@oxy.so/services 11.3.0 → 11.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/commonjs/ui/boot/runProviderColdBoot.js +47 -3
- package/lib/commonjs/ui/boot/runProviderColdBoot.js.map +1 -1
- package/lib/module/ui/boot/runProviderColdBoot.js +47 -3
- package/lib/module/ui/boot/runProviderColdBoot.js.map +1 -1
- package/lib/typescript/commonjs/ui/boot/runProviderColdBoot.d.ts.map +1 -1
- package/lib/typescript/module/ui/boot/runProviderColdBoot.d.ts.map +1 -1
- package/package.json +3 -3
- package/src/ui/boot/__tests__/coldBootNoIdpRedirect.test.ts +166 -3
- package/src/ui/boot/runProviderColdBoot.ts +49 -4
|
@@ -14,6 +14,28 @@ var _oauthReturn = require("../utils/oauthReturn.js");
|
|
|
14
14
|
var _isWebBrowser = require("../utils/isWebBrowser.js");
|
|
15
15
|
var _netConnectivity = require("../utils/netConnectivity.js");
|
|
16
16
|
function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
|
|
17
|
+
/**
|
|
18
|
+
* Whether the URL carries an OAuth return (`?code=` or `?error=`) for
|
|
19
|
+
* `tryCompleteOAuthReturn` to consume. Reads the address bar only.
|
|
20
|
+
*/
|
|
21
|
+
function hasOAuthReturnOnUrl() {
|
|
22
|
+
const search = globalThis.location?.search;
|
|
23
|
+
if (!search) return false;
|
|
24
|
+
const params = new URLSearchParams(search);
|
|
25
|
+
return params.has('code') || params.has('error');
|
|
26
|
+
}
|
|
27
|
+
|
|
28
|
+
/**
|
|
29
|
+
* Whether this origin's own store holds anything a web boot could restore from:
|
|
30
|
+
* a warm access token to plant or a device secret to mint with. A presence
|
|
31
|
+
* check only — nothing read here is used, sent or synced before the
|
|
32
|
+
* classification allows it.
|
|
33
|
+
*/
|
|
34
|
+
async function hasRestorableState(store) {
|
|
35
|
+
const persisted = await store.load();
|
|
36
|
+
return Boolean(persisted?.accessToken || persisted?.deviceSecret);
|
|
37
|
+
}
|
|
38
|
+
|
|
17
39
|
/** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
|
|
18
40
|
const SESSION_HANDOFF_DEADLINE_MS = exports.SESSION_HANDOFF_DEADLINE_MS = 6000;
|
|
19
41
|
|
|
@@ -101,9 +123,31 @@ async function runProviderColdBoot(opts) {
|
|
|
101
123
|
const identityBound = sessionMode === 'identity';
|
|
102
124
|
setTokenReady(false);
|
|
103
125
|
try {
|
|
104
|
-
// Classification precedes every local
|
|
105
|
-
//
|
|
106
|
-
|
|
126
|
+
// Classification precedes every USE of a local secret, the shared credential
|
|
127
|
+
// and the identity key. Unavailable registry metadata fails closed, including
|
|
128
|
+
// offline boot. It starts now, before anything else, so its round trip
|
|
129
|
+
// overlaps the local work below.
|
|
130
|
+
const classification = (async () => opts.resolveSessionLane?.() ?? (0, _applicationSessionLane.resolveApplicationSessionLane)(oxyServices, clientId))();
|
|
131
|
+
// Observed so a rejection that lands before it is awaited is not reported as
|
|
132
|
+
// unhandled; every path below still awaits it and sees the rejection.
|
|
133
|
+
classification.catch(() => undefined);
|
|
134
|
+
|
|
135
|
+
// The verdict decides HOW a session is restored, never WHETHER there is one.
|
|
136
|
+
// A web origin with nothing to restore and no OAuth return on the URL ends
|
|
137
|
+
// signed out on either lane, so routing need not wait a network round trip
|
|
138
|
+
// for an answer that cannot change the outcome. The classification still
|
|
139
|
+
// completes below and still gates every later sign-in
|
|
140
|
+
// (`ensureDeviceSessionLane` shares this same in-flight lookup).
|
|
141
|
+
if (!identityBound && (0, _isWebBrowser.isWebBrowser)() && !hasOAuthReturnOnUrl()) {
|
|
142
|
+
if (!(await hasRestorableState(authStore))) {
|
|
143
|
+
markAuthResolved();
|
|
144
|
+
const lane = await classification;
|
|
145
|
+
await opts.onClassified?.(lane);
|
|
146
|
+
if (lane === 'oauth') setTokenReady(true);
|
|
147
|
+
return;
|
|
148
|
+
}
|
|
149
|
+
}
|
|
150
|
+
const lane = await classification;
|
|
107
151
|
await opts.onClassified?.(lane);
|
|
108
152
|
if (identityBound && lane !== 'device') return;
|
|
109
153
|
// The redirect transport's RETURN leg. An app reaches it whenever the browser
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["_applicationSessionLane","require","_core","_session","_deviceCredential","_sharedDeviceCredentialStore","_oauthReturn","_isWebBrowser","_netConnectivity","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","SESSION_HANDOFF_DEADLINE_MS","exports","COLD_BOOT_OVERALL_DEADLINE_MS","OFFLINE_PROBE_TIMEOUT_MS","detectOfflineHint","isWebBrowser","online","
|
|
1
|
+
{"version":3,"names":["_applicationSessionLane","require","_core","_session","_deviceCredential","_sharedDeviceCredentialStore","_oauthReturn","_isWebBrowser","_netConnectivity","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","hasOAuthReturnOnUrl","search","globalThis","location","params","URLSearchParams","hasRestorableState","store","persisted","load","Boolean","accessToken","deviceSecret","SESSION_HANDOFF_DEADLINE_MS","exports","COLD_BOOT_OVERALL_DEADLINE_MS","OFFLINE_PROBE_TIMEOUT_MS","detectOfflineHint","isWebBrowser","online","navigator","onLine","NetInfo","Promise","resolve","then","state","race","fetch","setTimeout","isNetConnectivityExplicitlyOffline","runProviderColdBoot","opts","oxyServices","authStore","clientId","authRedirectUri","sessionMode","identity","sessionClient","syncDeviceCredentialToHost","commitSession","markAuthResolved","setTokenReady","identityBound","classification","resolveSessionLane","resolveApplicationSessionLane","catch","undefined","lane","onClassified","oauthCompleted","tryCompleteOAuthReturn","input","activate","oauth","beforeDeviceBoot","offline","runSessionColdBoot","oxy","platform","isWeb","isNative","sharedDeviceCredential","createPlatformSharedDeviceCredentialStore","overallDeadlineMs","isOffline","onStepDeadline","stepId","loggerUtil","warn","component","method","onSession","session","handoff","sessionId","userId","deviceState","handoffDeadlineId","finally","clearTimeout","onSignedOut","cred","loadPersistedDeviceCredential","start","socketError","__DEV__","debug","onStepError","id","error","afterDeviceBoot","Error","String"],"sourceRoot":"../../../../src","sources":["ui/boot/runProviderColdBoot.ts"],"mappings":";;;;;;;AAAA,IAAAA,uBAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,QAAA,GAAAF,OAAA;AAOA,IAAAG,iBAAA,GAAAH,OAAA;AACA,IAAAI,4BAAA,GAAAJ,OAAA;AACA,IAAAK,YAAA,GAAAL,OAAA;AACA,IAAAM,aAAA,GAAAN,OAAA;AACA,IAAAO,gBAAA,GAAAP,OAAA;AAA8E,SAAAQ,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA;AAG9E;AACA;AACA;AACA;AACA,SAASkB,mBAAmBA,CAAA,EAAY;EACtC,MAAMC,MAAM,GAAIC,UAAU,CAAwCC,QAAQ,EAAEF,MAAM;EAClF,IAAI,CAACA,MAAM,EAAE,OAAO,KAAK;EACzB,MAAMG,MAAM,GAAG,IAAIC,eAAe,CAACJ,MAAM,CAAC;EAC1C,OAAOG,MAAM,CAACZ,GAAG,CAAC,MAAM,CAAC,IAAIY,MAAM,CAACZ,GAAG,CAAC,OAAO,CAAC;AAClD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,eAAec,kBAAkBA,CAACC,KAAqB,EAAoB;EACzE,MAAMC,SAAS,GAAG,MAAMD,KAAK,CAACE,IAAI,CAAC,CAAC;EACpC,OAAOC,OAAO,CAACF,SAAS,EAAEG,WAAW,IAAIH,SAAS,EAAEI,YAAY,CAAC;AACnE;;AAEA;AACO,MAAMC,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GAAG,IAAI;;AAE/C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,6BAA6B,GAAAD,OAAA,CAAAC,6BAAA,GAAG,MAAM;;AAEnD;AACA;AACA;AACA;AACA;AACA,MAAMC,wBAAwB,GAAG,GAAG;;AAEpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAqB;EACnD,IAAI;IACF,IAAI,IAAAC,0BAAY,EAAC,CAAC,EAAE;MAClB,MAAMC,MAAM,GAAIjB,UAAU,CAA0CkB,SAAS,EAAEC,MAAM;MACrF;MACA,OAAOF,MAAM,KAAK,KAAK;IACzB;IACA,MAAMG,OAAO,GAAG,MAAAC,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAA7C,uBAAA,CAAAR,OAAA,CAAa,iCAAiC,GAAC;IAC/D,MAAMsD,KAAK,GAAG,MAAMH,OAAO,CAACI,IAAI,CAAC,CAC/BL,OAAO,CAAC/B,OAAO,CAACqC,KAAK,CAAC,CAAC,EACvB,IAAIL,OAAO,CAAQC,OAAO,IAAK;MAC7BK,UAAU,CAAC,MAAML,OAAO,CAAC,IAAI,CAAC,EAAER,wBAAwB,CAAC;IAC3D,CAAC,CAAC,CACH,CAAC;IACF;IACA;IACA,OAAO,IAAAc,mDAAkC,EAACJ,KAAK,CAAC;EAClD,CAAC,CAAC,MAAM;IACN;IACA,OAAO,KAAK;EACd;AACF;AAiCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeK,mBAAmBA,CAACC,IAAgC,EAAiB;EACzF,MAAM;IACJC,WAAW;IACXC,SAAS;IACTC,QAAQ;IACRC,eAAe;IACfC,WAAW,GAAG,SAAS;IACvBC,QAAQ;IACRC,aAAa;IACbC,0BAA0B;IAC1BC,aAAa;IACbC,gBAAgB;IAChBC;EACF,CAAC,GAAGX,IAAI;EAER,MAAMY,aAAa,GAAGP,WAAW,KAAK,UAAU;EAEhDM,aAAa,CAAC,KAAK,CAAC;EAEpB,IAAI;IACF;IACA;IACA;IACA;IACA,MAAME,cAAc,GAAG,CAAC,YACtBb,IAAI,CAACc,kBAAkB,GAAG,CAAC,IAAI,IAAAC,qDAA6B,EAACd,WAAW,EAAEE,QAAQ,CAAC,EAAE,CAAC;IACxF;IACA;IACAU,cAAc,CAACG,KAAK,CAAC,MAAMC,SAAS,CAAC;;IAErC;IACA;IACA;IACA;IACA;IACA;IACA,IAAI,CAACL,aAAa,IAAI,IAAA1B,0BAAY,EAAC,CAAC,IAAI,CAAClB,mBAAmB,CAAC,CAAC,EAAE;MAC9D,IAAI,EAAE,MAAMM,kBAAkB,CAAC4B,SAAS,CAAC,CAAC,EAAE;QAC1CQ,gBAAgB,CAAC,CAAC;QAClB,MAAMQ,IAAI,GAAG,MAAML,cAAc;QACjC,MAAMb,IAAI,CAACmB,YAAY,GAAGD,IAAI,CAAC;QAC/B,IAAIA,IAAI,KAAK,OAAO,EAAEP,aAAa,CAAC,IAAI,CAAC;QACzC;MACF;IACF;IAEA,MAAMO,IAAI,GAAG,MAAML,cAAc;IACjC,MAAMb,IAAI,CAACmB,YAAY,GAAGD,IAAI,CAAC;IAC/B,IAAIN,aAAa,IAAIM,IAAI,KAAK,QAAQ,EAAE;IACxC;IACA;IACA;IACA;IACA;IACA;IACA,MAAME,cAAc,GAAGR,aAAa,GAChC,KAAK,GACL,MAAM,IAAAS,mCAAsB,EAAC;MAC3BpB,WAAW;MACXE,QAAQ;MACRC,eAAe;MACfK,aAAa,EAAGa,KAAK,IAAKb,aAAa,CAACa,KAAK,EAAE;QAAEC,QAAQ,EAAE,IAAI;QAAEC,KAAK,EAAE;MAAK,CAAC;IAChF,CAAC,CAAC;IACN,IAAIJ,cAAc,EAAE;MAClBT,aAAa,CAAC,IAAI,CAAC;MACnBD,gBAAgB,CAAC,CAAC;MAClB;IACF;IAEA,IAAIQ,IAAI,KAAK,OAAO,EAAE;MACpBP,aAAa,CAAC,IAAI,CAAC;MACnB;IACF;IAEA,MAAMX,IAAI,CAACyB,gBAAgB,GAAG,CAAC;;IAE/B;IACA;IACA;IACA;IACA,MAAMC,OAAO,GAAG,MAAMzC,iBAAiB,CAAC,CAAC;IAEzC,MAAM,IAAA0C,2BAAkB,EAAC;MACvBC,GAAG,EAAE3B,WAAW;MAChB1B,KAAK,EAAE2B,SAAS;MAChB2B,QAAQ,EAAE;QAAEC,KAAK,EAAE,IAAA5C,0BAAY,EAAC,CAAC;QAAE6C,QAAQ,EAAE,CAAC,IAAA7C,0BAAY,EAAC;MAAE,CAAC;MAC9DmB,WAAW;MACXC,QAAQ;MACR;MACA;MACA;MACA;MACA;MACA0B,sBAAsB,EAAE,IAAAC,sEAAyC,EAAC,CAAC,IAAIhB,SAAS;MAChFiB,iBAAiB,EAAEnD,6BAA6B;MAChDoD,SAAS,EAAEA,CAAA,KAAMT,OAAO;MACxBU,cAAc,EAAGC,MAAM,IAAK;QAC1BC,YAAU,CAACC,IAAI,CACb,mBAAmBF,MAAM,kBAAkBtD,6BAA6B,8DAA8D,EACtI;UAAEyD,SAAS,EAAE,qBAAqB;UAAEC,MAAM,EAAE;QAAiB,CAC/D,CAAC;MACH,CAAC;MACDC,SAAS,EAAE,MAAOC,OAAO,IAAK;QAC5B;QACA;QACA,MAAMnC,0BAA0B,CAAC,CAAC;QAClC,MAAMoC,OAAO,GAAGnC,aAAa,CAC3B;UACEoC,SAAS,EAAEF,OAAO,CAACE,SAAS;UAC5BlE,WAAW,EAAEgE,OAAO,CAAChE,WAAW;UAChCmE,MAAM,EAAEH,OAAO,CAACG,MAAM;UACtBC,WAAW,EAAEJ,OAAO,CAACjD;QACvB,CAAC,EACD;UAAE6B,QAAQ,EAAE;QAAM,CACpB,CAAC;QACD,IAAIyB,iBAA4D;QAChE,MAAMzD,OAAO,CAACI,IAAI,CAAC,CACjBiD,OAAO,EACP,IAAIrD,OAAO,CAAQC,OAAO,IAAK;UAC7BwD,iBAAiB,GAAGnD,UAAU,CAACL,OAAO,EAAEX,2BAA2B,CAAC;QACtE,CAAC,CAAC,CACH,CAAC,CAACoE,OAAO,CAAC,MAAM;UACf,IAAID,iBAAiB,KAAK/B,SAAS,EAAE;YACnCiC,YAAY,CAACF,iBAAiB,CAAC;UACjC;QACF,CAAC,CAAC;QACFtC,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACDyC,WAAW,EAAE,MAAAA,CAAA,KAAY;QACvB,MAAM3C,0BAA0B,CAAC,CAAC;QAClC,MAAM4C,IAAI,GAAG,MAAM,IAAAC,+CAA6B,EAACnD,SAAS,CAAC;QAC3D,IAAIkD,IAAI,EAAE;UACR,IAAI;YACF,MAAM7C,aAAa,CAAC+C,KAAK,CAAC,CAAC;UAC7B,CAAC,CAAC,OAAOC,WAAW,EAAE;YACpB,IAAIC,OAAO,EAAE;cACXlB,YAAU,CAACmB,KAAK,CACd,wCAAwC,EACxC;gBAAEjB,SAAS,EAAE;cAAsB,CAAC,EACpCe,WACF,CAAC;YACH;UACF;QACF;QACA7C,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACDgD,WAAW,EAAEA,CAACC,EAAE,EAAEC,KAAK,KAAK;QAC1B,IAAIJ,OAAO,EAAE;UACXlB,YAAU,CAACmB,KAAK,CACd,mBAAmBE,EAAE,wCAAwC,EAC7D;YAAEnB,SAAS,EAAE;UAAsB,CAAC,EACpCoB,KACF,CAAC;QACH;MACF;IACF,CAAC,CAAC;IACF,MAAM5D,IAAI,CAAC6D,eAAe,GAAG,CAAC;EAChC,CAAC,CAAC,OAAOD,KAAK,EAAE;IACd,IAAIJ,OAAO,EAAE;MACXlB,YAAU,CAACsB,KAAK,CACd,iBAAiB,EACjBA,KAAK,YAAYE,KAAK,GAAGF,KAAK,GAAG,IAAIE,KAAK,CAACC,MAAM,CAACH,KAAK,CAAC,CAAC,EACzD;QAAEpB,SAAS,EAAE;MAAsB,CACrC,CAAC;IACH;EACF,CAAC,SAAS;IACR9B,gBAAgB,CAAC,CAAC;EACpB;AACF","ignoreList":[]}
|
|
@@ -8,6 +8,28 @@ import { createPlatformSharedDeviceCredentialStore } from "../session/sharedDevi
|
|
|
8
8
|
import { tryCompleteOAuthReturn } from "../utils/oauthReturn.js";
|
|
9
9
|
import { isWebBrowser } from "../utils/isWebBrowser.js";
|
|
10
10
|
import { isNetConnectivityExplicitlyOffline } from "../utils/netConnectivity.js";
|
|
11
|
+
/**
|
|
12
|
+
* Whether the URL carries an OAuth return (`?code=` or `?error=`) for
|
|
13
|
+
* `tryCompleteOAuthReturn` to consume. Reads the address bar only.
|
|
14
|
+
*/
|
|
15
|
+
function hasOAuthReturnOnUrl() {
|
|
16
|
+
const search = globalThis.location?.search;
|
|
17
|
+
if (!search) return false;
|
|
18
|
+
const params = new URLSearchParams(search);
|
|
19
|
+
return params.has('code') || params.has('error');
|
|
20
|
+
}
|
|
21
|
+
|
|
22
|
+
/**
|
|
23
|
+
* Whether this origin's own store holds anything a web boot could restore from:
|
|
24
|
+
* a warm access token to plant or a device secret to mint with. A presence
|
|
25
|
+
* check only — nothing read here is used, sent or synced before the
|
|
26
|
+
* classification allows it.
|
|
27
|
+
*/
|
|
28
|
+
async function hasRestorableState(store) {
|
|
29
|
+
const persisted = await store.load();
|
|
30
|
+
return Boolean(persisted?.accessToken || persisted?.deviceSecret);
|
|
31
|
+
}
|
|
32
|
+
|
|
11
33
|
/** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
|
|
12
34
|
export const SESSION_HANDOFF_DEADLINE_MS = 6000;
|
|
13
35
|
|
|
@@ -95,9 +117,31 @@ export async function runProviderColdBoot(opts) {
|
|
|
95
117
|
const identityBound = sessionMode === 'identity';
|
|
96
118
|
setTokenReady(false);
|
|
97
119
|
try {
|
|
98
|
-
// Classification precedes every local
|
|
99
|
-
//
|
|
100
|
-
|
|
120
|
+
// Classification precedes every USE of a local secret, the shared credential
|
|
121
|
+
// and the identity key. Unavailable registry metadata fails closed, including
|
|
122
|
+
// offline boot. It starts now, before anything else, so its round trip
|
|
123
|
+
// overlaps the local work below.
|
|
124
|
+
const classification = (async () => opts.resolveSessionLane?.() ?? resolveApplicationSessionLane(oxyServices, clientId))();
|
|
125
|
+
// Observed so a rejection that lands before it is awaited is not reported as
|
|
126
|
+
// unhandled; every path below still awaits it and sees the rejection.
|
|
127
|
+
classification.catch(() => undefined);
|
|
128
|
+
|
|
129
|
+
// The verdict decides HOW a session is restored, never WHETHER there is one.
|
|
130
|
+
// A web origin with nothing to restore and no OAuth return on the URL ends
|
|
131
|
+
// signed out on either lane, so routing need not wait a network round trip
|
|
132
|
+
// for an answer that cannot change the outcome. The classification still
|
|
133
|
+
// completes below and still gates every later sign-in
|
|
134
|
+
// (`ensureDeviceSessionLane` shares this same in-flight lookup).
|
|
135
|
+
if (!identityBound && isWebBrowser() && !hasOAuthReturnOnUrl()) {
|
|
136
|
+
if (!(await hasRestorableState(authStore))) {
|
|
137
|
+
markAuthResolved();
|
|
138
|
+
const lane = await classification;
|
|
139
|
+
await opts.onClassified?.(lane);
|
|
140
|
+
if (lane === 'oauth') setTokenReady(true);
|
|
141
|
+
return;
|
|
142
|
+
}
|
|
143
|
+
}
|
|
144
|
+
const lane = await classification;
|
|
101
145
|
await opts.onClassified?.(lane);
|
|
102
146
|
if (identityBound && lane !== 'device') return;
|
|
103
147
|
// The redirect transport's RETURN leg. An app reaches it whenever the browser
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["resolveApplicationSessionLane","logger","loggerUtil","runSessionColdBoot","loadPersistedDeviceCredential","createPlatformSharedDeviceCredentialStore","tryCompleteOAuthReturn","isWebBrowser","isNetConnectivityExplicitlyOffline","SESSION_HANDOFF_DEADLINE_MS","COLD_BOOT_OVERALL_DEADLINE_MS","OFFLINE_PROBE_TIMEOUT_MS","detectOfflineHint","online","
|
|
1
|
+
{"version":3,"names":["resolveApplicationSessionLane","logger","loggerUtil","runSessionColdBoot","loadPersistedDeviceCredential","createPlatformSharedDeviceCredentialStore","tryCompleteOAuthReturn","isWebBrowser","isNetConnectivityExplicitlyOffline","hasOAuthReturnOnUrl","search","globalThis","location","params","URLSearchParams","has","hasRestorableState","store","persisted","load","Boolean","accessToken","deviceSecret","SESSION_HANDOFF_DEADLINE_MS","COLD_BOOT_OVERALL_DEADLINE_MS","OFFLINE_PROBE_TIMEOUT_MS","detectOfflineHint","online","navigator","onLine","NetInfo","state","Promise","race","default","fetch","resolve","setTimeout","runProviderColdBoot","opts","oxyServices","authStore","clientId","authRedirectUri","sessionMode","identity","sessionClient","syncDeviceCredentialToHost","commitSession","markAuthResolved","setTokenReady","identityBound","classification","resolveSessionLane","catch","undefined","lane","onClassified","oauthCompleted","input","activate","oauth","beforeDeviceBoot","offline","oxy","platform","isWeb","isNative","sharedDeviceCredential","overallDeadlineMs","isOffline","onStepDeadline","stepId","warn","component","method","onSession","session","handoff","sessionId","userId","deviceState","handoffDeadlineId","finally","clearTimeout","onSignedOut","cred","start","socketError","__DEV__","debug","onStepError","id","error","afterDeviceBoot","Error","String"],"sourceRoot":"../../../../src","sources":["ui/boot/runProviderColdBoot.ts"],"mappings":";;AAAA,SAASA,6BAA6B,QAAQ,oCAAiC;AAC/E,SAASC,MAAM,IAAIC,UAAU,QAA0B,cAAc;AACrE,SACEC,kBAAkB,QAIb,sBAAsB;AAE7B,SAASC,6BAA6B,QAAQ,8BAA2B;AACzE,SAASC,yCAAyC,QAAQ,2CAAwC;AAClG,SAASC,sBAAsB,QAAQ,yBAAsB;AAC7D,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SAASC,kCAAkC,QAAQ,6BAA0B;AAG7E;AACA;AACA;AACA;AACA,SAASC,mBAAmBA,CAAA,EAAY;EACtC,MAAMC,MAAM,GAAIC,UAAU,CAAwCC,QAAQ,EAAEF,MAAM;EAClF,IAAI,CAACA,MAAM,EAAE,OAAO,KAAK;EACzB,MAAMG,MAAM,GAAG,IAAIC,eAAe,CAACJ,MAAM,CAAC;EAC1C,OAAOG,MAAM,CAACE,GAAG,CAAC,MAAM,CAAC,IAAIF,MAAM,CAACE,GAAG,CAAC,OAAO,CAAC;AAClD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,kBAAkBA,CAACC,KAAqB,EAAoB;EACzE,MAAMC,SAAS,GAAG,MAAMD,KAAK,CAACE,IAAI,CAAC,CAAC;EACpC,OAAOC,OAAO,CAACF,SAAS,EAAEG,WAAW,IAAIH,SAAS,EAAEI,YAAY,CAAC;AACnE;;AAEA;AACA,OAAO,MAAMC,2BAA2B,GAAG,IAAI;;AAE/C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,6BAA6B,GAAG,MAAM;;AAEnD;AACA;AACA;AACA;AACA;AACA,MAAMC,wBAAwB,GAAG,GAAG;;AAEpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAqB;EACnD,IAAI;IACF,IAAInB,YAAY,CAAC,CAAC,EAAE;MAClB,MAAMoB,MAAM,GAAIhB,UAAU,CAA0CiB,SAAS,EAAEC,MAAM;MACrF;MACA,OAAOF,MAAM,KAAK,KAAK;IACzB;IACA,MAAMG,OAAO,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC;IAC/D,MAAMC,KAAK,GAAG,MAAMC,OAAO,CAACC,IAAI,CAAC,CAC/BH,OAAO,CAACI,OAAO,CAACC,KAAK,CAAC,CAAC,EACvB,IAAIH,OAAO,CAAQI,OAAO,IAAK;MAC7BC,UAAU,CAAC,MAAMD,OAAO,CAAC,IAAI,CAAC,EAAEX,wBAAwB,CAAC;IAC3D,CAAC,CAAC,CACH,CAAC;IACF;IACA;IACA,OAAOjB,kCAAkC,CAACuB,KAAK,CAAC;EAClD,CAAC,CAAC,MAAM;IACN;IACA,OAAO,KAAK;EACd;AACF;AAiCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeO,mBAAmBA,CAACC,IAAgC,EAAiB;EACzF,MAAM;IACJC,WAAW;IACXC,SAAS;IACTC,QAAQ;IACRC,eAAe;IACfC,WAAW,GAAG,SAAS;IACvBC,QAAQ;IACRC,aAAa;IACbC,0BAA0B;IAC1BC,aAAa;IACbC,gBAAgB;IAChBC;EACF,CAAC,GAAGX,IAAI;EAER,MAAMY,aAAa,GAAGP,WAAW,KAAK,UAAU;EAEhDM,aAAa,CAAC,KAAK,CAAC;EAEpB,IAAI;IACF;IACA;IACA;IACA;IACA,MAAME,cAAc,GAAG,CAAC,YACtBb,IAAI,CAACc,kBAAkB,GAAG,CAAC,IAAIrD,6BAA6B,CAACwC,WAAW,EAAEE,QAAQ,CAAC,EAAE,CAAC;IACxF;IACA;IACAU,cAAc,CAACE,KAAK,CAAC,MAAMC,SAAS,CAAC;;IAErC;IACA;IACA;IACA;IACA;IACA;IACA,IAAI,CAACJ,aAAa,IAAI5C,YAAY,CAAC,CAAC,IAAI,CAACE,mBAAmB,CAAC,CAAC,EAAE;MAC9D,IAAI,EAAE,MAAMO,kBAAkB,CAACyB,SAAS,CAAC,CAAC,EAAE;QAC1CQ,gBAAgB,CAAC,CAAC;QAClB,MAAMO,IAAI,GAAG,MAAMJ,cAAc;QACjC,MAAMb,IAAI,CAACkB,YAAY,GAAGD,IAAI,CAAC;QAC/B,IAAIA,IAAI,KAAK,OAAO,EAAEN,aAAa,CAAC,IAAI,CAAC;QACzC;MACF;IACF;IAEA,MAAMM,IAAI,GAAG,MAAMJ,cAAc;IACjC,MAAMb,IAAI,CAACkB,YAAY,GAAGD,IAAI,CAAC;IAC/B,IAAIL,aAAa,IAAIK,IAAI,KAAK,QAAQ,EAAE;IACxC;IACA;IACA;IACA;IACA;IACA;IACA,MAAME,cAAc,GAAGP,aAAa,GAChC,KAAK,GACL,MAAM7C,sBAAsB,CAAC;MAC3BkC,WAAW;MACXE,QAAQ;MACRC,eAAe;MACfK,aAAa,EAAGW,KAAK,IAAKX,aAAa,CAACW,KAAK,EAAE;QAAEC,QAAQ,EAAE,IAAI;QAAEC,KAAK,EAAE;MAAK,CAAC;IAChF,CAAC,CAAC;IACN,IAAIH,cAAc,EAAE;MAClBR,aAAa,CAAC,IAAI,CAAC;MACnBD,gBAAgB,CAAC,CAAC;MAClB;IACF;IAEA,IAAIO,IAAI,KAAK,OAAO,EAAE;MACpBN,aAAa,CAAC,IAAI,CAAC;MACnB;IACF;IAEA,MAAMX,IAAI,CAACuB,gBAAgB,GAAG,CAAC;;IAE/B;IACA;IACA;IACA;IACA,MAAMC,OAAO,GAAG,MAAMrC,iBAAiB,CAAC,CAAC;IAEzC,MAAMvB,kBAAkB,CAAC;MACvB6D,GAAG,EAAExB,WAAW;MAChBvB,KAAK,EAAEwB,SAAS;MAChBwB,QAAQ,EAAE;QAAEC,KAAK,EAAE3D,YAAY,CAAC,CAAC;QAAE4D,QAAQ,EAAE,CAAC5D,YAAY,CAAC;MAAE,CAAC;MAC9DqC,WAAW;MACXC,QAAQ;MACR;MACA;MACA;MACA;MACA;MACAuB,sBAAsB,EAAE/D,yCAAyC,CAAC,CAAC,IAAIkD,SAAS;MAChFc,iBAAiB,EAAE7C,6BAA6B;MAChD8C,SAAS,EAAEA,CAAA,KAAMP,OAAO;MACxBQ,cAAc,EAAGC,MAAM,IAAK;QAC1BtE,UAAU,CAACuE,IAAI,CACb,mBAAmBD,MAAM,kBAAkBhD,6BAA6B,8DAA8D,EACtI;UAAEkD,SAAS,EAAE,qBAAqB;UAAEC,MAAM,EAAE;QAAiB,CAC/D,CAAC;MACH,CAAC;MACDC,SAAS,EAAE,MAAOC,OAAO,IAAK;QAC5B;QACA;QACA,MAAM9B,0BAA0B,CAAC,CAAC;QAClC,MAAM+B,OAAO,GAAG9B,aAAa,CAC3B;UACE+B,SAAS,EAAEF,OAAO,CAACE,SAAS;UAC5B1D,WAAW,EAAEwD,OAAO,CAACxD,WAAW;UAChC2D,MAAM,EAAEH,OAAO,CAACG,MAAM;UACtBC,WAAW,EAAEJ,OAAO,CAAC9C;QACvB,CAAC,EACD;UAAE6B,QAAQ,EAAE;QAAM,CACpB,CAAC;QACD,IAAIsB,iBAA4D;QAChE,MAAMlD,OAAO,CAACC,IAAI,CAAC,CACjB6C,OAAO,EACP,IAAI9C,OAAO,CAAQI,OAAO,IAAK;UAC7B8C,iBAAiB,GAAG7C,UAAU,CAACD,OAAO,EAAEb,2BAA2B,CAAC;QACtE,CAAC,CAAC,CACH,CAAC,CAAC4D,OAAO,CAAC,MAAM;UACf,IAAID,iBAAiB,KAAK3B,SAAS,EAAE;YACnC6B,YAAY,CAACF,iBAAiB,CAAC;UACjC;QACF,CAAC,CAAC;QACFjC,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACDoC,WAAW,EAAE,MAAAA,CAAA,KAAY;QACvB,MAAMtC,0BAA0B,CAAC,CAAC;QAClC,MAAMuC,IAAI,GAAG,MAAMlF,6BAA6B,CAACqC,SAAS,CAAC;QAC3D,IAAI6C,IAAI,EAAE;UACR,IAAI;YACF,MAAMxC,aAAa,CAACyC,KAAK,CAAC,CAAC;UAC7B,CAAC,CAAC,OAAOC,WAAW,EAAE;YACpB,IAAIC,OAAO,EAAE;cACXvF,UAAU,CAACwF,KAAK,CACd,wCAAwC,EACxC;gBAAEhB,SAAS,EAAE;cAAsB,CAAC,EACpCc,WACF,CAAC;YACH;UACF;QACF;QACAvC,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACD0C,WAAW,EAAEA,CAACC,EAAE,EAAEC,KAAK,KAAK;QAC1B,IAAIJ,OAAO,EAAE;UACXvF,UAAU,CAACwF,KAAK,CACd,mBAAmBE,EAAE,wCAAwC,EAC7D;YAAElB,SAAS,EAAE;UAAsB,CAAC,EACpCmB,KACF,CAAC;QACH;MACF;IACF,CAAC,CAAC;IACF,MAAMtD,IAAI,CAACuD,eAAe,GAAG,CAAC;EAChC,CAAC,CAAC,OAAOD,KAAK,EAAE;IACd,IAAIJ,OAAO,EAAE;MACXvF,UAAU,CAAC2F,KAAK,CACd,iBAAiB,EACjBA,KAAK,YAAYE,KAAK,GAAGF,KAAK,GAAG,IAAIE,KAAK,CAACC,MAAM,CAACH,KAAK,CAAC,CAAC,EACzD;QAAEnB,SAAS,EAAE;MAAsB,CACrC,CAAC;IACH;EACF,CAAC,SAAS;IACRzB,gBAAgB,CAAC,CAAC;EACpB;AACF","ignoreList":[]}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runProviderColdBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/boot/runProviderColdBoot.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAM1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"runProviderColdBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/boot/runProviderColdBoot.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAM1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAwB9D,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AA0CpD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC;IACvD,0EAA0E;IAC1E,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,EAAE,CACb,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAwKzF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runProviderColdBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/boot/runProviderColdBoot.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAM1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"runProviderColdBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/boot/runProviderColdBoot.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAM1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA4B,CAAC;AAwB9D,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AA0CpD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC;IACvD,0EAA0E;IAC1E,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,EAAE,CACb,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAwKzF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@oxy.so/services",
|
|
3
|
-
"version": "11.3.
|
|
3
|
+
"version": "11.3.1",
|
|
4
4
|
"description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
|
|
5
5
|
"main": "lib/commonjs/index.js",
|
|
6
6
|
"module": "lib/module/index.js",
|
|
@@ -162,7 +162,7 @@
|
|
|
162
162
|
"@commitlint/cli": "^21.2.1",
|
|
163
163
|
"@commitlint/config-conventional": "^21.2.0",
|
|
164
164
|
"@expo/vector-icons": "^15.0.3",
|
|
165
|
-
"@oxy.so/core": "4.
|
|
165
|
+
"@oxy.so/core": "4.9.1",
|
|
166
166
|
"@react-native-async-storage/async-storage": "^2.0.0",
|
|
167
167
|
"@react-native-community/netinfo": "^12.0.1",
|
|
168
168
|
"@react-native/babel-preset": "^0.86.2",
|
|
@@ -215,7 +215,7 @@
|
|
|
215
215
|
"peerDependencies": {
|
|
216
216
|
"@expo/vector-icons": "^15.0.3",
|
|
217
217
|
"@oxy.so/bloom": ">=6.2.1 <6.3.0 || >=7.1.2 <7.2.0 || >=7.7.0 <7.8.0 || >=7.13.1 <7.34.0 || >=8.0.0 <8.2.0 || >=9.0.0 <9.1.0 || >=10.0.0",
|
|
218
|
-
"@oxy.so/core": "4.
|
|
218
|
+
"@oxy.so/core": "4.9.1",
|
|
219
219
|
"@react-native-async-storage/async-storage": "^2.0.0",
|
|
220
220
|
"@react-native-community/netinfo": ">=11.4.1 <13.0.0",
|
|
221
221
|
"@tanstack/query-async-storage-persister": "^5.101",
|
|
@@ -63,6 +63,22 @@ function makeEmptyAuthStore(): AuthStateStore {
|
|
|
63
63
|
} as unknown as AuthStateStore;
|
|
64
64
|
}
|
|
65
65
|
|
|
66
|
+
/** An auth store holding this origin's device credential. */
|
|
67
|
+
function makeCredentialAuthStore(): AuthStateStore {
|
|
68
|
+
return {
|
|
69
|
+
load: jest.fn(
|
|
70
|
+
async (): Promise<PersistedAuthState | null> => ({ deviceId: 'd1', deviceSecret: 's1' }),
|
|
71
|
+
),
|
|
72
|
+
save: jest.fn(async () => undefined),
|
|
73
|
+
clear: jest.fn(async () => undefined),
|
|
74
|
+
} as unknown as AuthStateStore;
|
|
75
|
+
}
|
|
76
|
+
|
|
77
|
+
/** Put an OAuth return (`?code=`) on the address bar, as the IdP's redirect does. */
|
|
78
|
+
function landWithAuthorizationCode(): void {
|
|
79
|
+
window.history.replaceState(null, '', '/?code=auth-code&state=auth-state');
|
|
80
|
+
}
|
|
81
|
+
|
|
66
82
|
interface Harness {
|
|
67
83
|
options: RunProviderColdBootOptions;
|
|
68
84
|
commitSession: jest.Mock;
|
|
@@ -120,6 +136,7 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
|
|
|
120
136
|
mockTryCompleteOAuthReturn.mockClear();
|
|
121
137
|
mockTryCompleteOAuthReturn.mockImplementation(async () => false);
|
|
122
138
|
globalThis.sessionStorage?.clear();
|
|
139
|
+
window.history.replaceState(null, '', '/');
|
|
123
140
|
});
|
|
124
141
|
|
|
125
142
|
it('resolves a domain with no local credential SIGNED OUT instead of bouncing to the IdP', async () => {
|
|
@@ -160,7 +177,7 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
|
|
|
160
177
|
return { kind: 'session', via: session.via, session } as const;
|
|
161
178
|
},
|
|
162
179
|
);
|
|
163
|
-
const { options, commitSession } = makeHarness();
|
|
180
|
+
const { options, commitSession } = makeHarness({ authStore: makeCredentialAuthStore() });
|
|
164
181
|
|
|
165
182
|
await runProviderColdBoot(options);
|
|
166
183
|
|
|
@@ -176,6 +193,7 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
|
|
|
176
193
|
// A popup-mode app lands here whenever the browser blocked the popup and
|
|
177
194
|
// `startWebOAuthSignIn` fell back to a full-page redirect.
|
|
178
195
|
mockTryCompleteOAuthReturn.mockImplementation(async () => true);
|
|
196
|
+
landWithAuthorizationCode();
|
|
179
197
|
const { options, markAuthResolved, setTokenReady } = makeHarness();
|
|
180
198
|
|
|
181
199
|
await runProviderColdBoot(options);
|
|
@@ -190,6 +208,7 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
|
|
|
190
208
|
|
|
191
209
|
it('runs the return leg even on a boot that finds no session', async () => {
|
|
192
210
|
stubSignedOutBoot();
|
|
211
|
+
landWithAuthorizationCode();
|
|
193
212
|
const { options } = makeHarness();
|
|
194
213
|
|
|
195
214
|
await runProviderColdBoot(options);
|
|
@@ -199,6 +218,7 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
|
|
|
199
218
|
|
|
200
219
|
it('commits the OAuth return as a deliberate sign-in', async () => {
|
|
201
220
|
mockTryCompleteOAuthReturn.mockImplementation(async () => true);
|
|
221
|
+
landWithAuthorizationCode();
|
|
202
222
|
const { options } = makeHarness();
|
|
203
223
|
|
|
204
224
|
await runProviderColdBoot(options);
|
|
@@ -225,14 +245,22 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
|
|
|
225
245
|
});
|
|
226
246
|
});
|
|
227
247
|
|
|
248
|
+
// Each case lands with an OAuth return on the URL — the boot that must classify
|
|
249
|
+
// before it does anything — so "nothing ran first" is a real claim. The web
|
|
250
|
+
// origin with nothing to restore, which resolves before classification, is
|
|
251
|
+
// covered on its own below.
|
|
228
252
|
describe('registered cold-boot classification', () => {
|
|
229
253
|
beforeEach(() => {
|
|
230
254
|
mockRunSessionColdBoot.mockReset();
|
|
231
255
|
mockTryCompleteOAuthReturn.mockReset();
|
|
232
256
|
mockTryCompleteOAuthReturn.mockResolvedValue(false);
|
|
257
|
+
landWithAuthorizationCode();
|
|
258
|
+
});
|
|
259
|
+
afterEach(() => {
|
|
260
|
+
window.history.replaceState(null, '', '/');
|
|
233
261
|
});
|
|
234
262
|
it('external classification bypasses prior secrets, shared device and identity pin work', async () => {
|
|
235
|
-
const { options } = makeHarness();
|
|
263
|
+
const { options } = makeHarness({ authStore: makeCredentialAuthStore() });
|
|
236
264
|
(options.oxyServices.apps.getPublic as jest.Mock).mockResolvedValue({
|
|
237
265
|
id: 'external',
|
|
238
266
|
name: 'External',
|
|
@@ -298,8 +326,9 @@ describe('registered cold-boot classification', () => {
|
|
|
298
326
|
|
|
299
327
|
it('an unresponsive registry resolves signed-out without a late privileged continuation', async () => {
|
|
300
328
|
jest.useFakeTimers();
|
|
329
|
+
landWithAuthorizationCode();
|
|
301
330
|
try {
|
|
302
|
-
const { options } = makeHarness();
|
|
331
|
+
const { options } = makeHarness({ authStore: makeCredentialAuthStore() });
|
|
303
332
|
let release!: (app: unknown) => void;
|
|
304
333
|
(options.oxyServices.apps.getPublic as jest.Mock).mockImplementation(
|
|
305
334
|
() =>
|
|
@@ -327,5 +356,139 @@ it('an unresponsive registry resolves signed-out without a late privileged conti
|
|
|
327
356
|
expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
|
|
328
357
|
} finally {
|
|
329
358
|
jest.useRealTimers();
|
|
359
|
+
window.history.replaceState(null, '', '/');
|
|
330
360
|
}
|
|
331
361
|
});
|
|
362
|
+
|
|
363
|
+
/**
|
|
364
|
+
* A web origin with nothing to restore — no warm token, no device secret, no
|
|
365
|
+
* OAuth return on the URL — ends signed out on either lane, so its routing does
|
|
366
|
+
* not wait on the registry round trip. Everything that would USE a credential
|
|
367
|
+
* still waits for the verdict.
|
|
368
|
+
*/
|
|
369
|
+
describe('web origin with nothing to restore', () => {
|
|
370
|
+
const official = {
|
|
371
|
+
id: 'registered-app',
|
|
372
|
+
name: 'Registered App',
|
|
373
|
+
type: 'first_party',
|
|
374
|
+
isOfficial: true,
|
|
375
|
+
isInternal: false,
|
|
376
|
+
scopes: [],
|
|
377
|
+
};
|
|
378
|
+
|
|
379
|
+
beforeEach(() => {
|
|
380
|
+
mockRunSessionColdBoot.mockReset();
|
|
381
|
+
mockTryCompleteOAuthReturn.mockReset();
|
|
382
|
+
mockTryCompleteOAuthReturn.mockResolvedValue(false);
|
|
383
|
+
window.history.replaceState(null, '', '/');
|
|
384
|
+
});
|
|
385
|
+
|
|
386
|
+
function pendingRegistry(options: RunProviderColdBootOptions): (app: unknown) => void {
|
|
387
|
+
let release!: (app: unknown) => void;
|
|
388
|
+
(options.oxyServices.apps.getPublic as jest.Mock).mockImplementation(
|
|
389
|
+
() =>
|
|
390
|
+
new Promise((resolve) => {
|
|
391
|
+
release = resolve;
|
|
392
|
+
}),
|
|
393
|
+
);
|
|
394
|
+
return (app) => release(app);
|
|
395
|
+
}
|
|
396
|
+
|
|
397
|
+
it('resolves auth before the registry answers, and still classifies with no cache', async () => {
|
|
398
|
+
const { options, markAuthResolved } = makeHarness();
|
|
399
|
+
const onClassified = jest.fn();
|
|
400
|
+
const release = pendingRegistry(options);
|
|
401
|
+
|
|
402
|
+
const boot = runProviderColdBoot({ ...options, onClassified });
|
|
403
|
+
await new Promise((resolve) => setTimeout(resolve, 0));
|
|
404
|
+
|
|
405
|
+
expect(markAuthResolved).toHaveBeenCalled();
|
|
406
|
+
expect(options.oxyServices.apps.getPublic).toHaveBeenCalledWith(CLIENT_ID, { cache: false });
|
|
407
|
+
expect(onClassified).not.toHaveBeenCalled();
|
|
408
|
+
|
|
409
|
+
release(official);
|
|
410
|
+
await boot;
|
|
411
|
+
|
|
412
|
+
expect(onClassified).toHaveBeenCalledWith('device');
|
|
413
|
+
expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
|
|
414
|
+
expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
|
|
415
|
+
expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
|
|
416
|
+
expect(options.commitSession).not.toHaveBeenCalled();
|
|
417
|
+
});
|
|
418
|
+
|
|
419
|
+
it('a failed classification after the early resolution restores nothing', async () => {
|
|
420
|
+
const { options, markAuthResolved } = makeHarness();
|
|
421
|
+
(options.oxyServices.apps.getPublic as jest.Mock).mockRejectedValue(new Error('offline'));
|
|
422
|
+
|
|
423
|
+
await runProviderColdBoot(options);
|
|
424
|
+
|
|
425
|
+
expect(markAuthResolved).toHaveBeenCalled();
|
|
426
|
+
expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
|
|
427
|
+
expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
|
|
428
|
+
});
|
|
429
|
+
|
|
430
|
+
it('an origin holding a device secret still waits for the verdict before using it', async () => {
|
|
431
|
+
stubSignedOutBoot();
|
|
432
|
+
const { options, markAuthResolved } = makeHarness({ authStore: makeCredentialAuthStore() });
|
|
433
|
+
const release = pendingRegistry(options);
|
|
434
|
+
|
|
435
|
+
const boot = runProviderColdBoot(options);
|
|
436
|
+
await new Promise((resolve) => setTimeout(resolve, 0));
|
|
437
|
+
|
|
438
|
+
expect(markAuthResolved).not.toHaveBeenCalled();
|
|
439
|
+
expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
|
|
440
|
+
expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
|
|
441
|
+
|
|
442
|
+
release(official);
|
|
443
|
+
await boot;
|
|
444
|
+
|
|
445
|
+
expect(mockRunSessionColdBoot).toHaveBeenCalledTimes(1);
|
|
446
|
+
expect(markAuthResolved).toHaveBeenCalled();
|
|
447
|
+
});
|
|
448
|
+
|
|
449
|
+
it('an origin holding a device secret classified external never uses it', async () => {
|
|
450
|
+
const { options } = makeHarness({ authStore: makeCredentialAuthStore() });
|
|
451
|
+
(options.oxyServices.apps.getPublic as jest.Mock).mockResolvedValue({
|
|
452
|
+
...official,
|
|
453
|
+
type: 'third_party',
|
|
454
|
+
isOfficial: false,
|
|
455
|
+
});
|
|
456
|
+
|
|
457
|
+
await runProviderColdBoot(options);
|
|
458
|
+
|
|
459
|
+
expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
|
|
460
|
+
expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
|
|
461
|
+
expect(options.authStore.save).not.toHaveBeenCalled();
|
|
462
|
+
expect(options.authStore.clear).not.toHaveBeenCalled();
|
|
463
|
+
});
|
|
464
|
+
|
|
465
|
+
it('an OAuth return on the URL waits for the verdict', async () => {
|
|
466
|
+
landWithAuthorizationCode();
|
|
467
|
+
const { options, markAuthResolved } = makeHarness();
|
|
468
|
+
const release = pendingRegistry(options);
|
|
469
|
+
|
|
470
|
+
const boot = runProviderColdBoot(options);
|
|
471
|
+
await new Promise((resolve) => setTimeout(resolve, 0));
|
|
472
|
+
expect(markAuthResolved).not.toHaveBeenCalled();
|
|
473
|
+
expect(options.authStore.load).not.toHaveBeenCalled();
|
|
474
|
+
|
|
475
|
+
release(official);
|
|
476
|
+
await boot;
|
|
477
|
+
expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
|
|
478
|
+
window.history.replaceState(null, '', '/');
|
|
479
|
+
});
|
|
480
|
+
|
|
481
|
+
it('identity mode always waits for the verdict', async () => {
|
|
482
|
+
stubSignedOutBoot();
|
|
483
|
+
const { options, markAuthResolved } = makeHarness({ sessionMode: 'identity' });
|
|
484
|
+
const release = pendingRegistry(options);
|
|
485
|
+
|
|
486
|
+
const boot = runProviderColdBoot(options);
|
|
487
|
+
await new Promise((resolve) => setTimeout(resolve, 0));
|
|
488
|
+
expect(markAuthResolved).not.toHaveBeenCalled();
|
|
489
|
+
|
|
490
|
+
release(official);
|
|
491
|
+
await boot;
|
|
492
|
+
expect(markAuthResolved).toHaveBeenCalled();
|
|
493
|
+
});
|
|
494
|
+
});
|
|
@@ -14,6 +14,28 @@ import { isWebBrowser } from '../utils/isWebBrowser';
|
|
|
14
14
|
import { isNetConnectivityExplicitlyOffline } from '../utils/netConnectivity';
|
|
15
15
|
import type { CommitInput } from '../context/oxyContextTypes';
|
|
16
16
|
|
|
17
|
+
/**
|
|
18
|
+
* Whether the URL carries an OAuth return (`?code=` or `?error=`) for
|
|
19
|
+
* `tryCompleteOAuthReturn` to consume. Reads the address bar only.
|
|
20
|
+
*/
|
|
21
|
+
function hasOAuthReturnOnUrl(): boolean {
|
|
22
|
+
const search = (globalThis as { location?: { search?: string } }).location?.search;
|
|
23
|
+
if (!search) return false;
|
|
24
|
+
const params = new URLSearchParams(search);
|
|
25
|
+
return params.has('code') || params.has('error');
|
|
26
|
+
}
|
|
27
|
+
|
|
28
|
+
/**
|
|
29
|
+
* Whether this origin's own store holds anything a web boot could restore from:
|
|
30
|
+
* a warm access token to plant or a device secret to mint with. A presence
|
|
31
|
+
* check only — nothing read here is used, sent or synced before the
|
|
32
|
+
* classification allows it.
|
|
33
|
+
*/
|
|
34
|
+
async function hasRestorableState(store: AuthStateStore): Promise<boolean> {
|
|
35
|
+
const persisted = await store.load();
|
|
36
|
+
return Boolean(persisted?.accessToken || persisted?.deviceSecret);
|
|
37
|
+
}
|
|
38
|
+
|
|
17
39
|
/** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
|
|
18
40
|
export const SESSION_HANDOFF_DEADLINE_MS = 6000;
|
|
19
41
|
|
|
@@ -139,10 +161,33 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
|
|
|
139
161
|
setTokenReady(false);
|
|
140
162
|
|
|
141
163
|
try {
|
|
142
|
-
// Classification precedes every local
|
|
143
|
-
//
|
|
144
|
-
|
|
145
|
-
|
|
164
|
+
// Classification precedes every USE of a local secret, the shared credential
|
|
165
|
+
// and the identity key. Unavailable registry metadata fails closed, including
|
|
166
|
+
// offline boot. It starts now, before anything else, so its round trip
|
|
167
|
+
// overlaps the local work below.
|
|
168
|
+
const classification = (async () =>
|
|
169
|
+
opts.resolveSessionLane?.() ?? resolveApplicationSessionLane(oxyServices, clientId))();
|
|
170
|
+
// Observed so a rejection that lands before it is awaited is not reported as
|
|
171
|
+
// unhandled; every path below still awaits it and sees the rejection.
|
|
172
|
+
classification.catch(() => undefined);
|
|
173
|
+
|
|
174
|
+
// The verdict decides HOW a session is restored, never WHETHER there is one.
|
|
175
|
+
// A web origin with nothing to restore and no OAuth return on the URL ends
|
|
176
|
+
// signed out on either lane, so routing need not wait a network round trip
|
|
177
|
+
// for an answer that cannot change the outcome. The classification still
|
|
178
|
+
// completes below and still gates every later sign-in
|
|
179
|
+
// (`ensureDeviceSessionLane` shares this same in-flight lookup).
|
|
180
|
+
if (!identityBound && isWebBrowser() && !hasOAuthReturnOnUrl()) {
|
|
181
|
+
if (!(await hasRestorableState(authStore))) {
|
|
182
|
+
markAuthResolved();
|
|
183
|
+
const lane = await classification;
|
|
184
|
+
await opts.onClassified?.(lane);
|
|
185
|
+
if (lane === 'oauth') setTokenReady(true);
|
|
186
|
+
return;
|
|
187
|
+
}
|
|
188
|
+
}
|
|
189
|
+
|
|
190
|
+
const lane = await classification;
|
|
146
191
|
await opts.onClassified?.(lane);
|
|
147
192
|
if (identityBound && lane !== 'device') return;
|
|
148
193
|
// The redirect transport's RETURN leg. An app reaches it whenever the browser
|