and succeeds. Previously
+     *   `makeRequest`, which attaches the configured user bearer. Previously
      *   this method always used the service path, so every client-side caller
      *   silently received `[]` because `getServiceToken()` had no credentials.
      *
@@ -504,7 +501,7 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
 
       // A backend that called configureServiceAuth() uses the bearer-service
       // path; any other caller (browser / RN with a user session) uses the
-      // user-bearer path. See the method doc for why the user path is CSRF-safe.
+      // user-bearer path.
       const useServiceAuth = Boolean(this._serviceApiKey && this._serviceApiSecret);
 
       // Run chunks concurrently; a single chunk failure must not sink the rest.

package/src/mixins/__tests__/backgroundCredential.httpIntegration.test.ts

@@ -22,11 +22,9 @@ import { OxyServices } from '../../OxyServices';
  *     hand-built `Object.assign(new Error(), { status: 404 })` proves only that
  *     the branch reads the shape the test itself invented.
  *
- * The stub is URL-aware because a state-changing request through the real stack
- * fetches `GET /csrf-token` FIRST. A blanket stub answers that call too, which
- * both shifts the request under test out of `calls[0]` and (on a non-200 stub)
- * makes the CSRF fetch burn its own retries — so a naive call-count assertion
- * measures CSRF attempts rather than the route.
+ * Assertions select calls by URL rather than position, so a preflight added
+ * to the real stack later cannot make a call-count assertion measure it
+ * instead of the route.
  */
 const ROUTE = '/session/device/background-credential';
 
@@ -67,19 +65,16 @@ const ACCESS_TOKEN = (() => {
 describe('provisionBackgroundCredential over a real HttpService', () => {
   const originalFetch = global.fetch;
 
-  /** Answers the CSRF preflight properly; answers the route under test with `body`/`status`. */
+  /** Answers every call with `body`/`status`. */
   const stubFetch = (body: unknown, status: number) => {
     const fetchMock = jest.fn(async (input: unknown) => {
-      if (String(input).includes('/csrf-token')) {
-        return jsonResponse({ csrfToken: 'csrf-test-token' }, 200);
-      }
       return jsonResponse(body, status);
     });
     global.fetch = fetchMock as unknown as typeof fetch;
     return fetchMock;
   };
 
-  /** Every stubbed call whose URL is the route under test (i.e. not the CSRF preflight). */
+  /** Every stubbed call whose URL is the route under test. */
   const routeCalls = (fetchMock: jest.Mock) =>
     fetchMock.mock.calls.filter(([input]) => String(input).includes(ROUTE));
 

package/src/mixins/__tests__/discoveryErrorHandling.test.ts

@@ -27,7 +27,7 @@ function jsonResponse(data: unknown): Response {
  * Build a non-verified JWT whose payload decodes to the given claims.
  * `jwtDecode` only base64url-decodes the middle segment (no signature check).
  * Used to put the SDK in an authenticated state so a state-changing POST
- * carries a bearer header and skips the CSRF-token pre-fetch.
+ * carries a bearer header.
  */
 function makeJwt(payload: Record<string, unknown>): string {
   const b64url = (obj: Record<string, unknown>): string =>
@@ -142,9 +142,8 @@ describe('discovery error handling', () => {
    * `POST /profiles/recommendations` with the validated request body.
    */
   describe('getProfileRecommendations routing (GET vs POST)', () => {
-    // Authenticate so the state-changing POST carries a bearer header and the
-    // SDK skips the CSRF-token pre-fetch (which would otherwise consume a mock).
-    // A bearer token does not affect GET routing or the request body, so the
+    // Authenticate so the state-changing POST carries a bearer header. A bearer
+    // token does not affect GET routing or the request body, so the
     // GET-path assertions below are unaffected.
     beforeEach(() => {
       oxy.httpService.setTokens(makeJwt({ userId: 'me' }));

package/src/mixins/__tests__/topics.test.ts

@@ -24,8 +24,7 @@ function rawResponse(body: unknown): Response {
 
 /**
  * A non-verified JWT whose payload decodes to the given claims. Puts the SDK in
- * an authenticated state so the `POST /topics/resolve` carries a bearer header
- * and skips the CSRF-token pre-fetch (which would otherwise consume a mock).
+ * an authenticated state so the `POST /topics/resolve` carries a bearer header.
  */
 function makeJwt(payload: Record<string, unknown>): string {
   const b64url = (obj: Record<string, unknown>): string =>
@@ -59,7 +58,7 @@ describe('topics mixin envelope unwrapping', () => {
     fetchMock = jest.fn();
     globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
     oxy = new OxyServices({ baseURL: 'http://test.invalid', enableRetry: false });
-    // Authenticate so the resolve POST skips the CSRF pre-fetch. Harmless for GETs.
+    // Authenticate so the resolve POST carries a bearer. Harmless for GETs.
     oxy.httpService.setTokens(makeJwt({ userId: 'me' }));
   });
 

package/src/server/cors.ts

@@ -40,7 +40,6 @@ const DEFAULT_ALLOWED_HEADERS = [
   'X-Requested-With',
   'X-Oxy-User-Id',
   'X-Oxy-Internal',
-  'X-CSRF-Token',
   'X-Oxy-Edge-Region',
   'X-Oxy-Activity-Id',
 ];