@oxy.so/services 11.0.0 → 11.1.1

package/src/ui/oauth/nativeAuthTransport.ts

@@ -0,0 +1,67 @@
+import type { OxyServices } from '@oxy.so/core';
+import { openAuthorizeUrlNative } from '../components/oauthNavigation';
+import { resolveApplicationSessionLane } from './applicationSessionLane';
+import { completeOAuthCode } from './completeOAuthCode';
+import { prepareAuthorizeRequest } from './oauthHandshake';
+import type { OAuthSessionCommitInput } from './types';
+
+export interface StartNativeOAuthSignInOptions {
+  /** Exact registered URI, including any fixed query. Never inferred. */
+  redirectUri: string;
+}
+export type NativeOAuthSignInResult =
+  | { status: 'signed-in' }
+  | { status: 'cancelled' }
+  | { status: 'unsupported'; reason: 'unsupported-platform' | 'missing-client-id' | 'identity-bound' | 'not-third-party' }
+  | { status: 'failed'; reason: 'invalid-redirect-uri' | 'client-resolution-failed' | 'native-callback-invalid' | 'state-mismatch' | 'exchange-failed' | 'already-in-progress' };
+export interface NativeOAuthSignInContext {
+  platform: 'native' | 'unsupported';
+  oxyServices: OxyServices;
+  clientId: string | null;
+  authorizeBaseUrl?: string;
+  identityBound: boolean;
+  commitSession: (input: OAuthSessionCommitInput) => Promise<void>;
+}
+const attempts = new WeakSet<OxyServices>();
+
+function isExactRedirectUri(value: string): boolean {
+  if (!value || value !== value.trim() || /\s/.test(value)) return false;
+  try {
+    const uri = new URL(value);
+    return !uri.username && !uri.password && !uri.hash &&
+      !['code', 'state', 'error', 'error_description'].some((key) => uri.searchParams.has(key));
+  } catch { return false; }
+}
+
+/** SDK owns the in-memory handshake, observed native callback and session commit. */
+export async function startNativeOAuthSignIn(
+  context: NativeOAuthSignInContext,
+  options: StartNativeOAuthSignInOptions,
+): Promise<NativeOAuthSignInResult> {
+  if (context.platform !== 'native') return { status: 'unsupported', reason: 'unsupported-platform' };
+  if (!context.clientId) return { status: 'unsupported', reason: 'missing-client-id' };
+  if (context.identityBound) return { status: 'unsupported', reason: 'identity-bound' };
+  if (!isExactRedirectUri(options.redirectUri)) return { status: 'failed', reason: 'invalid-redirect-uri' };
+  if (attempts.has(context.oxyServices)) return { status: 'failed', reason: 'already-in-progress' };
+  attempts.add(context.oxyServices);
+  try {
+    let lane: 'device' | 'oauth';
+    try { lane = await resolveApplicationSessionLane(context.oxyServices, context.clientId); }
+    catch { return { status: 'failed', reason: 'client-resolution-failed' }; }
+    if (lane !== 'oauth') return { status: 'unsupported', reason: 'not-third-party' };
+    const prepared = await prepareAuthorizeRequest({ clientId: context.clientId, redirectUri: options.redirectUri, authorizeBaseUrl: context.authorizeBaseUrl });
+    const { redirectUrl } = await openAuthorizeUrlNative(prepared.authorizeUrl, options.redirectUri, { allowExternalFallback: false });
+    if (!redirectUrl) return { status: 'cancelled' };
+    const prefix = `${options.redirectUri}${options.redirectUri.includes('?') ? '&' : '?'}`;
+    if (!redirectUrl.startsWith(prefix) || redirectUrl.includes('#')) return { status: 'failed', reason: 'native-callback-invalid' };
+    const parameters = new URLSearchParams(redirectUrl.slice(prefix.length));
+    if ([...new URL(options.redirectUri).searchParams.keys()].some((key) => parameters.has(key))) return { status: 'failed', reason: 'native-callback-invalid' };
+    if (['code', 'state', 'error', 'error_description'].some((key) => parameters.getAll(key).length > 1)) return { status: 'failed', reason: 'native-callback-invalid' };
+    if (parameters.get('state') !== prepared.handshake.state) return { status: 'failed', reason: 'state-mismatch' };
+    const code = parameters.get('code');
+    if (parameters.has('error') || !code) return { status: 'failed', reason: 'native-callback-invalid' };
+    const completion = await completeOAuthCode({ oxyServices: context.oxyServices, clientId: context.clientId, code, returnedState: parameters.get('state'), handshake: prepared.handshake, redirectUri: options.redirectUri, commitSession: context.commitSession });
+    return completion.ok ? { status: 'signed-in' } : { status: 'failed', reason: completion.reason };
+  } catch { return { status: 'failed', reason: 'exchange-failed' }; }
+  finally { attempts.delete(context.oxyServices); }
+}

package/src/ui/session/createSessionClient.ts

@@ -40,15 +40,27 @@ export function createSessionClient(
   oxyServices: OxyServices,
   onUnauthenticated?: (origin: SessionStateOrigin) => void,
   getPinnedAccountId?: () => string | null,
+  isDeviceSessionAllowed: () => boolean = () => true,
+  onFullExplicitSignOut?: () => Promise<void>,
 ): {
   client: SessionClient;
   host: ReturnType<typeof createSessionClientHost>;
 } {
-  const host = createSessionClientHost(oxyServices);
+  const baseHost = createSessionClientHost(oxyServices);
+  const host = {
+    ...baseHost,
+    getAccessToken: () => isDeviceSessionAllowed() ? baseHost.getAccessToken() : null,
+    setTokens: (token: string) => { if (isDeviceSessionAllowed()) baseHost.setTokens(token); },
+    makeRequest: async <T>(method: 'GET' | 'POST', url: string, data?: unknown, requestOptions?: { cache?: boolean }): Promise<T> => {
+      if (!isDeviceSessionAllowed()) throw new Error('An isolated OAuth session cannot access the shared device');
+      return baseHost.makeRequest<T>(method, url, data, requestOptions);
+    },
+  };
   const transport = createTokenTransport(oxyServices, getPinnedAccountId);
   const client = new SessionClient(host, {
     transport,
     onUnauthenticated,
+    onFullExplicitSignOut,
     getPinnedAccountId,
   });
   return { client, host };

package/src/ui/session/deviceCredentialTracker.ts

@@ -7,7 +7,7 @@
  * every load, save and clear passes through, so the press can read it at once.
  * The cold boot loads the store on mount, long before anyone presses sign-in.
  */
-import type { AuthStateStore } from '@oxy.so/core/session';
+import type { AuthStateStore, AuthStateWriteGuard, PersistedAuthState } from '@oxy.so/core/session';
 
 export interface HeldDeviceCredential {
   deviceId: string;
@@ -31,6 +31,7 @@ function credentialOf(state: { deviceId?: string; deviceSecret?: string } | null
 export function trackDeviceCredential(store: AuthStateStore): CredentialTrackingAuthStateStore {
   let held: HeldDeviceCredential | null | undefined;
   return {
+    ...store,
     load: async () => {
       const state = await store.load();
       held = credentialOf(state);
@@ -40,6 +41,11 @@ export function trackDeviceCredential(store: AuthStateStore): CredentialTracking
       held = credentialOf(state);
       return store.save(state);
     },
+    ...(store.saveIfCurrent ? {saveIfCurrent: async (state: PersistedAuthState, guard: AuthStateWriteGuard) => {
+      const committed = await store.saveIfCurrent?.(state, guard);
+      if (committed) held = credentialOf(state);
+      return committed === true;
+    }} : {}),
     clear: async () => {
       held = null;
       await store.clear();