@oxy.so/core 1.9.1 → 1.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (44) hide show
  1. package/README.md +4 -4
  2. package/dist/cjs/.tsbuildinfo +1 -1
  3. package/dist/cjs/HttpService.js +56 -163
  4. package/dist/cjs/OxyServices.base.js +4 -2
  5. package/dist/cjs/boot/sessionColdBoot.js +3 -0
  6. package/dist/cjs/mixins/OxyServices.user.js +2 -5
  7. package/dist/cjs/server/cors.js +0 -1
  8. package/dist/cjs/session/refresh.js +32 -2
  9. package/dist/cjs/utils/errorUtils.js +1 -1
  10. package/dist/esm/.tsbuildinfo +1 -1
  11. package/dist/esm/HttpService.js +56 -163
  12. package/dist/esm/OxyServices.base.js +4 -2
  13. package/dist/esm/boot/sessionColdBoot.js +3 -0
  14. package/dist/esm/mixins/OxyServices.user.js +2 -5
  15. package/dist/esm/server/cors.js +0 -1
  16. package/dist/esm/session/refresh.js +32 -2
  17. package/dist/esm/utils/errorUtils.js +1 -1
  18. package/dist/types/.tsbuildinfo +1 -1
  19. package/dist/types/HttpService.d.ts +31 -7
  20. package/dist/types/OxyServices.base.d.ts +3 -1
  21. package/dist/types/mixins/OxyServices.civic.d.ts +11 -1
  22. package/dist/types/mixins/OxyServices.user.d.ts +1 -4
  23. package/dist/types/session/refresh.d.ts +7 -0
  24. package/dist/types/utils/errorUtils.d.ts +1 -1
  25. package/package.json +1 -1
  26. package/src/HttpService.ts +59 -187
  27. package/src/OxyServices.base.ts +4 -2
  28. package/src/__tests__/httpServiceFormEncoded.test.ts +2 -5
  29. package/src/__tests__/{httpServiceCsrf.test.ts → httpServiceWrites.test.ts} +49 -109
  30. package/src/__tests__/inSessionRefresh.test.ts +53 -0
  31. package/src/__tests__/linkedClient.test.ts +0 -7
  32. package/src/boot/__tests__/sessionColdBoot.identity.test.ts +1 -1
  33. package/src/boot/__tests__/sessionColdBoot.sharedDevice.test.ts +1 -1
  34. package/src/boot/__tests__/sessionColdBoot.test.ts +1 -1
  35. package/src/boot/sessionColdBoot.ts +3 -0
  36. package/src/mixins/OxyServices.user.ts +2 -5
  37. package/src/mixins/__tests__/backgroundCredential.httpIntegration.test.ts +5 -10
  38. package/src/mixins/__tests__/discoveryErrorHandling.test.ts +3 -4
  39. package/src/mixins/__tests__/topics.test.ts +2 -3
  40. package/src/server/cors.ts +0 -1
  41. package/src/session/__tests__/refresh.identityPin.test.ts +1 -1
  42. package/src/session/__tests__/refresh.test.ts +115 -2
  43. package/src/session/refresh.ts +38 -2
  44. package/src/utils/errorUtils.ts +1 -1
package/README.md CHANGED
@@ -104,8 +104,8 @@ getNormalizedUserHandle({ username: 'alice', isFederated: true, instance: 'examp
104
104
  ## Linked App API Clients
105
105
 
106
106
  Apps that call their own backend should derive API clients from the active SDK
107
- instance instead of re-implementing auth headers, session restore, CSRF fetches,
108
- or user forwarding.
107
+ instance instead of re-implementing auth headers, session restore or user
108
+ forwarding.
109
109
 
110
110
  ```ts
111
111
  import { OxyServices } from '@oxy.so/core';
@@ -117,8 +117,8 @@ await mentionApi.post('/posts', { content: 'Hello from Oxy' });
117
117
  ```
118
118
 
119
119
  Linked clients send the current Oxy bearer token for authenticated requests.
120
- State-changing bearer requests do not fetch app-local CSRF tokens; cookie-only
121
- writes still use CSRF.
120
+ The SDK never fetches or sends a CSRF token: writes authenticate with the bearer,
121
+ which a browser does not attach to a cross-site request on its own.
122
122
 
123
123
  **GET response caching is OFF by default for linked clients.** The
124
124
  SDK's per-instance GET cache is only safe on the canonical `OxyServices` client,