@oxy.so/services 12.14.0 → 13.0.0

package/src/ui/context/oxyContextTypes.ts

@@ -129,7 +129,8 @@ export interface OxyContextState {
 
   /**
    * Ask the already-authenticated user for explicit OAuth consent to exact
-   * application scopes. Must be called from a user gesture. Works on web and
+   * external application scopes. Own Oxy apps do not use this operation.
+   * Must be called from a user gesture. Works on web and
    * native and commits only a callback bound to the same user, state, PKCE pair
    * and byte-exact redirect URI.
    */

package/src/ui/oauth/__tests__/explicitOAuthConsent.test.ts

@@ -82,6 +82,23 @@ describe('requestOAuthConsent', () => {
     jest.restoreAllMocks();
   });
 
+  it.each(['first_party', 'internal', 'system'])(
+    'does not request consent for an own %s application',
+    async (type) => {
+      const context = makeContext('native');
+      const apps = context.oxyServices.apps.getPublic as jest.Mock;
+      apps.mockResolvedValue({ id: 'own-app', type, scopes: [...EXACT_SCOPES] });
+      expect(
+        await requestOAuthConsent(context, {
+          redirectUri: NATIVE_REDIRECT_URI,
+          scopes: EXACT_SCOPES,
+        }),
+      ).toEqual({ status: 'unsupported', reason: 'first-party-application' });
+      expect(openNative).not.toHaveBeenCalled();
+      expect(context.commitSession).not.toHaveBeenCalled();
+    },
+  );
+
   it('uses the existing web popup transport with exact scopes and redirect', async () => {
     const popup = fakePopup();
     jest.spyOn(window, 'open').mockReturnValue(popup as unknown as Window);

package/src/ui/oauth/explicitOAuthConsent.ts

@@ -1,11 +1,9 @@
 /**
  * Explicit OAuth consent for an already-authenticated Oxy user.
  *
- * This is deliberately separate from sign-in routing. First-party applications
- * normally use the account dialog, but a consent-required scope (for example
- * `acting-as:offline`) still has to go through the OAuth authorize surface. The
- * caller must invoke this operation from a real user gesture; it never runs on
- * mount, retries silently, or grants anything locally.
+ * External applications may request additional scopes through OAuth. Own Oxy
+ * applications use the account dialog and never create OAuth consent grants.
+ * The caller invokes this operation from a user gesture.
  */
 
 import type { OxyServices, PublicApplication } from "@oxy.so/core";
@@ -44,6 +42,7 @@ export type OAuthConsentFailureReason =
 
 export type OAuthConsentUnsupportedReason =
 	| "missing-client-id"
+	| "first-party-application"
 	| "identity-bound"
 	| "not-authenticated"
 	| "unsupported-platform";
@@ -173,6 +172,12 @@ export async function requestOAuthConsent(
 		return { status: "failed", reason: "client-resolution-failed" };
 	}
 
+	if (application.isOfficial || application.isInternal ||
+		["first_party", "internal", "system"].includes(application.type)) {
+		closeOAuthPopup(popup);
+		return { status: "unsupported", reason: "first-party-application" };
+	}
+
 	const configuredScopes = new Set(application.scopes);
 	if (options.scopes.some((scope) => !configuredScopes.has(scope))) {
 		closeOAuthPopup(popup);