@oxy.so/core 1.9.1 → 1.11.0

package/dist/esm/HttpService.js

@@ -17,18 +17,12 @@ import { RequestDeduplicator, RequestQueue, SimpleLogger } from './utils/request
 import { retryAsync } from './utils/asyncUtils.js';
 import { createCancelledError, ErrorCodes, handleHttpError, parseHttpErrorBody } from './utils/errorUtils.js';
 import { jwtDecode } from 'jwt-decode';
-import { isNative, getPlatformOS } from './utils/platform.js';
 import { isReactNative } from '@oxy.so/protocol';
 import { computeIdentityTag, fnv1a32 } from './utils/cacheKey.js';
 import { redactUrlQuery } from './utils/redactUrl.js';
 import { OxyAuthenticationError } from './OxyServices.errors.js';
 import { getBrowserEdgeRegionHeader } from './utils/edgeRegion.js';
 import { getBrowserActivityIdHeader } from './utils/activityId.js';
-/**
- * Check if we're running in a native app environment (React Native, not web)
- * This is used to determine CSRF handling mode
- */
-const isNativeApp = isNative();
 /**
  * Default per-request timeout (ms) when neither the call site nor
  * {@link OxyConfig.requestTimeout} overrides it. Kept tight so a stalled
@@ -36,24 +30,6 @@ const isNativeApp = isNative();
  * request queue.
  */
 const DEFAULT_REQUEST_TIMEOUT_MS = 5000;
-/**
- * Timeout (ms) for the dedicated `GET /csrf-token` fetch. Independent of the
- * regular request timeout: this is a small, fast, unauthenticated call and
- * should never inherit a longer per-request budget.
- */
-const CSRF_FETCH_TIMEOUT_MS = 5000;
-/**
- * Number of attempts for fetching a CSRF token before giving up. The first
- * failure is usually a cold edge/cookie race; a single retry recovers it
- * without masking a genuinely broken `/csrf-token` route.
- */
-const CSRF_FETCH_MAX_ATTEMPTS = 2;
-/**
- * Backoff (ms) between CSRF-token fetch attempts. Short by design — a CSRF
- * fetch sits in the critical path of a state-changing request, so the retry
- * must add minimal latency.
- */
-const CSRF_FETCH_RETRY_DELAY_MS = 500;
 /**
  * Cooldown (ms) applied after a failed access-token refresh before another
  * refresh is attempted while the CURRENT token is still valid (a proactive,
@@ -156,8 +132,6 @@ const CACHE_SIZE_WARNING_THROTTLE_MS = 60000;
 class TokenStore {
     constructor() {
         this.accessToken = null;
-        this.csrfToken = null;
-        this.csrfTokenFetchPromise = null;
     }
     setTokens(accessToken) {
         this.accessToken = accessToken;
@@ -171,22 +145,6 @@ class TokenStore {
     hasAccessToken() {
         return !!this.accessToken;
     }
-    setCsrfToken(token) {
-        this.csrfToken = token;
-    }
-    getCsrfToken() {
-        return this.csrfToken;
-    }
-    setCsrfTokenFetchPromise(promise) {
-        this.csrfTokenFetchPromise = promise;
-    }
-    getCsrfTokenFetchPromise() {
-        return this.csrfTokenFetchPromise;
-    }
-    clearCsrfToken() {
-        this.csrfToken = null;
-        this.csrfTokenFetchPromise = null;
-    }
 }
 /**
  * Propagate `parent`'s abort to `child`, returning a disposer.
@@ -276,6 +234,21 @@ export class HttpService {
         this.authRefreshHandler = null;
         this.accessTokenProvider = null;
         this.deviceSecretMintInFlight = null;
+        /**
+         * Bumped by every {@link endSession}. A re-mint captures it before its first
+         * await and plants nothing if it moved: a refresh that was already in flight
+         * when the user signed out would otherwise complete a moment later and put a
+         * bearer — and through the token listeners, the account — back.
+         */
+        this.sessionEpoch = 0;
+        /**
+         * Set by {@link endSession}, cleared by the next {@link setTokens}. Read by the
+         * native shared-keychain re-mint arm: after a sign-out a 401 is the expected
+         * answer, not a cue to sign back in with the identity key. The device-secret
+         * arm is NOT gated on it — minting from a credential the store still holds is
+         * how a signed-out tab joins a sign-in made in another tab.
+         */
+        this.sessionEnded = false;
         /**
          * Epoch (ms) before which a cache-size telemetry warning must not be
          * re-emitted. Throttles the {@link CACHE_SOFT_MAX_ENTRIES} warning to at most
@@ -429,14 +402,9 @@ export class HttpService {
         // it before enqueue means auth-blocked requests hold NO slot while the shared
         // mint runs. `skipAuth` requests (the body-authenticated mint) send NO bearer
         // and skip the near-expiry preflight — see RequestOptions.skipAuth. The
-        // 401/CSRF retry re-enters request() with a fresh config, so it re-resolves
-        // these here with the refreshed token / cleared CSRF.
-        const isStateChangingMethod = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method);
+        // 401 retry re-enters request() with a fresh config, so it re-resolves
+        // this here with the refreshed token.
         const authHeader = config.skipAuth ? null : await this.getAuthHeader();
-        // CSRF protects cookie-authenticated browser writes. Bearer-authenticated SDK
-        // clients are not vulnerable to ambient-cookie CSRF, and linked app APIs
-        // should not need to implement a duplicate `/csrf-token` route.
-        const csrfToken = isStateChangingMethod && !authHeader ? await this.fetchCsrfToken() : null;
         const edgeRegionHeader = await getBrowserEdgeRegionHeader();
         const activityIdHeader = getBrowserActivityIdHeader();
         // A request the caller has ALREADY abandoned takes no queue slot and makes
@@ -507,29 +475,6 @@ export class HttpService {
                 if (authHeader) {
                     headers['Authorization'] = authHeader;
                 }
-                // Add CSRF token header for state-changing requests
-                if (csrfToken) {
-                    headers['X-CSRF-Token'] = csrfToken;
-                }
-                // Add native app header for React Native (required for CSRF validation)
-                // Native apps can't persist cookies like browsers, so the server uses
-                // header-only CSRF validation when this header is present
-                if (isNativeApp && isStateChangingMethod) {
-                    headers['X-Native-App'] = 'true';
-                }
-                // Debug logging for CSRF issues, routed through SimpleLogger so it only
-                // fires when consumers opt in via `enableLogging`.
-                if (isStateChangingMethod) {
-                    this.logger.debug('CSRF Debug:', {
-                        url,
-                        method,
-                        isNativeApp,
-                        platformOS: getPlatformOS(),
-                        hasCsrfToken: !!csrfToken,
-                        csrfTokenLength: csrfToken?.length,
-                        hasNativeAppHeader: headers['X-Native-App'] === 'true',
-                    });
-                }
                 // Merge custom headers if provided
                 if (config.headers) {
                     Object.entries(config.headers).forEach(([key, value]) => {
@@ -581,34 +526,19 @@ export class HttpService {
                     if (response.status === 401 && !config._isAuthRetry && !config.skipAuth) {
                         const refreshed = await this.refreshAccessToken('response-401');
                         if (refreshed) {
-                            // `deduplicate: false` is REQUIRED on the retry (mirrors the 403
-                            // CSRF retry below). This re-issue runs while the ORIGINAL request
-                            // is still in-flight under its dedupe key; the refreshed token is
+                            // `deduplicate: false` is REQUIRED on the retry. This re-issue runs
+                            // while the ORIGINAL request is still in-flight under its dedupe
+                            // key; the refreshed token is
                             // for the SAME user, so the identity-scoped key is UNCHANGED — a
                             // deduplicated retry would resolve to the still-pending original
                             // and await itself (deadlock). Opting the retry out of dedupe makes
                             // it a fresh request.
                             return this.request({ ...config, _isAuthRetry: true, retry: false, deduplicate: false });
                         }
-                        // Refresh failed or no token — clear tokens and stale CSRF
+                        // Refresh failed or no token — clear tokens
                         this.tokenStore.clearTokens();
-                        this.tokenStore.clearCsrfToken();
                         this.notifyTokenChange();
                     }
-                    // On 403 with CSRF error, clear cached token and retry once
-                    if (response.status === 403 && !config._isCsrfRetry) {
-                        try {
-                            const clonedResponse = response.clone();
-                            const errBody = await clonedResponse.json();
-                            if (errBody?.code === 'CSRF_TOKEN_INVALID' || errBody?.code === 'CSRF_TOKEN_MISSING') {
-                                this.tokenStore.clearCsrfToken();
-                                return this.request({ ...config, _isCsrfRetry: true, retry: false, deduplicate: false });
-                            }
-                        }
-                        catch {
-                            // Failed to parse error body — not a CSRF error
-                        }
-                    }
                     // Read the error body (may be absent, non-JSON, empty or malformed).
                     // Anything unreadable leaves `errorBody` undefined and degrades to the
                     // status-based message — an error path that throws its own error is
@@ -982,75 +912,6 @@ export class HttpService {
             return false;
         }
     }
-    /**
-     * Fetch CSRF token from server (with deduplication)
-     * Required for state-changing requests (POST, PUT, PATCH, DELETE)
-     */
-    async fetchCsrfToken() {
-        // Return cached token if available
-        const cachedToken = this.tokenStore.getCsrfToken();
-        if (cachedToken) {
-            this.logger.debug('Using cached CSRF token');
-            return cachedToken;
-        }
-        // Deduplicate concurrent CSRF token fetches
-        const existingPromise = this.tokenStore.getCsrfTokenFetchPromise();
-        if (existingPromise) {
-            this.logger.debug('Waiting for existing CSRF fetch');
-            return existingPromise;
-        }
-        const fetchPromise = (async () => {
-            for (let attempt = 1; attempt <= CSRF_FETCH_MAX_ATTEMPTS; attempt++) {
-                try {
-                    this.logger.debug('Fetching CSRF token from:', `${this.baseURL}/csrf-token`, `(attempt ${attempt})`);
-                    // Use AbortController for timeout (more compatible than AbortSignal.timeout)
-                    const controller = new AbortController();
-                    const timeoutId = setTimeout(() => controller.abort(), CSRF_FETCH_TIMEOUT_MS);
-                    const response = await fetch(`${this.baseURL}/csrf-token`, {
-                        method: 'GET',
-                        headers: { 'Accept': 'application/json' },
-                        credentials: 'include', // Required to receive and send cookies
-                        signal: controller.signal,
-                    });
-                    clearTimeout(timeoutId);
-                    this.logger.debug('CSRF fetch response:', response.status, response.ok);
-                    if (response.ok) {
-                        const data = await response.json();
-                        const token = data.csrfToken || null;
-                        this.logger.debug('CSRF response data:', {
-                            hasCsrfToken: typeof token === 'string' && token.length > 0,
-                            csrfTokenLength: token?.length,
-                        });
-                        this.tokenStore.setCsrfToken(token);
-                        this.logger.debug('CSRF token fetched');
-                        return token;
-                    }
-                    // Also check response header for CSRF token
-                    const headerToken = response.headers.get('X-CSRF-Token');
-                    if (headerToken) {
-                        this.tokenStore.setCsrfToken(headerToken);
-                        this.logger.debug('CSRF token from header');
-                        return headerToken;
-                    }
-                    this.logger.debug('CSRF fetch failed with status:', response.status);
-                    this.logger.warn('Failed to fetch CSRF token:', response.status);
-                }
-                catch (error) {
-                    this.logger.debug('CSRF fetch error:', error);
-                    this.logger.warn('CSRF token fetch error:', error);
-                }
-                // Brief backoff before the next attempt.
-                if (attempt < CSRF_FETCH_MAX_ATTEMPTS) {
-                    await new Promise(resolve => setTimeout(resolve, CSRF_FETCH_RETRY_DELAY_MS));
-                }
-            }
-            return null;
-        })().finally(() => {
-            this.tokenStore.setCsrfTokenFetchPromise(null);
-        });
-        this.tokenStore.setCsrfTokenFetchPromise(fetchPromise);
-        return fetchPromise;
-    }
     /**
      * Get auth header with automatic token refresh
      */
@@ -1112,12 +973,21 @@ export class HttpService {
             // by calling `noteRefreshRateLimited()` from INSIDE this call, so clearing
             // on the way out would discard the flag it just set.
             this.lastRefreshWasRateLimited = false;
+            const epoch = this.sessionEpoch;
             this.tokenRefreshPromise = this.authRefreshHandler(reason)
                 .then((newToken) => {
+                if (epoch !== this.sessionEpoch) {
+                    // The session ended while this re-mint was in flight. Not a failure
+                    // (no cooldown), and nothing to plant.
+                    this.logger.debug('Discarded a token refresh that outlived its session');
+                    return null;
+                }
                 if (!newToken) {
                     this.lastRefreshFailureAt = Date.now();
                     return null;
                 }
+                // A token is planted again, so there is a session again.
+                this.sessionEnded = false;
                 if (this.tokenStore.getAccessToken() !== newToken) {
                     this.tokenStore.setTokens(newToken);
                     this.notifyTokenChange();
@@ -1317,7 +1187,6 @@ export class HttpService {
                     return this.requestAuthenticatedResponseAttempt(config, `Bearer ${refreshed}`, true);
                 }
                 this.tokenStore.clearTokens();
-                this.tokenStore.clearCsrfToken();
                 this.notifyTokenChange();
             }
             const duration = Date.now() - startTime;
@@ -1352,9 +1221,34 @@ export class HttpService {
     }
     // Token management
     setTokens(accessToken) {
+        this.sessionEnded = false;
         this.tokenStore.setTokens(accessToken);
         this.notifyTokenChange();
     }
+    /**
+     * End the local session: clear the bearer and abandon every re-mint already
+     * in flight, so none of them can plant a token after the sign-out.
+     *
+     * {@link clearTokens} alone only drops the bearer, which is right for a
+     * mirror (a linked client following its parent) but not for a sign-out: a
+     * refresh started a moment earlier would finish and plant a new one.
+     */
+    endSession() {
+        this.sessionEpoch += 1;
+        this.sessionEnded = true;
+        this.clearTokens();
+    }
+    /**
+     * The current session epoch — see {@link endSession}. A re-mint lane that
+     * plants tokens itself (the device-secret arm) compares it across its awaits.
+     */
+    getSessionEpoch() {
+        return this.sessionEpoch;
+    }
+    /** Whether {@link endSession} ran and no token has been planted since. */
+    hasSessionEnded() {
+        return this.sessionEnded;
+    }
     setAuthRefreshHandler(handler) {
         this.authRefreshHandler = handler;
     }
@@ -1363,7 +1257,6 @@ export class HttpService {
     }
     clearTokens() {
         this.tokenStore.clearTokens();
-        this.tokenStore.clearCsrfToken();
         // Drop the response cache on logout. The cache is identity-scoped, so a
         // different user could never read these entries, but a logged-out client
         // must not keep the previous session's personalized data resident in
@@ -1479,8 +1372,8 @@ export class HttpService {
     }
     // Test-only utility — clears tokens on this instance
     __resetTokensForTests() {
+        this.sessionEnded = false;
         this.tokenStore.clearTokens();
-        this.tokenStore.clearCsrfToken();
     }
 }
 /**

package/dist/esm/OxyServices.base.js

@@ -165,10 +165,12 @@ export class OxyServicesBase {
         this.httpService.setTokens(accessToken);
     }
     /**
-     * Clear stored authentication tokens
+     * Clear stored authentication tokens and end the local session: a re-mint
+     * already in flight plants nothing, and no new one runs until a token is set
+     * again (see `HttpService.endSession`).
      */
     clearTokens() {
-        this.httpService.clearTokens();
+        this.httpService.endSession();
         this._cachedUserId = undefined;
         this._cachedAccessToken = null;
     }

package/dist/esm/boot/sessionColdBoot.js

@@ -202,6 +202,9 @@ export async function runSessionColdBoot(opts) {
                     // Network / 5xx: keep the secret; a later attempt can succeed.
                     logger.debug('device-secret mint failed (transient) — keeping secret', { component: 'sessionColdBoot', method: 'device-secret-mint' });
                     return { kind: 'skip' };
+                case 'session-ended':
+                    // Signed out while the boot was minting; the arm planted nothing.
+                    return { kind: 'skip' };
                 case 'no-secret':
                     return { kind: 'skip' };
             }

package/dist/esm/crypto/deviceBackup.js

@@ -0,0 +1,70 @@
+/**
+ * The device backup of the self-custody identity: a copy that lives OUTSIDE this
+ * app's own keystore, so a keystore wipe cannot take it along with the keys.
+ *
+ * Why it exists (OxyHQ/oxy#1388): on Android every Oxy app shares the Linux UID
+ * `so.oxy.shared`, and the Android Keystore is per UID. Clearing the storage of
+ * ANY sibling app (`pm clear`, or Settings › Apps › Storage › Clear storage)
+ * wipes the Keystore of the whole UID. Every copy the SDK keeps in
+ * expo-secure-store (primary, backup slot, phrase slot) and in the androidx
+ * encrypted prefs (the cross-app shared slot) is wrapped by a key in that
+ * Keystore, so they all die together, and until now the only way back was the
+ * recovery phrase.
+ *
+ * `@oxy.so/core` never imports a native module, so the store is injected by the
+ * app that owns the identity ({@link KeyManager.setDeviceBackupStore}). Commons
+ * registers Android Block Store; every other app registers nothing, which keeps
+ * every code path below a no-op for them. The design and the threat model are in
+ * `docs/identity/device-backup.md`.
+ */
+/** The record format. Bump {@link DEVICE_BACKUP_VERSION} on a breaking change. */
+export const DEVICE_BACKUP_VERSION = 1;
+export function serializeDeviceBackup(record) {
+    const out = {
+        version: DEVICE_BACKUP_VERSION,
+        privateKey: record.privateKey,
+        publicKey: record.publicKey,
+        updatedAt: record.updatedAt,
+    };
+    if (record.mnemonic) {
+        out.mnemonic = record.mnemonic;
+    }
+    return JSON.stringify(out);
+}
+/**
+ * Parse a stored record, or `null` for anything that is not a well-formed
+ * version-1 record. Checks SHAPE only; the caller still proves the key pair is
+ * healthy (well-formed, public derives from private) before trusting it.
+ */
+export function parseDeviceBackup(raw) {
+    if (!raw) {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object') {
+        return null;
+    }
+    const candidate = parsed;
+    if (candidate.version !== DEVICE_BACKUP_VERSION ||
+        typeof candidate.privateKey !== 'string' ||
+        typeof candidate.publicKey !== 'string' ||
+        typeof candidate.updatedAt !== 'string') {
+        return null;
+    }
+    const record = {
+        version: DEVICE_BACKUP_VERSION,
+        privateKey: candidate.privateKey,
+        publicKey: candidate.publicKey,
+        updatedAt: candidate.updatedAt,
+    };
+    if (typeof candidate.mnemonic === 'string' && candidate.mnemonic.length > 0) {
+        record.mnemonic = candidate.mnemonic;
+    }
+    return record;
+}