@oxy.so/services 10.0.0 → 11.1.0

package/plugins/withOxySharedPermissions.js

@@ -0,0 +1,89 @@
+/**
+ * Config plugin: withOxySharedPermissions (EVERY Oxy Android app).
+ *
+ * Oxy Android apps do not share a UID. They share the Oxy identity and the
+ * device session with Commons (and Accounts) through signature-protected
+ * ContentProvider `call()` IPC, the way apps use `AccountManager`. Crossing a UID
+ * needs two `signature`-level permissions:
+ *
+ *  - `so.oxy.permission.IDENTITY` — Commons' identity host
+ *    (`so.oxy.commons[.dev].identity`): public key, challenge proofs, scoped
+ *    derivations. Never the private key.
+ *  - `so.oxy.permission.DEVICE_SESSION` — the device-session hosts
+ *    (`so.oxy.commons[.dev].devicesession`, `so.oxy.accounts[.dev].devicesession`).
+ *
+ * This plugin makes the app both DECLARE and REQUEST both, and adds `<queries>`
+ * for every host authority:
+ *
+ *  - Declared by every app, not only by the hosts: a signature permission is
+ *    granted when the requesting app is installed, if the declaring app is
+ *    already there. With every app declaring it, install order never matters.
+ *    Android accepts the same declaration from several packages signed with one
+ *    certificate, and rejects it from a differently-signed one
+ *    (`INSTALL_FAILED_DUPLICATE_PERMISSION`), which is the protection we want.
+ *    Every declaration must be identical, which is why this ONE plugin owns
+ *    them; the provider plugins do not declare anything.
+ *  - `<queries>`: Android 11+ package visibility hides a provider the app has
+ *    not declared an interest in, and `ContentResolver.call` then silently finds
+ *    nothing.
+ *
+ * `signature` is the whole trust boundary at the manifest level; each provider
+ * also checks the calling package and its certificate itself.
+ */
+const { withAndroidManifest } = require('@expo/config-plugins');
+
+const IDENTITY_PERMISSION = 'so.oxy.permission.IDENTITY';
+const DEVICE_SESSION_PERMISSION = 'so.oxy.permission.DEVICE_SESSION';
+const PERMISSIONS = [IDENTITY_PERMISSION, DEVICE_SESSION_PERMISSION];
+
+/**
+ * Every host authority an Oxy app calls. Keep in step with `COMMONS_AUTHORITIES`
+ * in `OxyIdentityModule.kt` and `HOST_AUTHORITIES` in `OxyDeviceSessionModule.kt`
+ * (a test compares them).
+ */
+const HOST_AUTHORITIES = [
+  'so.oxy.commons.identity',
+  'so.oxy.commons.dev.identity',
+  'so.oxy.commons.devicesession',
+  'so.oxy.commons.dev.devicesession',
+  'so.oxy.accounts.devicesession',
+  'so.oxy.accounts.dev.devicesession',
+];
+
+function withOxySharedPermissions(config) {
+  return withAndroidManifest(config, (modConfig) => {
+    const manifest = modConfig.modResults.manifest;
+
+    manifest.permission = manifest.permission ?? [];
+    manifest['uses-permission'] = manifest['uses-permission'] ?? [];
+    for (const name of PERMISSIONS) {
+      if (!manifest.permission.some((p) => p.$['android:name'] === name)) {
+        manifest.permission.push({
+          $: { 'android:name': name, 'android:protectionLevel': 'signature' },
+        });
+      }
+      if (!manifest['uses-permission'].some((p) => p.$['android:name'] === name)) {
+        manifest['uses-permission'].push({ $: { 'android:name': name } });
+      }
+    }
+
+    manifest.queries = manifest.queries ?? [];
+    if (manifest.queries.length === 0) {
+      manifest.queries.push({});
+    }
+    const queries = manifest.queries[0];
+    queries.provider = queries.provider ?? [];
+    for (const authority of HOST_AUTHORITIES) {
+      if (!queries.provider.some((p) => p.$['android:authorities'] === authority)) {
+        queries.provider.push({ $: { 'android:authorities': authority } });
+      }
+    }
+
+    return modConfig;
+  });
+}
+
+module.exports = withOxySharedPermissions;
+module.exports.IDENTITY_PERMISSION = IDENTITY_PERMISSION;
+module.exports.DEVICE_SESSION_PERMISSION = DEVICE_SESSION_PERMISSION;
+module.exports.HOST_AUTHORITIES = HOST_AUTHORITIES;

package/plugins/withSharedDeviceSessionProvider.js

@@ -1,86 +1,39 @@
 /**
- * Config plugin: withSharedDeviceSessionProvider (UID-member hub apps).
+ * Config plugin: withSharedDeviceSessionProvider (the device-session HOSTS:
+ * Commons and Accounts, prod and dev).
  *
- * The shared DeviceSession credential is how several official Oxy apps end up on
+ * The shared DeviceSession credential is how the official Oxy apps end up on
  * ONE `DeviceSession` — and therefore one globally active account context —
- * WITHOUT any of them reading Commons's private identity key. This plugin wires
- * the Android side of `@oxy.so/services`:
+ * without any of them touching the identity key. Oxy apps do not share a UID,
+ * so the credential lives in the hosts' own storage, and this plugin declares
+ * the provider every other app reads and writes it through:
+ * `OxyDeviceSessionProvider` at `${applicationId}.devicesession` (AGP
+ * substitutes `${applicationId}` at build), guarded by the `signature`-level
+ * `so.oxy.permission.DEVICE_SESSION`.
  *
- *  - Defines a `signature`-level permission
- *    `so.oxy.shared.permission.READ_DEVICE_SESSION`. `signature` means only apps
- *    signed with the SAME certificate (the shared Oxy release keystore) can hold
- *    it — the trust boundary is the signing key, not the deprecated `sharedUserId`.
- *  - Requests that same permission so this app can also read cross-authority.
- *  - Declares `OxyDeviceSessionProvider` at authority
- *    `${applicationId}.devicesession` (AGP substitutes `${applicationId}` at
- *    build), guarded by that permission. The provider is READ-only across the
- *    process boundary: a sibling may join the device session, never overwrite it.
- *  - Adds `<queries>` entries so Android 11+ package-visibility filtering never
- *    hides the sibling providers from the resolver.
+ * It declares NO permission itself: every Oxy app, host or not, declares and
+ * requests both Oxy permissions through `withOxySharedPermissions`, so the
+ * declarations stay identical. Apply that plugin too.
  *
- * WHICH APPS USE THIS PLUGIN: exactly the apps listed in `PROVIDER_AUTHORITIES`
- * below, which must be apps inside the `so.oxy.shared` UID. UID members share one
- * data directory, so they all serve the SAME file and the sweep in
- * `OxyDeviceSessionModule` is deterministic whichever one answers. An app that is
- * same-signature but outside that UID must use `withSharedDeviceSessionReader`
- * instead — hosting from there would publish a second, independent copy of "the
- * shared credential" and make the winner depend on list order.
- *
- * Keep this list identical to `PROVIDER_AUTHORITIES` in
- * `android/src/main/java/so/oxy/devicesession/OxyDeviceSessionModule.kt`.
- *
- * This is deliberately a SEPARATE permission and a SEPARATE provider from
- * `withSharedIdentityProvider`. Two secrets with different blast radii: the
- * identity key is self-custody and irreplaceable, the device credential is
- * server-revocable and re-publishable. An app that only needs a session gets only
- * the second one.
+ * WHICH APPS USE THIS PLUGIN: exactly the apps whose authorities are listed in
+ * `HOST_AUTHORITIES` of `OxyDeviceSessionModule.kt` (a test compares them).
  */
 const { withAndroidManifest } = require('@expo/config-plugins');
 
-const READ_DEVICE_SESSION_PERMISSION = 'so.oxy.shared.permission.READ_DEVICE_SESSION';
+const DEVICE_SESSION_PERMISSION = 'so.oxy.permission.DEVICE_SESSION';
 const PROVIDER_CLASS = 'so.oxy.devicesession.OxyDeviceSessionProvider';
-const PROVIDER_AUTHORITIES = [
-  'so.oxy.accounts.devicesession',
-  'so.oxy.accounts.dev.devicesession',
+
+/** The authorities this plugin can end up hosting, one per host app. */
+const HOST_AUTHORITIES = [
   'so.oxy.commons.devicesession',
   'so.oxy.commons.dev.devicesession',
+  'so.oxy.accounts.devicesession',
+  'so.oxy.accounts.dev.devicesession',
 ];
 
-module.exports = function withSharedDeviceSessionProvider(config) {
+function withSharedDeviceSessionProvider(config) {
   return withAndroidManifest(config, (modConfig) => {
     const manifest = modConfig.modResults.manifest;
-
-    // 1. Define the signature-level permission.
-    manifest['permission'] = manifest['permission'] ?? [];
-    if (!manifest['permission'].some((p) => p.$['android:name'] === READ_DEVICE_SESSION_PERMISSION)) {
-      manifest['permission'].push({
-        $: {
-          'android:name': READ_DEVICE_SESSION_PERMISSION,
-          'android:protectionLevel': 'signature',
-        },
-      });
-    }
-
-    // 2. Request it (a hub app reads its siblings too — prod ⇆ dev variant).
-    manifest['uses-permission'] = manifest['uses-permission'] ?? [];
-    if (!manifest['uses-permission'].some((p) => p.$['android:name'] === READ_DEVICE_SESSION_PERMISSION)) {
-      manifest['uses-permission'].push({ $: { 'android:name': READ_DEVICE_SESSION_PERMISSION } });
-    }
-
-    // 3. Make the sibling provider authorities visible under package filtering.
-    manifest['queries'] = manifest['queries'] ?? [];
-    if (manifest['queries'].length === 0) {
-      manifest['queries'].push({});
-    }
-    const queries = manifest['queries'][0];
-    queries.provider = queries.provider ?? [];
-    for (const authority of PROVIDER_AUTHORITIES) {
-      if (!queries.provider.some((p) => p.$['android:authorities'] === authority)) {
-        queries.provider.push({ $: { 'android:authorities': authority } });
-      }
-    }
-
-    // 4. Host the provider.
     const app = manifest.application?.[0];
     if (!app) {
       throw new Error('withSharedDeviceSessionProvider: AndroidManifest has no <application>');
@@ -92,11 +45,13 @@ module.exports = function withSharedDeviceSessionProvider(config) {
           'android:name': PROVIDER_CLASS,
           'android:authorities': '${applicationId}.devicesession',
           'android:exported': 'true',
-          'android:permission': READ_DEVICE_SESSION_PERMISSION,
+          'android:permission': DEVICE_SESSION_PERMISSION,
         },
       });
     }
-
     return modConfig;
   });
-};
+}
+
+module.exports = withSharedDeviceSessionProvider;
+module.exports.HOST_AUTHORITIES = HOST_AUTHORITIES;

package/src/index.ts

@@ -436,3 +436,5 @@ export {
   closeAccountDialog,
   subscribeToAccountDialog,
 } from './ui/navigation/accountDialogManager';
+
+export type { StartNativeOAuthSignInOptions, NativeOAuthSignInResult } from './ui/oauth/nativeAuthTransport';

package/src/ui/boot/__tests__/coldBootNoIdpRedirect.test.ts

@@ -78,7 +78,7 @@ function makeHarness(overrides: Partial<RunProviderColdBootOptions> = {}): Harne
   const sessionClientStart = jest.fn(async () => undefined);
 
   const options: RunProviderColdBootOptions = {
-    oxyServices: {} as RunProviderColdBootOptions['oxyServices'],
+    oxyServices: { apps: { getPublic: jest.fn(async () => ({ id: 'registered-app', name: 'Registered App', type: 'first_party', isOfficial: false, isInternal: false, scopes: [] })) } } as unknown as RunProviderColdBootOptions['oxyServices'],
     authStore: makeEmptyAuthStore(),
     clientId: CLIENT_ID,
     sessionClient: { start: sessionClientStart } as unknown as SessionClient,
@@ -198,7 +198,7 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
       await commit.commitSession({ sessionId: 's1', userId: 'u1' });
       expect(options.commitSession).toHaveBeenCalledWith(
         { sessionId: 's1', userId: 'u1' },
-        { activate: true },
+        { activate: true, oauth: true },
       );
     });
   });
@@ -213,3 +213,57 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
     expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
   });
 });
+
+describe('registered cold-boot classification', () => {
+  beforeEach(() => { mockRunSessionColdBoot.mockReset(); mockTryCompleteOAuthReturn.mockReset(); mockTryCompleteOAuthReturn.mockResolvedValue(false); });
+  it('external classification bypasses prior secrets, shared device and identity pin work', async () => {
+    const { options } = makeHarness();
+    (options.oxyServices.apps.getPublic as jest.Mock).mockResolvedValue({ id: 'external', name: 'External', type: 'third_party', isOfficial: false, isInternal: false, scopes: [] });
+    const beforeDeviceBoot = jest.fn();
+    await runProviderColdBoot({ ...options, beforeDeviceBoot });
+    expect(options.oxyServices.apps.getPublic).toHaveBeenCalledWith(CLIENT_ID, { cache: false });
+    expect(options.authStore.load).not.toHaveBeenCalled();
+    expect(options.authStore.clear).not.toHaveBeenCalled();
+    expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
+    expect(beforeDeviceBoot).not.toHaveBeenCalled();
+    expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+  });
+  it.each(['missing', 'inactive', 'offline', 'invalid'])('fails closed for %s before secrets and callback work', async (mode) => {
+    const { options } = makeHarness();
+    if (mode === 'missing') options.clientId = undefined;
+    else if (mode === 'invalid') (options.oxyServices.apps.getPublic as jest.Mock).mockResolvedValue({ type: 'unknown' });
+    else (options.oxyServices.apps.getPublic as jest.Mock).mockRejectedValue(new Error(mode));
+    await runProviderColdBoot(options);
+    expect(options.markAuthResolved).toHaveBeenCalled();
+    expect(options.authStore.load).not.toHaveBeenCalled();
+    expect(options.authStore.clear).not.toHaveBeenCalled();
+    expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
+    expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+    expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
+  });
+  it('a cold external OAuth callback never probes a previous device secret', async () => {
+    const { options } = makeHarness();
+    (options.oxyServices.apps.getPublic as jest.Mock).mockResolvedValue({ id: 'external', name: 'External', type: 'third_party', isOfficial: false, isInternal: false, scopes: [] });
+    mockTryCompleteOAuthReturn.mockImplementation(async ({ commitSession }) => {
+      await commitSession({ sessionId: 'isolated', userId: 'external-user', accessToken: 'isolated-bearer' }); return true;
+    });
+    await runProviderColdBoot(options);
+    expect(options.commitSession).toHaveBeenCalledWith({ sessionId: 'isolated', userId: 'external-user', accessToken: 'isolated-bearer' }, { activate: true, oauth: true });
+    expect(options.authStore.load).not.toHaveBeenCalled();
+    expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
+    expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+  });
+});
+
+it('an unresponsive registry resolves signed-out without a late privileged continuation', async () => {
+ jest.useFakeTimers();
+ try {
+  const {options}=makeHarness(); let release!: (app:unknown)=>void;
+  (options.oxyServices.apps.getPublic as jest.Mock).mockImplementation(()=>new Promise(resolve=>{release=resolve;}));
+  mockRunSessionColdBoot.mockReset(); mockTryCompleteOAuthReturn.mockReset();
+  const boot=runProviderColdBoot(options); await jest.advanceTimersByTimeAsync(5000); await boot;
+  expect(options.markAuthResolved).toHaveBeenCalled(); expect(options.authStore.load).not.toHaveBeenCalled();
+  release({id:'app',name:'Late',type:'first_party',isOfficial:true,isInternal:false,scopes:[]}); await Promise.resolve();
+  expect(mockRunSessionColdBoot).not.toHaveBeenCalled(); expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
+ } finally {jest.useRealTimers();}
+});

package/src/ui/boot/runProviderColdBoot.ts

@@ -1,3 +1,4 @@
+import { resolveApplicationSessionLane } from '../oauth/applicationSessionLane';
 import { logger as loggerUtil, type OxyServices } from '@oxy.so/core';
 import { runSessionColdBoot, type AuthStateStore, type IdentityBinding, type SessionMode } from '@oxy.so/core/session';
 import type { SessionClient } from '@oxy.so/core/session';
@@ -80,8 +81,14 @@ export interface RunProviderColdBootOptions {
   /** The identity binding required by `sessionMode: 'identity'`. */
   identity?: IdentityBinding;
   sessionClient: SessionClient;
+  /** Provider-owned fresh classifier, also used by explicit action recovery. */
+  resolveSessionLane?: () => Promise<'device' | 'oauth'>;
+  /** Identity pin work may run only after a fresh device classification. */
+  onClassified?: (lane: 'device' | 'oauth') => void | Promise<void>;
+  beforeDeviceBoot?: () => Promise<void>;
+  afterDeviceBoot?: () => Promise<void>;
   syncDeviceCredentialToHost: () => Promise<void>;
-  commitSession: (input: CommitInput, options: { activate: boolean }) => Promise<void>;
+  commitSession: (input: CommitInput, options: { activate: boolean; oauth?: boolean }) => Promise<void>;
   markAuthResolved: () => void;
   setTokenReady: (ready: boolean) => void;
 }
@@ -91,8 +98,8 @@ export interface RunProviderColdBootOptions {
  *
  * Ordered pipeline:
  * 1. Complete an OAuth authorization-code return already on the URL (web)
- * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
- *    primary-identity-key lane in `sessionMode: 'identity'`)
+ * 2. `runSessionColdBoot` — device-secret mint (+ the native Commons-proof lane,
+ *    or the primary-identity-key lane in `sessionMode: 'identity'`)
  *
  * Step 1 is ACCOUNT-MODE ONLY: it commits whichever account the IdP resolves,
  * which for an identity-bound client is somebody else's account by construction.
@@ -124,6 +131,11 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
   setTokenReady(false);
 
   try {
+    // Classification precedes every local-secret, shared-credential and identity
+    // probe. Unavailable registry metadata fails closed, including offline boot.
+    const lane = await (opts.resolveSessionLane?.() ?? resolveApplicationSessionLane(oxyServices, clientId));
+    await opts.onClassified?.(lane);
+    if (identityBound && lane !== 'device') return;
     // The redirect transport's RETURN leg. An app reaches it whenever the browser
     // BLOCKED the sign-in popup and `startWebOAuthSignIn` fell back to a
     // full-page redirect (`popup-blocked` / `popup-navigation-failed`), so it is
@@ -136,7 +148,7 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
           oxyServices,
           clientId,
           authRedirectUri,
-          commitSession: (input) => commitSession(input, { activate: true }),
+          commitSession: (input) => commitSession(input, { activate: true, oauth: true }),
         });
     if (oauthCompleted) {
       setTokenReady(true);
@@ -144,6 +156,13 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
       return;
     }
 
+    if (lane === 'oauth') {
+      setTokenReady(true);
+      return;
+    }
+
+    await opts.beforeDeviceBoot?.();
+
     // Best-effort connectivity probe up front: an EXPLICIT offline verdict skips
     // the two doomed network steps so routing settles immediately instead of
     // burning the overall deadline on a mint that cannot succeed. Any ambiguity
@@ -224,6 +243,7 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
         }
       },
     });
+    await opts.afterDeviceBoot?.();
   } catch (error) {
     if (__DEV__) {
       loggerUtil.error(

package/src/ui/components/OxySignInButton.tsx

@@ -1,3 +1,4 @@
+import { classifyApplicationSessionLane } from '../oauth/applicationSessionLane';
 import type React from 'react';
 import { useCallback, useState, useEffect, useRef } from 'react';
 import { type ViewStyle, type TextStyle, type StyleProp, Platform } from 'react-native';
@@ -142,6 +143,8 @@ export interface OxySignInButtonProps {
      * ```
      */
     onOAuthResult?: (result: OxyOAuthResult) => void;
+    /** Opt in to the shared SDK native finalizer. Mutually exclusive with onOAuthResult. */
+    nativeOAuthCompletion?: 'sdk';
 }
 
 const ACTION_KEYS: Record<OxySignInButtonAction, string> = {
@@ -188,9 +191,10 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
     showWhenAuthenticated = false,
     oauthRedirectUri,
     onOAuthResult,
+    nativeOAuthCompletion,
 }) => {
     const { t } = useI18n();
-    const { openAccountDialog, oxyServices, clientId, webAuthMode, startWebOAuthSignIn } = useOxy();
+    const { openAccountDialog, oxyServices, clientId, webAuthMode, startWebOAuthSignIn, startNativeOAuthSignIn } = useOxy();
     const { isAuthenticated, isLoading } = useAuthStore(
         useShallow((state) => ({ isAuthenticated: state.isAuthenticated, isLoading: state.isLoading }))
     );
@@ -228,7 +232,7 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
         if (cached && cached.clientId === clientId && cached.oxyServices === oxyServices) {
             return cached.promise;
         }
-        const promise = oxyServices.apps.getPublic(clientId).catch((error) => {
+        const promise = oxyServices.apps.getPublic(clientId, { cache: false }).catch((error) => {
             // Only clear if this is still the live entry (a later resolve may have
             // replaced it after a clientId/oxyServices change).
             if (appResolutionRef.current?.promise === promise) {
@@ -308,6 +312,14 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
                 return;
             }
 
+            if (nativeOAuthCompletion === 'sdk') {
+                if (onOAuthResult) { notifyNotConfigured(app.name); return; }
+                const result = await startNativeOAuthSignIn({ redirectUri: oauthRedirectUri });
+                if (result.status === 'failed') notifyFailed();
+                if (result.status === 'unsupported') notifyNotConfigured(app.name);
+                return;
+            }
+
             // Native: open the in-app auth session, then hand the handshake to the
             // RP so it can complete the token exchange from its deep-link callback.
             const [pkce, state] = await Promise.all([generatePkcePair(), generateOAuthState()]);
@@ -332,6 +344,8 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
             clientId,
             oauthRedirectUri,
             onOAuthResult,
+            nativeOAuthCompletion,
+            startNativeOAuthSignIn,
             startOfficialSignIn,
             startWebOAuthSignIn,
             shouldPreOpenPopup,
@@ -357,7 +371,7 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
                 const resolving = resolvePublicApplication();
                 if (!resolving) {
                     closeOAuthPopup(popup);
-                    startOfficialSignIn();
+                    notifyNotConfigured('this app');
                     return;
                 }
                 let app: PublicApplication;
@@ -373,7 +387,7 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
                     notifyFailed();
                     return;
                 }
-                if (app.type === 'third_party' && !app.isOfficial) {
+                if (classifyApplicationSessionLane(app) === 'oauth') {
                     await startThirdPartyOAuth(app, popup);
                     return;
                 }
@@ -392,6 +406,7 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
                 );
                 notifyFailed();
             } finally {
+                appResolutionRef.current = null;
                 routingRef.current = false;
             }
         },
@@ -400,6 +415,7 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
             startOfficialSignIn,
             startThirdPartyOAuth,
             clientId,
+            notifyNotConfigured,
             notifyFailed,
         ],
     );