@oxy.so/services 10.0.0 → 11.1.0

package/src/ui/oauth/nativeAuthTransport.ts

@@ -0,0 +1,67 @@
+import type { OxyServices } from '@oxy.so/core';
+import { openAuthorizeUrlNative } from '../components/oauthNavigation';
+import { resolveApplicationSessionLane } from './applicationSessionLane';
+import { completeOAuthCode } from './completeOAuthCode';
+import { prepareAuthorizeRequest } from './oauthHandshake';
+import type { OAuthSessionCommitInput } from './types';
+
+export interface StartNativeOAuthSignInOptions {
+  /** Exact registered URI, including any fixed query. Never inferred. */
+  redirectUri: string;
+}
+export type NativeOAuthSignInResult =
+  | { status: 'signed-in' }
+  | { status: 'cancelled' }
+  | { status: 'unsupported'; reason: 'unsupported-platform' | 'missing-client-id' | 'identity-bound' | 'not-third-party' }
+  | { status: 'failed'; reason: 'invalid-redirect-uri' | 'client-resolution-failed' | 'native-callback-invalid' | 'state-mismatch' | 'exchange-failed' | 'already-in-progress' };
+export interface NativeOAuthSignInContext {
+  platform: 'native' | 'unsupported';
+  oxyServices: OxyServices;
+  clientId: string | null;
+  authorizeBaseUrl?: string;
+  identityBound: boolean;
+  commitSession: (input: OAuthSessionCommitInput) => Promise<void>;
+}
+const attempts = new WeakSet<OxyServices>();
+
+function isExactRedirectUri(value: string): boolean {
+  if (!value || value !== value.trim() || /\s/.test(value)) return false;
+  try {
+    const uri = new URL(value);
+    return !uri.username && !uri.password && !uri.hash &&
+      !['code', 'state', 'error', 'error_description'].some((key) => uri.searchParams.has(key));
+  } catch { return false; }
+}
+
+/** SDK owns the in-memory handshake, observed native callback and session commit. */
+export async function startNativeOAuthSignIn(
+  context: NativeOAuthSignInContext,
+  options: StartNativeOAuthSignInOptions,
+): Promise<NativeOAuthSignInResult> {
+  if (context.platform !== 'native') return { status: 'unsupported', reason: 'unsupported-platform' };
+  if (!context.clientId) return { status: 'unsupported', reason: 'missing-client-id' };
+  if (context.identityBound) return { status: 'unsupported', reason: 'identity-bound' };
+  if (!isExactRedirectUri(options.redirectUri)) return { status: 'failed', reason: 'invalid-redirect-uri' };
+  if (attempts.has(context.oxyServices)) return { status: 'failed', reason: 'already-in-progress' };
+  attempts.add(context.oxyServices);
+  try {
+    let lane: 'device' | 'oauth';
+    try { lane = await resolveApplicationSessionLane(context.oxyServices, context.clientId); }
+    catch { return { status: 'failed', reason: 'client-resolution-failed' }; }
+    if (lane !== 'oauth') return { status: 'unsupported', reason: 'not-third-party' };
+    const prepared = await prepareAuthorizeRequest({ clientId: context.clientId, redirectUri: options.redirectUri, authorizeBaseUrl: context.authorizeBaseUrl });
+    const { redirectUrl } = await openAuthorizeUrlNative(prepared.authorizeUrl, options.redirectUri, { allowExternalFallback: false });
+    if (!redirectUrl) return { status: 'cancelled' };
+    const prefix = `${options.redirectUri}${options.redirectUri.includes('?') ? '&' : '?'}`;
+    if (!redirectUrl.startsWith(prefix) || redirectUrl.includes('#')) return { status: 'failed', reason: 'native-callback-invalid' };
+    const parameters = new URLSearchParams(redirectUrl.slice(prefix.length));
+    if ([...new URL(options.redirectUri).searchParams.keys()].some((key) => parameters.has(key))) return { status: 'failed', reason: 'native-callback-invalid' };
+    if (['code', 'state', 'error', 'error_description'].some((key) => parameters.getAll(key).length > 1)) return { status: 'failed', reason: 'native-callback-invalid' };
+    if (parameters.get('state') !== prepared.handshake.state) return { status: 'failed', reason: 'state-mismatch' };
+    const code = parameters.get('code');
+    if (parameters.has('error') || !code) return { status: 'failed', reason: 'native-callback-invalid' };
+    const completion = await completeOAuthCode({ oxyServices: context.oxyServices, clientId: context.clientId, code, returnedState: parameters.get('state'), handshake: prepared.handshake, redirectUri: options.redirectUri, commitSession: context.commitSession });
+    return completion.ok ? { status: 'signed-in' } : { status: 'failed', reason: completion.reason };
+  } catch { return { status: 'failed', reason: 'exchange-failed' }; }
+  finally { attempts.delete(context.oxyServices); }
+}

package/src/ui/session/__tests__/tokenLossRecovery.test.ts

@@ -102,7 +102,7 @@ describe('token loss recovery', () => {
   });
 
   it('re-establishes through the shared identity when the credential is gone, like the cold boot does', async () => {
-    const h = harness([null, 'from-shared-key']);
+    const h = harness([null, 'from-commons-proof']);
     h.state.credential = false;
     h.state.keyed = true;
     const recovery = createTokenLossRecovery(h.deps);
@@ -111,7 +111,7 @@ describe('token loss recovery', () => {
     await runToCompletion(recovery);
 
     expect(h.signOutLocally).not.toHaveBeenCalled();
-    expect(h.state.token).toBe('from-shared-key');
+    expect(h.state.token).toBe('from-commons-proof');
   });
 
   it('gives the key-based lane a bounded number of tries, then signs out', async () => {

package/src/ui/session/createSessionClient.ts

@@ -40,15 +40,27 @@ export function createSessionClient(
   oxyServices: OxyServices,
   onUnauthenticated?: (origin: SessionStateOrigin) => void,
   getPinnedAccountId?: () => string | null,
+  isDeviceSessionAllowed: () => boolean = () => true,
+  onFullExplicitSignOut?: () => Promise<void>,
 ): {
   client: SessionClient;
   host: ReturnType<typeof createSessionClientHost>;
 } {
-  const host = createSessionClientHost(oxyServices);
+  const baseHost = createSessionClientHost(oxyServices);
+  const host = {
+    ...baseHost,
+    getAccessToken: () => isDeviceSessionAllowed() ? baseHost.getAccessToken() : null,
+    setTokens: (token: string) => { if (isDeviceSessionAllowed()) baseHost.setTokens(token); },
+    makeRequest: async <T>(method: 'GET' | 'POST', url: string, data?: unknown, requestOptions?: { cache?: boolean }): Promise<T> => {
+      if (!isDeviceSessionAllowed()) throw new Error('An isolated OAuth session cannot access the shared device');
+      return baseHost.makeRequest<T>(method, url, data, requestOptions);
+    },
+  };
   const transport = createTokenTransport(oxyServices, getPinnedAccountId);
   const client = new SessionClient(host, {
     transport,
     onUnauthenticated,
+    onFullExplicitSignOut,
     getPinnedAccountId,
   });
   return { client, host };

package/src/ui/session/deviceCredentialTracker.ts

@@ -7,7 +7,7 @@
  * every load, save and clear passes through, so the press can read it at once.
  * The cold boot loads the store on mount, long before anyone presses sign-in.
  */
-import type { AuthStateStore } from '@oxy.so/core/session';
+import type { AuthStateStore, AuthStateWriteGuard, PersistedAuthState } from '@oxy.so/core/session';
 
 export interface HeldDeviceCredential {
   deviceId: string;
@@ -31,6 +31,7 @@ function credentialOf(state: { deviceId?: string; deviceSecret?: string } | null
 export function trackDeviceCredential(store: AuthStateStore): CredentialTrackingAuthStateStore {
   let held: HeldDeviceCredential | null | undefined;
   return {
+    ...store,
     load: async () => {
       const state = await store.load();
       held = credentialOf(state);
@@ -40,6 +41,11 @@ export function trackDeviceCredential(store: AuthStateStore): CredentialTracking
       held = credentialOf(state);
       return store.save(state);
     },
+    ...(store.saveIfCurrent ? {saveIfCurrent: async (state: PersistedAuthState, guard: AuthStateWriteGuard) => {
+      const committed = await store.saveIfCurrent?.(state, guard);
+      if (committed) held = credentialOf(state);
+      return committed === true;
+    }} : {}),
     clear: async () => {
       held = null;
       await store.clear();

package/src/ui/session/tokenLossRecovery.ts

@@ -21,7 +21,7 @@
  *    this loop in a sign-out — so a real revocation still signs out.
  *  - No credential, but a key-based lane can still re-establish (the native
  *    shared identity, or an identity-bound client's own key) → try that a few
- *    times, as the cold boot's shared-key step would, then sign out.
+ *    times, as the cold boot's Commons-proof step would, then sign out.
  *  - Neither → the session is over. Sign out now, as before.
  *
  * Framework-free and clock-injectable so the policy is unit tested without a

package/android/src/main/java/so/oxy/identity/OxyIdentityProvider.kt

@@ -1,77 +0,0 @@
-package so.oxy.identity
-
-import android.content.ContentProvider
-import android.content.ContentValues
-import android.content.Context
-import android.content.pm.PackageManager
-import android.database.Cursor
-import android.net.Uri
-import android.os.Bundle
-
-/**
- * Cross-process read surface for the shared Oxy identity, hosted ONLY by Commons
- * (declared per-app by the `withSharedIdentityProvider` config plugin with a
- * `signature`-level permission, authority `${applicationId}.identity`).
- *
- * `call("getShared")` returns the keypair from Commons's own
- * EncryptedSharedPreferences — but ONLY after verifying the caller is signed
- * with the SAME certificate. That signature check is belt-and-suspenders on top
- * of the manifest's `signature` permission: even if the permission gate were
- * ever misconfigured, a differently-signed caller still gets null.
- *
- * All standard CRUD operations are no-ops; this provider exists solely for the
- * `call()` channel.
- */
-class OxyIdentityProvider : ContentProvider() {
-  override fun onCreate(): Boolean = true
-
-  override fun call(method: String, arg: String?, extras: Bundle?): Bundle? {
-    if (method != METHOD_GET_SHARED) return null
-    val ctx = context ?: return null
-    if (!callerSignatureMatches(ctx)) return null
-
-    val pair = runCatching { OxyIdentityStore.read(ctx) }.getOrNull() ?: return null
-    return Bundle().apply {
-      putString(OxyIdentityStore.KEY_PRIVATE, pair.first)
-      putString(OxyIdentityStore.KEY_PUBLIC, pair.second)
-    }
-  }
-
-  /**
-   * True when the calling package shares this app's signing certificate. Uses
-   * `checkSignatures` (deprecated but still the simplest correct cross-package
-   * signature comparison; returns SIGNATURE_MATCH only for same-cert apps).
-   */
-  private fun callerSignatureMatches(ctx: Context): Boolean {
-    val caller = callingPackage ?: return false
-    return runCatching {
-      @Suppress("DEPRECATION")
-      ctx.packageManager.checkSignatures(caller, ctx.packageName) == PackageManager.SIGNATURE_MATCH
-    }.getOrDefault(false)
-  }
-
-  override fun query(
-    uri: Uri,
-    projection: Array<out String>?,
-    selection: String?,
-    selectionArgs: Array<out String>?,
-    sortOrder: String?
-  ): Cursor? = null
-
-  override fun getType(uri: Uri): String? = null
-
-  override fun insert(uri: Uri, values: ContentValues?): Uri? = null
-
-  override fun delete(uri: Uri, selection: String?, selectionArgs: Array<out String>?): Int = 0
-
-  override fun update(
-    uri: Uri,
-    values: ContentValues?,
-    selection: String?,
-    selectionArgs: Array<out String>?
-  ): Int = 0
-
-  companion object {
-    private const val METHOD_GET_SHARED = "getShared"
-  }
-}

package/android/src/main/java/so/oxy/identity/OxyIdentityStore.kt

@@ -1,66 +0,0 @@
-package so.oxy.identity
-
-import android.content.Context
-import android.content.SharedPreferences
-import so.oxy.storage.OxyEncryptedPrefs
-import so.oxy.storage.RecoveryPolicy
-
-/**
- * Shared accessor for the hardware-backed EncryptedSharedPreferences that holds
- * the cross-app Oxy identity keypair.
- *
- * Used by BOTH [OxyIdentityModule] (the JS bridge / local read + write) and
- * [OxyIdentityProvider] (the cross-process read surface) so the store name and
- * the encryption scheme can never drift between the two halves.
- *
- * Opening the file — the single-memoized-instance rule and the two-stage keyset
- * self-heal, both load-bearing and non-obvious — lives in [OxyEncryptedPrefs],
- * which is shared with the background-session store. Read its documentation
- * before changing anything about how this file is opened.
- *
- * One consequence worth restating here: an open can legitimately return an EMPTY
- * file (the self-heal wipes a keyset it cannot read). That is safe for this slot
- * specifically because it is a DERIVED copy — Commons re-populates it from the
- * primary self-custody identity on the next boot (`migrateToSharedIdentity`), and
- * that primary lives in expo-secure-store under a different file and different
- * keystore aliases, untouched by any recovery here.
- */
-internal object OxyIdentityStore {
-  const val PREFS_NAME = "oxy_shared_identity"
-  const val KEY_PRIVATE = "priv"
-  const val KEY_PUBLIC = "pub"
-
-  /**
-   * [RecoveryPolicy.RebuildFileOnly], like every other store (OxyHQ/oxy#1388).
-   * This store used to regenerate the UID-shared androidx master key when its
-   * keyset could not be rebuilt, which made every other Oxy app's encrypted prefs
-   * unreadable. It never needs to: this slot is a DERIVED copy that Commons
-   * re-populates from the primary identity on every launch
-   * (`KeyManager.syncSharedIdentity`), so an empty or unavailable slot costs
-   * nothing that a relaunch of Commons does not restore.
-   */
-  private fun prefs(context: Context): SharedPreferences =
-    OxyEncryptedPrefs.open(context, PREFS_NAME, RecoveryPolicy.RebuildFileOnly)
-
-  /** Read the stored keypair as (privateKey, publicKey), or null when absent/blank. */
-  fun read(context: Context): Pair<String, String>? {
-    val p = prefs(context)
-    val priv = p.getString(KEY_PRIVATE, null) ?: return null
-    val pub = p.getString(KEY_PUBLIC, null) ?: return null
-    if (priv.isEmpty() || pub.isEmpty()) return null
-    return priv to pub
-  }
-
-  fun write(context: Context, priv: String, pub: String) {
-    // commit() (synchronous) so a cross-process reader that fires immediately
-    // after the write is guaranteed to see the flushed value.
-    prefs(context).edit()
-      .putString(KEY_PRIVATE, priv)
-      .putString(KEY_PUBLIC, pub)
-      .commit()
-  }
-
-  fun clear(context: Context) {
-    prefs(context).edit().clear().commit()
-  }
-}

package/plugins/withSharedDeviceSessionReader.js

@@ -1,57 +0,0 @@
-/**
- * Config plugin: withSharedDeviceSessionReader (every other official Oxy app).
- *
- * A reader app JOINS the device's existing session — it adopts the shared
- * `deviceId` + `deviceSecret` a hub app published, so it lands signed in with no
- * QR and, crucially, without ever asking for Commons's private identity key.
- * This plugin wires the minimal Android side of `@oxy.so/services`:
- *
- *  - Requests the `signature`-level permission
- *    `so.oxy.shared.permission.READ_DEVICE_SESSION` (defined by the hub apps).
- *    Because it is `signature`, it is granted only when this app is signed with
- *    the SAME certificate as the hub — that is the entire trust boundary, and it
- *    is what makes an incorrectly-signed app unable to read the slot.
- *  - Adds `<queries>` entries for the hub authorities so package-visibility
- *    filtering (Android 11+) never hides them from `ContentResolver.call`.
- *
- * The provider itself is declared only by the hub apps
- * (`withSharedDeviceSessionProvider`) — see the note there about why hosting is
- * restricted to apps inside the `so.oxy.shared` UID.
- *
- * Keep this list identical to `PROVIDER_AUTHORITIES` in
- * `android/src/main/java/so/oxy/devicesession/OxyDeviceSessionModule.kt`.
- */
-const { withAndroidManifest } = require('@expo/config-plugins');
-
-const READ_DEVICE_SESSION_PERMISSION = 'so.oxy.shared.permission.READ_DEVICE_SESSION';
-const PROVIDER_AUTHORITIES = [
-  'so.oxy.accounts.devicesession',
-  'so.oxy.accounts.dev.devicesession',
-  'so.oxy.commons.devicesession',
-  'so.oxy.commons.dev.devicesession',
-];
-
-module.exports = function withSharedDeviceSessionReader(config) {
-  return withAndroidManifest(config, (modConfig) => {
-    const manifest = modConfig.modResults.manifest;
-
-    manifest['uses-permission'] = manifest['uses-permission'] ?? [];
-    if (!manifest['uses-permission'].some((p) => p.$['android:name'] === READ_DEVICE_SESSION_PERMISSION)) {
-      manifest['uses-permission'].push({ $: { 'android:name': READ_DEVICE_SESSION_PERMISSION } });
-    }
-
-    manifest['queries'] = manifest['queries'] ?? [];
-    if (manifest['queries'].length === 0) {
-      manifest['queries'].push({});
-    }
-    const queries = manifest['queries'][0];
-    queries.provider = queries.provider ?? [];
-    for (const authority of PROVIDER_AUTHORITIES) {
-      if (!queries.provider.some((p) => p.$['android:authorities'] === authority)) {
-        queries.provider.push({ $: { 'android:authorities': authority } });
-      }
-    }
-
-    return modConfig;
-  });
-};

package/plugins/withSharedIdentityProvider.js

@@ -1,83 +0,0 @@
-/**
- * Config plugin: withSharedIdentityProvider (Commons only).
- *
- * Commons is the identity vault — the ONE app that HOSTS the cross-app shared
- * identity. This plugin wires the Android side of `@oxy.so/services`:
- *
- *  - Defines a `signature`-level permission `so.oxy.shared.permission.READ_IDENTITY`.
- *    `signature` means only apps signed with the SAME certificate (the shared
- *    Oxy release keystore) can hold it — the trust boundary is the signing key,
- *    not the deprecated `sharedUserId`.
- *  - Requests that same permission (`<uses-permission>`) so Commons can also
- *    read cross-authority (e.g. prod ⇆ dev variant) through the provider.
- *  - Declares the `OxyIdentityProvider` at authority `${applicationId}.identity`
- *    (AGP substitutes `${applicationId}` at build → `so.oxy.commons.identity`,
- *    or `so.oxy.commons.dev.identity` for the dev variant), guarded by that
- *    permission.
- *  - Adds a `<queries>` entry for the provider authorities so package-visibility
- *    filtering (Android 11+) never hides the sibling provider from the resolver.
- *
- * Reader apps (accounts, Mention, …) use the companion `withSharedIdentityReader`
- * plugin, which only requests the permission + queries — they never host the
- * provider.
- */
-const { withAndroidManifest } = require('@expo/config-plugins');
-
-const READ_IDENTITY_PERMISSION = 'so.oxy.shared.permission.READ_IDENTITY';
-const PROVIDER_CLASS = 'so.oxy.identity.OxyIdentityProvider';
-const PROVIDER_AUTHORITIES = ['so.oxy.commons.identity', 'so.oxy.commons.dev.identity'];
-
-module.exports = function withSharedIdentityProvider(config) {
-  return withAndroidManifest(config, (modConfig) => {
-    const manifest = modConfig.modResults.manifest;
-
-    // 1. Define the signature-level permission.
-    manifest['permission'] = manifest['permission'] ?? [];
-    if (!manifest['permission'].some((p) => p.$['android:name'] === READ_IDENTITY_PERMISSION)) {
-      manifest['permission'].push({
-        $: {
-          'android:name': READ_IDENTITY_PERMISSION,
-          'android:protectionLevel': 'signature',
-        },
-      });
-    }
-
-    // 2. Request it (Commons reads cross-authority too).
-    manifest['uses-permission'] = manifest['uses-permission'] ?? [];
-    if (!manifest['uses-permission'].some((p) => p.$['android:name'] === READ_IDENTITY_PERMISSION)) {
-      manifest['uses-permission'].push({ $: { 'android:name': READ_IDENTITY_PERMISSION } });
-    }
-
-    // 3. Make the sibling provider authorities visible under package filtering.
-    manifest['queries'] = manifest['queries'] ?? [];
-    if (manifest['queries'].length === 0) {
-      manifest['queries'].push({});
-    }
-    const queries = manifest['queries'][0];
-    queries.provider = queries.provider ?? [];
-    for (const authority of PROVIDER_AUTHORITIES) {
-      if (!queries.provider.some((p) => p.$['android:authorities'] === authority)) {
-        queries.provider.push({ $: { 'android:authorities': authority } });
-      }
-    }
-
-    // 4. Host the provider.
-    const app = manifest.application?.[0];
-    if (!app) {
-      throw new Error('withSharedIdentityProvider: AndroidManifest has no <application>');
-    }
-    app.provider = app.provider ?? [];
-    if (!app.provider.some((p) => p.$['android:name'] === PROVIDER_CLASS)) {
-      app.provider.push({
-        $: {
-          'android:name': PROVIDER_CLASS,
-          'android:authorities': '${applicationId}.identity',
-          'android:exported': 'true',
-          'android:permission': READ_IDENTITY_PERMISSION,
-        },
-      });
-    }
-
-    return modConfig;
-  });
-};

package/plugins/withSharedIdentityReader.js

@@ -1,46 +0,0 @@
-/**
- * Config plugin: withSharedIdentityReader (reader RPs — accounts, etc.).
- *
- * Reader apps do NOT host the shared identity — they only READ it from the
- * Commons-hosted `OxyIdentityProvider` to enable silent "Sign in with Oxy".
- * This plugin wires the minimal Android side of `@oxy.so/services`:
- *
- *  - Requests the `signature`-level permission `so.oxy.shared.permission.READ_IDENTITY`
- *    (defined by Commons). Because it is `signature`, it is only granted when
- *    this app is signed with the SAME certificate as Commons (the shared Oxy
- *    release keystore) — that is the entire trust boundary.
- *  - Adds a `<queries>` entry for the Commons provider authorities so
- *    package-visibility filtering (Android 11+) never hides the provider from
- *    `ContentResolver.call`.
- *
- * The provider itself is declared only in Commons (`withSharedIdentityProvider`).
- */
-const { withAndroidManifest } = require('@expo/config-plugins');
-
-const READ_IDENTITY_PERMISSION = 'so.oxy.shared.permission.READ_IDENTITY';
-const PROVIDER_AUTHORITIES = ['so.oxy.commons.identity', 'so.oxy.commons.dev.identity'];
-
-module.exports = function withSharedIdentityReader(config) {
-  return withAndroidManifest(config, (modConfig) => {
-    const manifest = modConfig.modResults.manifest;
-
-    manifest['uses-permission'] = manifest['uses-permission'] ?? [];
-    if (!manifest['uses-permission'].some((p) => p.$['android:name'] === READ_IDENTITY_PERMISSION)) {
-      manifest['uses-permission'].push({ $: { 'android:name': READ_IDENTITY_PERMISSION } });
-    }
-
-    manifest['queries'] = manifest['queries'] ?? [];
-    if (manifest['queries'].length === 0) {
-      manifest['queries'].push({});
-    }
-    const queries = manifest['queries'][0];
-    queries.provider = queries.provider ?? [];
-    for (const authority of PROVIDER_AUTHORITIES) {
-      if (!queries.provider.some((p) => p.$['android:authorities'] === authority)) {
-        queries.provider.push({ $: { 'android:authorities': authority } });
-      }
-    }
-
-    return modConfig;
-  });
-};