@oxy.so/services 4.0.7 → 6.1.0

package/src/ui/components/signIn/passkeyError.ts

@@ -0,0 +1,44 @@
+/**
+ * The message for a failed passkey sign-in, and whether it was rate-limited.
+ *
+ * A dismissed or timed-out browser prompt rejects with a `NotAllowedError` /
+ * `AbortError` DOMException, often re-wrapped by `@simplewebauthn/browser` as a
+ * `WebAuthnError` whose `cause` is the original — so the cancellation shape is
+ * looked for along the cause chain, and reported calmly instead of as the raw
+ * "The operation either timed out or was not allowed…".
+ */
+
+import type { Translate } from '../authChooser/types';
+
+/** How long the surface waits after a 429 before it lets the person retry. */
+export const RATE_LIMIT_SECONDS = 60;
+
+function isCancellation(error: unknown): boolean {
+  let current: unknown = error;
+  for (let depth = 0; depth < 5 && current instanceof Error; depth += 1) {
+    if (current.name === 'NotAllowedError' || current.name === 'AbortError') return true;
+    // `@simplewebauthn/browser`'s stable code for an aborted ceremony.
+    if ((current as { code?: unknown }).code === 'ERROR_CEREMONY_ABORTED') return true;
+    current = (current as { cause?: unknown }).cause;
+  }
+  return false;
+}
+
+/** An HTTP status off a thrown SDK error (ApiError- or axios-shaped). */
+function errorStatus(error: unknown): number | undefined {
+  return (
+    (error as { status?: number } | undefined)?.status ??
+    (error as { response?: { status?: number } } | undefined)?.response?.status
+  );
+}
+
+export function isRateLimited(error: unknown): boolean {
+  return errorStatus(error) === 429;
+}
+
+/** The inline message for a passkey ceremony that did not sign anyone in. */
+export function describePasskeyError(error: unknown, t: Translate): string {
+  if (isCancellation(error)) return t('signin.errors.passkeyCancelled');
+  if (error instanceof Error && error.message.trim().length > 0) return error.message;
+  return t('signin.errors.passkeyFailed');
+}

package/src/ui/components/signIn/signInMethods.ts

@@ -0,0 +1,51 @@
+/**
+ * Which sign-in methods a surface offers, from where it runs.
+ *
+ * One screen everywhere; only the transport behind each block changes:
+ *
+ *  - auth.oxy.so (`page`) is where the web signs in: the embedded Commons QR
+ *    (the split card's right column from `md`, "Continue with Oxy" below it),
+ *    the username with its Continue, and the passkey — asserted right here,
+ *    on the one origin every Oxy passkey belongs to;
+ *  - an app's account dialog on the web (`dialog`) opens that screen in a
+ *    window over the app ("Continue with Oxy"), like "Sign in with Google":
+ *    the browser's session lives on auth.oxy.so, so every Oxy app shares it;
+ *  - native signs in with Commons: "Continue with Oxy", or "Get Commons" on a
+ *    device that has no Commons to continue with.
+ */
+
+import type { CommonsAvailability } from '@oxy.so/core';
+
+/**
+ * `qr`          — auth.oxy.so: the embedded QR from `md`, "Continue with Oxy" below.
+ * `window`      — an app on the web: "Continue with Oxy" opens auth.oxy.so's window.
+ * `continue`    — native "Continue with Oxy": Oxy picks the route (shared
+ *                 keychain, Commons on this device, a push, or the QR view).
+ * `get-commons` — native, and Commons is not installed here.
+ */
+export type CommonsEntry = 'qr' | 'window' | 'continue' | 'get-commons';
+
+export interface SignInMethods {
+  commons: CommonsEntry;
+  /** The username and passkey block: only on auth.oxy.so. */
+  passkey: boolean;
+}
+
+export interface SignInSurfaceFacts {
+  /** Rendering in a browser (react-native-web), not a native app. */
+  web: boolean;
+  /** `page` is auth.oxy.so; `dialog` is an app's account dialog. */
+  host: 'dialog' | 'page';
+  /** The controller's native probe for an installed Commons. */
+  commonsAvailability: CommonsAvailability;
+}
+
+export function resolveSignInMethods(facts: SignInSurfaceFacts): SignInMethods {
+  if (facts.web) {
+    return facts.host === 'page' ? { commons: 'qr', passkey: true } : { commons: 'window', passkey: false };
+  }
+  return {
+    commons: facts.commonsAvailability === 'unavailable' ? 'get-commons' : 'continue',
+    passkey: false,
+  };
+}

package/src/ui/context/OxyContext.tsx

@@ -9,7 +9,8 @@ import {
   useState,
 } from 'react';
 import { Linking, Platform } from 'react-native';
-import { OxyServices, oxyClient } from '@oxy.so/core';
+import { DeviceManager, OxyServices, oxyClient, type OxyAuthScreen } from '@oxy.so/core';
+import type { LoginSessionResult } from '@oxy.so/contracts';
 import type {
   User,
   SessionLoginResponse,
@@ -31,7 +32,6 @@ import {
   notifyAccountDialogVisibility,
 } from '../navigation/accountDialogManager';
 import { redirectToAuthorize } from '../components/oauthNavigation';
-import { openPasskeyHubPopup } from '../components/passkeyHubPopup';
 import {
   startWebOAuthSignIn,
   type StartWebOAuthSignInOptions,
@@ -149,7 +149,6 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
   sessionMode = 'account',
   webAuthMode = 'popup',
   backgroundSession = false,
-  deviceCredentialStorage = 'persistent',
   platformStorage,
   onAuthStateChange,
   onError,
@@ -170,17 +169,9 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
 
   // The device-first persisted auth-state store (per-origin device credential on
   // web; SecureStore session blob on native). Built ONCE per provider mount.
-  //
-  // `deviceCredentialStorage` is mount-time configuration for the same reason
-  // `sessionMode` is: it decides where the durable credential lives, and letting
-  // it change mid-flight would mean a session that started ephemeral could begin
-  // writing one.
   const authStoreRef = useRef<AuthStateStore | null>(null);
   if (!authStoreRef.current) {
-    authStoreRef.current = createPlatformAuthStateStore({
-      sessionMode,
-      storage: deviceCredentialStorage,
-    });
+    authStoreRef.current = createPlatformAuthStateStore({ sessionMode });
   }
   const authStore = authStoreRef.current;
 
@@ -730,7 +721,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
   // Public `handleWebSession`: commit a session from the QR device flow. It is a
   // deliberate sign-in on THIS device, so it activates the account.
   const handleWebSession = useCallback(
-    async (session: SessionLoginResponse): Promise<void> => {
+    async (session: SessionLoginResponse | LoginSessionResult): Promise<void> => {
       if (!session?.user || !session?.sessionId || !session.accessToken) {
         throw new Error('Session response did not include a usable session');
       }
@@ -794,6 +785,20 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
     [webAuthMode, oxyServices, clientId, authorizeBaseUrl, isIdentityBound, user?.id],
   );
 
+  // On the web an Oxy app signs in and creates accounts in auth.oxy.so's
+  // window over the app, like "Sign in with Google": the passkey belongs to
+  // that origin, and the browser's session lives there, shared by every Oxy
+  // app. A blocked window falls back to the same page in this tab.
+  const continueOnAuth = useCallback(
+    (screen: OxyAuthScreen): Promise<WebOAuthSignInResult> =>
+      startWebOAuthSignInForContext({
+        redirectUri: authRedirectUri ?? globalThis.location?.origin ?? '',
+        transport: 'popup',
+        screen,
+      }),
+    [startWebOAuthSignInForContext, authRedirectUri],
+  );
+
   // ── Unified account dialog ─────────────────────────────────────────────────
   // The single account-chooser + sign-in surface. Built ONCE per provider mount
   // and bound to the live `oxyServices` + `sessionClient` + this provider's
@@ -863,11 +868,6 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       // controller short-circuits, so `redirectToAuthorize` never runs for the
       // `oxycommons://` payload.
       canOpenApp: isWebBrowser() ? undefined : (url) => Linking.canOpenURL(url),
-      // Web-only: lets `startPasskeyHubSignIn` open the auth.oxy.so passkey hub
-      // popup (b2) for a non-Oxy origin. `undefined` on native — there is no
-      // popup concept there, and off-origin passkey sign-in isn't reachable
-      // (Commons owns the native flow).
-      openPopup: isWebBrowser() ? openPasskeyHubPopup : undefined,
       // Which surface a sign-in starts from — a FACT only this consumer can
       // supply (headless core never touches a platform global). It decides
       // whether automatic delivery may take the same-device Commons deep link;
@@ -983,7 +983,9 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
         username: opts?.username,
         deviceId: persisted?.deviceId,
         deviceName: opts?.deviceName,
-        deviceFingerprint: opts?.deviceFingerprint,
+        // The same shape every other sign-in path sends; the server only reads it
+        // to place a device that has no persisted id yet.
+        deviceFingerprint: opts?.deviceFingerprint ?? JSON.stringify(DeviceManager.getDeviceFingerprint()),
       });
     },
     [oxyServices, authStore, commitSession],
@@ -1284,6 +1286,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       revokeSuspiciousSignIn,
       handleWebSession,
       startWebOAuthSignIn: startWebOAuthSignInForContext,
+      continueOnAuth,
       requestOAuthConsent: requestOAuthConsentForContext,
       logout,
       logoutAll,
@@ -1341,6 +1344,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       revokeSuspiciousSignIn,
       handleWebSession,
       startWebOAuthSignInForContext,
+      continueOnAuth,
       requestOAuthConsentForContext,
       logout,
       logoutAll,

package/src/ui/context/__tests__/commitSessionFlow.test.ts

@@ -1,11 +1,8 @@
 import type { User } from '@oxy.so/core';
 import { logger } from '@oxy.so/core';
-import type { WebAuthMode } from '../../oauth/types';
 import {
   commitDeviceSetAndResolve,
-  maybeSyncHubAfterCommit,
   type CommitDeviceSetAndResolveDeps,
-  type MaybeSyncHubAfterCommitDeps,
 } from '../commitSessionFlow';
 
 // A resolved promise chain (addCurrentAccount -> start -> syncFromClient) settles
@@ -206,92 +203,6 @@ describe('commitDeviceSetAndResolve — cold boot (activate: false)', () => {
   });
 });
 
-/**
- * Post-sign-in hub sync is a FULL-PAGE redirect to auth.oxy.so. It runs from the
- * ONE commit funnel, so gating it here gates every commit path at once —
- * `webAuthMode: 'popup'` must never bounce the tab, whichever path signed the
- * user in (#691 phase 7).
- */
-describe('maybeSyncHubAfterCommit — webAuthMode transport gate (#691 phase 7)', () => {
-  const buildHubDeps = (
-    overrides: Partial<MaybeSyncHubAfterCommitDeps> = {},
-  ): MaybeSyncHubAfterCommitDeps => ({
-    activate: true,
-    hubSyncRequested: true,
-    hubSyncEnabled: true,
-    webAuthMode: 'redirect',
-    syncHub: jest.fn(async () => true),
-    ...overrides,
-  });
-
-  it("redirect mode: syncs the hub after a deliberate sign-in (unchanged)", async () => {
-    const deps = buildHubDeps();
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(true);
-
-    expect(deps.syncHub).toHaveBeenCalledTimes(1);
-  });
-
-  it('popup mode: NEVER syncs the hub, even on an otherwise-eligible sign-in', async () => {
-    const deps = buildHubDeps({ webAuthMode: 'popup' });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('popup mode: no commit path can opt back in', async () => {
-    // Every commit path differs only in `activate` / `hubSyncRequested`; the
-    // transport gate outranks all of them.
-    for (const activate of [true, false]) {
-      for (const hubSyncRequested of [true, false]) {
-        const deps = buildHubDeps({ webAuthMode: 'popup', activate, hubSyncRequested });
-        await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-        expect(deps.syncHub).not.toHaveBeenCalled();
-      }
-    }
-  });
-
-  it.each(['popup', 'redirect'] as const)(
-    'never syncs on a cold-boot restore, in either mode (%s)',
-    async (webAuthMode: WebAuthMode) => {
-      const deps = buildHubDeps({ webAuthMode, activate: false });
-
-      await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-      expect(deps.syncHub).not.toHaveBeenCalled();
-    },
-  );
-
-  it('redirect mode: honours the per-commit opt-out (account switch / popup OAuth lanes)', async () => {
-    const deps = buildHubDeps({ hubSyncRequested: false });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('redirect mode: honours the provider-level hubSync opt-out', async () => {
-    const deps = buildHubDeps({ hubSyncEnabled: false });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('redirect mode: a failing hub sync is non-fatal and never rejects', async () => {
-    const deps = buildHubDeps({
-      syncHub: jest.fn(async () => {
-        throw new Error('hub ticket failed');
-      }),
-    });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).toHaveBeenCalledTimes(1);
-  });
-});
-
 describe('commitDeviceSetAndResolve — deliberate sign-in (activate: true)', () => {
   it('BLOCKS on the device-set reconcile before resolving auth (unchanged ordering)', async () => {
     const order: string[] = [];

package/src/ui/context/__tests__/passkeyFlow.test.ts

@@ -12,7 +12,8 @@
 import type { LoginSessionResult } from '@oxy.so/contracts';
 import {
   runPasskeyLogin,
-    runPasskeyAdd,
+  runPasskeyAdd,
+  runPasskeyRegisterSignIn,
   PASSKEY_UNSUPPORTED_MESSAGE,
   type RunPasskeyLoginDeps,
   type RunPasskeyAddDeps,
@@ -179,3 +180,60 @@ describe('runPasskeyAdd', () => {
     expect(deps.onLinked).not.toHaveBeenCalled();
   });
 });
+
+describe('runPasskeyRegisterSignIn', () => {
+  it('runs options → ceremony → verify → commit, and commits the session it minted', async () => {
+    const order: string[] = [];
+    const commit = jest.fn(async (result: LoginSessionResult) => {
+      order.push('commit');
+      expect(result).toBe(sessionResult);
+    });
+    await runPasskeyRegisterSignIn({
+      isSupported: () => true,
+      getRegisterOptions: async () => {
+        order.push('register-options');
+        return { challenge: 'c' };
+      },
+      runCeremony: async (options) => {
+        order.push('ceremony');
+        expect(options).toEqual({ challenge: 'c' });
+        return { id: 'cred' };
+      },
+      registerVerify: async (response) => {
+        order.push('verify');
+        expect(response).toEqual({ id: 'cred' });
+        return sessionResult;
+      },
+      commit,
+    });
+    expect(order).toEqual(['register-options', 'ceremony', 'verify', 'commit']);
+  });
+
+  it('refuses a verify that linked instead of signing in', async () => {
+    const commit = jest.fn();
+    await expect(
+      runPasskeyRegisterSignIn({
+        isSupported: () => true,
+        getRegisterOptions: async () => ({}),
+        runCeremony: async () => ({}),
+        registerVerify: async () => linkResult,
+        commit,
+      }),
+    ).rejects.toThrow('without signing in');
+    expect(commit).not.toHaveBeenCalled();
+  });
+
+  it('fails before any ceremony where passkeys are unsupported', async () => {
+    const getRegisterOptions = jest.fn();
+    await expect(
+      runPasskeyRegisterSignIn({
+        isSupported: () => false,
+        getRegisterOptions,
+        runCeremony: jest.fn(),
+        registerVerify: jest.fn(),
+        commit: jest.fn(),
+      }),
+    ).rejects.toThrow(PASSKEY_UNSUPPORTED_MESSAGE);
+    expect(getRegisterOptions).not.toHaveBeenCalled();
+  });
+});

package/src/ui/context/commitSessionFlow.ts

@@ -1,8 +1,5 @@
 import type { User } from '@oxy.so/core';
 import { logger as loggerUtil } from '@oxy.so/core';
-import { allowsAutomaticIdpRedirect } from '../oauth/legacyRedirectLanes';
-import type { WebAuthMode } from '../oauth/types';
-import { isWebBrowser } from '../utils/isWebBrowser';
 import { isUnauthorizedStatus } from './oxyContextHelpers';
 
 const LOG_CONTEXT = { component: 'OxyContext', method: 'commitSession' } as const;
@@ -133,61 +130,3 @@ export async function commitDeviceSetAndResolve(
   await hydrateAndResolve();
   void reconcileDeviceSet().catch(logReconcileError);
 }
-
-export interface MaybeSyncHubAfterCommitDeps {
-  /** Deliberate sign-in (`true`) vs. a cold-boot / background commit (`false`). */
-  activate: boolean;
-  /** Per-commit opt-in — `commitSession`'s `options.hubSync`. */
-  hubSyncRequested: boolean;
-  /** Provider-level opt-out — `OxyProviderProps.hubSync`. */
-  hubSyncEnabled: boolean;
-  /**
-   * The provider's web sign-in transport — `OxyProviderProps.webAuthMode`.
-   * A first-class input: `'popup'` forbids the redirect outright.
-   */
-  webAuthMode: WebAuthMode;
-  /**
-   * Starts the full-page hop to `auth.oxy.so/sync`; resolves `true` when the
-   * navigation was actually started.
-   */
-  syncHub: () => Promise<boolean>;
-}
-
-/**
- * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
- * official origins can silently restore a session on their next cold boot.
- *
- * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
- * on this legacy lane lives — and is tested — in one place. Returns whether the
- * full-page redirect was started; a failure is non-fatal and never propagates
- * (the sign-in itself already succeeded).
- *
- * Four gates, all of which must pass:
- * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
- * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
- * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
- * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
- *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
- *    bounces the tab defeats the entire point of the mode, no matter which
- *    commit path produced the session (issue #691, "Cold boot and cross-domain
- *    behavior"). Redirect mode — the default and the compatibility path — is
- *    unchanged, and this whole function disappears with it in phase 7b.
- */
-export async function maybeSyncHubAfterCommit(
-  deps: MaybeSyncHubAfterCommitDeps,
-): Promise<boolean> {
-  const { activate, hubSyncRequested, hubSyncEnabled, webAuthMode, syncHub } = deps;
-
-  if (!activate || !hubSyncRequested || !hubSyncEnabled) return false;
-  if (!allowsAutomaticIdpRedirect(webAuthMode)) return false;
-  if (!isWebBrowser()) return false;
-
-  try {
-    return await syncHub();
-  } catch (hubError) {
-    if (__DEV__) {
-      loggerUtil.debug('Hub sync after sign-in failed (non-fatal)', LOG_CONTEXT, hubError);
-    }
-    return false;
-  }
-}

package/src/ui/context/oxyContextTypes.ts

@@ -1,5 +1,6 @@
 import type { ReactNode } from 'react';
-import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient, SessionMode } from '@oxy.so/core';
+import type { LoginSessionResult } from '@oxy.so/contracts';
+import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient, SessionMode, OxyAuthScreen } from '@oxy.so/core';
 import type { UseFollowHook } from '../hooks/useFollow.types';
 import type { useLanguageManagement } from '../hooks/useLanguageManagement';
 import type { RouteName } from '../navigation/routes';
@@ -104,7 +105,12 @@ export interface OxyContextState {
   removePasskey: (credentialId: string) => Promise<void>;
 
   revokeSuspiciousSignIn: () => Promise<void>;
-  handleWebSession: (session: SessionLoginResponse) => Promise<void>;
+  /**
+   * Commit a session a first-party sign-in minted on THIS origin — an OAuth
+   * code exchange, or a passkey registration on auth.oxy.so (sign-up,
+   * recovery) — as the active one.
+   */
+  handleWebSession: (session: SessionLoginResponse | LoginSessionResult) => Promise<void>;
 
   /**
    * Run a WEB third-party OAuth sign-in (authorization code + PKCE) end to end
@@ -124,6 +130,14 @@ export interface OxyContextState {
    */
   startWebOAuthSignIn: (options: StartWebOAuthSignInOptions) => Promise<WebOAuthSignInResult>;
 
+  /**
+   * Sign in (`signin`), create an account (`signup`) or recover one
+   * (`recover`) in auth.oxy.so's window over the app, where the browser's
+   * shared Oxy session lives. Web only; call it from the press, so the window
+   * opens with the gesture.
+   */
+  continueOnAuth: (screen: OxyAuthScreen) => Promise<WebOAuthSignInResult>;
+
   /**
    * Ask the already-authenticated user for explicit OAuth consent to exact
    * application scopes. Must be called from a user gesture. Works on web and
@@ -219,14 +233,6 @@ export interface OxyRuntimeProviderProps {
    * @default false
    */
   backgroundSession?: boolean;
-  /**
-   * Whether this origin/app persists the durable device credential at all. See
-   * `OxyProviderProps.deviceCredentialStorage` for the full rule and the one
-   * caller of `'ephemeral'`.
-   *
-   * @default 'persistent'
-   */
-  deviceCredentialStorage?: 'persistent' | 'ephemeral';
   onAuthStateChange?: (user: User | null) => void;
   onError?: (error: ApiError) => void;
   /** Storage instance owned by the public provider; internal composition seam. */

package/src/ui/context/passkeyFlow.ts

@@ -115,3 +115,31 @@ export async function runPasskeyAdd(deps: RunPasskeyAddDeps): Promise<void> {
   }
   deps.onLinked();
 }
+
+/** Injected dependencies for {@link runPasskeyRegisterSignIn}. */
+export interface RunPasskeyRegisterSignInDeps {
+  isSupported: () => boolean;
+  getRegisterOptions: () => Promise<unknown>;
+  runCeremony: (optionsJSON: unknown) => Promise<unknown>;
+  registerVerify: (response: unknown) => Promise<PasskeyRegisterVerifyResult>;
+  commit: (result: LoginSessionResult) => Promise<void>;
+}
+
+/**
+ * Register a passkey SIGNED OUT and sign in with the account it belongs to —
+ * a new passkey account (username + confirmed recovery email), or a recovery's
+ * new passkey (ADR 0029 D3). Options, ceremony, verify, then commit; the verify
+ * must mint a session, since there is no bearer to link to.
+ */
+export async function runPasskeyRegisterSignIn(deps: RunPasskeyRegisterSignInDeps): Promise<void> {
+  if (!deps.isSupported()) {
+    throw new Error(PASSKEY_UNSUPPORTED_MESSAGE);
+  }
+  const options = await deps.getRegisterOptions();
+  const response = await deps.runCeremony(options);
+  const result = await deps.registerVerify(response);
+  if (!('sessionId' in result)) {
+    throw new Error('The passkey was registered without signing in.');
+  }
+  await deps.commit(result);
+}

package/src/ui/hooks/accountDialogSnapshot.ts

@@ -1,4 +1,5 @@
-import type { AccountDialogSnapshot } from '@oxy.so/core';
+import { useCallback, useSyncExternalStore } from 'react';
+import type { AccountDialogController, AccountDialogSnapshot } from '@oxy.so/core';
 
 /**
  * The snapshot `useSyncExternalStore` reads before a controller exists.
@@ -36,6 +37,24 @@ export const EMPTY_ACCOUNT_DIALOG_SNAPSHOT: AccountDialogSnapshot = {
     openedAt: null,
     progress: 'idle',
     attempt: 0,
+    inline: false,
   },
   commonsAvailability: 'unknown',
 };
+
+/**
+ * Bind a surface to `controller`'s snapshot (the inert one while there is no
+ * controller). `getSnapshot` returns a stable reference between changes, so
+ * it is `useSyncExternalStore`-safe.
+ */
+export function useAccountDialogSnapshot(controller: AccountDialogController | null): AccountDialogSnapshot {
+  const subscribe = useCallback(
+    (listener: () => void) => (controller ? controller.subscribe(listener) : () => undefined),
+    [controller],
+  );
+  const getSnapshot = useCallback(
+    () => (controller ? controller.getSnapshot() : EMPTY_ACCOUNT_DIALOG_SNAPSHOT),
+    [controller],
+  );
+  return useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+}

package/src/ui/hooks/useDeviceSwitcher.ts

@@ -1,4 +1,4 @@
-import { useCallback, useMemo, useSyncExternalStore } from 'react';
+import { useCallback, useMemo } from 'react';
 import {
     buildSwitcherRows,
     projectDevicePrincipals,
@@ -7,7 +7,7 @@ import {
 } from '@oxy.so/core';
 import { useOxy } from '../context/OxyContext';
 import { useI18n } from './useI18n';
-import { EMPTY_ACCOUNT_DIALOG_SNAPSHOT } from './accountDialogSnapshot';
+import { useAccountDialogSnapshot } from './accountDialogSnapshot';
 
 export interface UseDeviceSwitcherResult {
     /**
@@ -60,15 +60,7 @@ export function useDeviceSwitcher(): UseDeviceSwitcherResult {
     const { accountDialogController: controller, oxyServices } = useOxy();
     const { locale } = useI18n();
 
-    const subscribe = useCallback(
-        (listener: () => void) => (controller ? controller.subscribe(listener) : () => undefined),
-        [controller],
-    );
-    const getSnapshot = useCallback(
-        () => (controller ? controller.getSnapshot() : EMPTY_ACCOUNT_DIALOG_SNAPSHOT),
-        [controller],
-    );
-    const snapshot = useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+    const snapshot = useAccountDialogSnapshot(controller);
 
     // `directory` is a stable reference between reads (`SessionClient` holds the
     // one it applied), so this recomputes only when the device actually moved.

package/src/ui/oauth/__tests__/browserAuthTransport.test.ts

@@ -153,6 +153,27 @@ describe('startWebOAuthSignIn', () => {
       expect(openSpy).toHaveBeenCalledTimes(1);
     });
 
+    // An Oxy app's account dialog asks for the window whatever the provider's
+    // `webAuthMode`, and for the IdP screen the person lands on.
+    it('opens the window for `transport: popup` even in redirect mode, with its screen', async () => {
+      const context = makeContext({ mode: 'redirect' });
+      const popup = fakePopup();
+      const openSpy = jest.spyOn(window, 'open').mockReturnValue(popup as unknown as Window);
+
+      const pending = startWebOAuthSignIn(context, { redirectUri: REDIRECT_URI, transport: 'popup', screen: 'signup' });
+      const authorizeUrl = await waitForAuthorizeUrl(popup);
+      expect(authorizeUrl.searchParams.get('screen')).toBe('signup');
+      expect(authorizeUrl.searchParams.get('response_mode')).toBe('web_message');
+      dispatchFromPopup(
+        { type: OXY_OAUTH_CODE_MESSAGE_TYPE, code: 'code-1', state: authorizeUrl.searchParams.get('state') },
+        popup,
+      );
+
+      await expect(pending).resolves.toEqual({ status: 'signed-in' });
+      expect(openSpy).toHaveBeenCalledTimes(1);
+      expect(mockRedirect).not.toHaveBeenCalled();
+    });
+
     it('falls back to a full-page redirect when the popup was blocked', async () => {
       const context = makeContext();