@oxy.so/services 6.2.0 → 8.0.0

package/src/ui/components/signIn/OxyRecoverAccountPanel.tsx

@@ -1,154 +0,0 @@
-/**
- * Recovering a passkey account (ADR 0029 D3), auth.oxy.so's `/recover`:
- *
- *   username or email → the code sent to the recovery email → new passkey → signed in
- *
- * The first step answers the same whether or not the account exists, so it
- * never says who has one. An account that uses Commons has no recovery email:
- * it recovers in Commons with its phrase, and the first step says so. The new
- * passkey joins the ones the account has; lost ones are removed afterwards in
- * the account's security settings.
- */
-
-import type React from 'react';
-import { useState } from 'react';
-import { useTheme } from '@oxy.so/bloom/theme';
-import { DeviceManager } from '@oxy.so/core';
-import { useOxy } from '../../context/OxyContext';
-import { runPasskeyRegisterSignIn } from '../../context/passkeyFlow';
-import { useI18n } from '../../hooks/useI18n';
-import { isPasskeySupported, runRegistrationCeremony } from '../../../webauthn/passkeyClient';
-import { SubtleLink } from '../authChooser/primitives';
-import { OxyAuthScreen, OxyAuthScreenHeader, OxyAuthTerms } from './OxyAuthScreen';
-import {
-  AccountFlowAction,
-  AccountFlowErrorLine,
-  AccountFlowField,
-  AccountFlowNote,
-  EmailCodeStep,
-  describeAccountFlowError,
-  isTicketExpired,
-} from './accountFlowParts';
-
-type Step =
-  | { name: 'entry' }
-  | { name: 'code'; verificationId: string }
-  | { name: 'passkey'; recoveryTicket: string; username: string | null };
-
-export interface OxyRecoverAccountPanelProps {
-  /** The account has a new passkey and this origin is signed in as it. */
-  onRecovered: () => void;
-  /** "Back to sign in". */
-  onSignIn: () => void;
-}
-
-export const OxyRecoverAccountPanel: React.FC<OxyRecoverAccountPanelProps> = ({ onRecovered, onSignIn }) => {
-  const theme = useTheme();
-  const { t } = useI18n();
-  const { oxyServices, handleWebSession } = useOxy();
-  const [step, setStep] = useState<Step>({ name: 'entry' });
-  const [identifier, setIdentifier] = useState('');
-  const [pending, setPending] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  const run = (work: () => Promise<void>) => {
-    if (pending) return;
-    setError(null);
-    setPending(true);
-    work()
-      .catch((reason: unknown) => {
-        if (isTicketExpired(reason)) setStep({ name: 'entry' });
-        setError(describeAccountFlowError(reason, t));
-      })
-      .finally(() => setPending(false));
-  };
-
-  const sendCode = async () => {
-    const { verificationId } = await oxyServices.startEmailVerification({ purpose: 'recovery', identifier: identifier.trim() });
-    setStep({ name: 'code', verificationId });
-  };
-
-  const submitIdentifier = () => {
-    if (!identifier.trim()) {
-      setError(t('recover.identifier.required'));
-      return;
-    }
-    run(sendCode);
-  };
-
-  // The ceremony opens the browser's passkey prompt, so it starts from the press.
-  const addPasskey = (recoveryTicket: string) =>
-    run(() =>
-      runPasskeyRegisterSignIn({
-        isSupported: isPasskeySupported,
-        getRegisterOptions: () => oxyServices.webauthnRegisterOptions({ recoveryTicket }),
-        runCeremony: runRegistrationCeremony,
-        registerVerify: (response) =>
-          oxyServices.webauthnRegisterVerify(response, {
-            recoveryTicket,
-            deviceFingerprint: JSON.stringify(DeviceManager.getDeviceFingerprint()),
-          }),
-        commit: async (session) => {
-          await handleWebSession(session);
-          onRecovered();
-        },
-      }),
-    );
-
-  switch (step.name) {
-    case 'code':
-      return (
-        <EmailCodeStep
-          description={t('emailCode.sentIfAccount')}
-          verificationId={step.verificationId}
-          onConfirmed={({ ticket, username }) => {
-            setError(null);
-            setStep({ name: 'passkey', recoveryTicket: ticket, username });
-          }}
-          onResend={sendCode}
-          back={{ label: t('signin.actions.back'), onPress: () => setStep({ name: 'entry' }) }}
-        />
-      );
-    case 'passkey':
-      return (
-        <OxyAuthScreen>
-          <OxyAuthScreenHeader
-            title={t('recover.passkey.title')}
-            description={t('recover.passkey.subtitle', { username: step.username ?? '' })}
-          />
-          {error ? <AccountFlowErrorLine message={error} /> : null}
-          <AccountFlowAction
-            label={t('recover.passkey.action')}
-            onPress={() => addPasskey(step.recoveryTicket)}
-            pending={pending}
-            testID="recover-create-passkey"
-          />
-          <OxyAuthTerms />
-        </OxyAuthScreen>
-      );
-    default:
-      return (
-        <OxyAuthScreen>
-          <OxyAuthScreenHeader title={t('recover.title')} description={t('recover.subtitle')} />
-          <AccountFlowField
-            label={t('recover.identifier.label')}
-            value={identifier}
-            onChange={(value) => {
-              setIdentifier(value);
-              if (error) setError(null);
-            }}
-            onSubmit={submitIdentifier}
-            error={error}
-            disabled={pending}
-            placeholder={t('recover.identifier.placeholder')}
-            autoComplete="username"
-            testID="recover-identifier"
-          />
-          <AccountFlowNote>{t('recover.commonsNote')}</AccountFlowNote>
-          <AccountFlowAction label={t('signin.actions.continue')} onPress={submitIdentifier} pending={pending} testID="recover-continue" />
-          <SubtleLink label={t('recover.backToSignIn')} theme={theme} onPress={onSignIn} testID="back-to-sign-in" />
-          <OxyAuthTerms />
-        </OxyAuthScreen>
-      );
-  }
-};

package/src/ui/components/signIn/passkeyError.ts

@@ -1,44 +0,0 @@
-/**
- * The message for a failed passkey sign-in, and whether it was rate-limited.
- *
- * A dismissed or timed-out browser prompt rejects with a `NotAllowedError` /
- * `AbortError` DOMException, often re-wrapped by `@simplewebauthn/browser` as a
- * `WebAuthnError` whose `cause` is the original — so the cancellation shape is
- * looked for along the cause chain, and reported calmly instead of as the raw
- * "The operation either timed out or was not allowed…".
- */
-
-import type { Translate } from '../authChooser/types';
-
-/** How long the surface waits after a 429 before it lets the person retry. */
-export const RATE_LIMIT_SECONDS = 60;
-
-function isCancellation(error: unknown): boolean {
-  let current: unknown = error;
-  for (let depth = 0; depth < 5 && current instanceof Error; depth += 1) {
-    if (current.name === 'NotAllowedError' || current.name === 'AbortError') return true;
-    // `@simplewebauthn/browser`'s stable code for an aborted ceremony.
-    if ((current as { code?: unknown }).code === 'ERROR_CEREMONY_ABORTED') return true;
-    current = (current as { cause?: unknown }).cause;
-  }
-  return false;
-}
-
-/** An HTTP status off a thrown SDK error (ApiError- or axios-shaped). */
-function errorStatus(error: unknown): number | undefined {
-  return (
-    (error as { status?: number } | undefined)?.status ??
-    (error as { response?: { status?: number } } | undefined)?.response?.status
-  );
-}
-
-export function isRateLimited(error: unknown): boolean {
-  return errorStatus(error) === 429;
-}
-
-/** The inline message for a passkey ceremony that did not sign anyone in. */
-export function describePasskeyError(error: unknown, t: Translate): string {
-  if (isCancellation(error)) return t('signin.errors.passkeyCancelled');
-  if (error instanceof Error && error.message.trim().length > 0) return error.message;
-  return t('signin.errors.passkeyFailed');
-}

package/src/ui/context/__tests__/passkeyFlow.test.ts

@@ -1,239 +0,0 @@
-/**
- * `passkeyFlow` — the pure, deps-injected passkey (WebAuthn) orchestration that
- * backs `useOxy().signInWithPasskey` / `addPasskey`.
- *
- * These tests assert the fixed `options → ceremony → verify → commit` ordering,
- * the exact `commitSession` input projected from a session-arm login result, the
- * `isSupported()` gate, and the branch discipline (sign-in/register commit a
- * session; add links WITHOUT committing and fires `onLinked`) — the same
- * deps-injection style `commitSessionFlow.test.ts` uses.
- */
-
-import type { LoginSessionResult } from '@oxy.so/contracts';
-import {
-  runPasskeyLogin,
-  runPasskeyAdd,
-  runPasskeyRegisterSignIn,
-  PASSKEY_UNSUPPORTED_MESSAGE,
-  type RunPasskeyLoginDeps,
-  type RunPasskeyAddDeps,
-  type PasskeyRegisterVerifyResult,
-} from '../passkeyFlow';
-import type { CommitInput } from '../oxyContextTypes';
-
-const SESSION_USER_ID = 'user_pk_1';
-
-/** A full session arm of the login contract (mirrors `webauthn*Verify`'s signup/login output). */
-const sessionResult: LoginSessionResult = {
-  sessionId: 'sess_pk',
-  deviceId: 'dev_pk',
-  accessToken: 'pk.access.token',
-  deviceSecret: 'pk.device.secret',
-  expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
-  user: { id: SESSION_USER_ID, username: 'pkuser' },
-};
-
-/** The `commitSession` input the flow projects from `sessionResult`. */
-const expectedCommitInput: CommitInput = {
-  sessionId: 'sess_pk',
-  accessToken: 'pk.access.token',
-  deviceSecret: 'pk.device.secret',
-  deviceId: 'dev_pk',
-  expiresAt: sessionResult.expiresAt,
-  userId: SESSION_USER_ID,
-  user: { id: SESSION_USER_ID, username: 'pkuser' },
-};
-
-const linkResult: PasskeyRegisterVerifyResult = { success: true, message: 'Passkey added' };
-
-describe('runPasskeyLogin', () => {
-  const buildDeps = (
-    order: string[],
-    overrides: Partial<RunPasskeyLoginDeps> = {},
-  ): RunPasskeyLoginDeps => ({
-    isSupported: jest.fn(() => true),
-    getLoginOptions: jest.fn(async () => {
-      order.push('getLoginOptions');
-      return { challenge: 'login-opts' };
-    }),
-    runCeremony: jest.fn(async (options) => {
-      order.push('runCeremony');
-      expect(options).toEqual({ challenge: 'login-opts' });
-      return { id: 'assertion' };
-    }),
-    loginVerify: jest.fn(async () => {
-      order.push('loginVerify');
-      return sessionResult;
-    }),
-    commit: jest.fn(async () => {
-      order.push('commit');
-    }),
-    deviceId: 'persisted-dev',
-    deviceName: 'My Laptop',
-    deviceFingerprint: 'fp-123',
-    ...overrides,
-  });
-
-  it('drives options → ceremony → verify → commit and threads the device envelope', async () => {
-    const order: string[] = [];
-    const deps = buildDeps(order);
-
-    await runPasskeyLogin(deps);
-
-    expect(order).toEqual(['getLoginOptions', 'runCeremony', 'loginVerify', 'commit']);
-    // The assertion response is forwarded to verify with the device envelope.
-    expect(deps.loginVerify).toHaveBeenCalledWith(
-      { id: 'assertion' },
-      { deviceName: 'My Laptop', deviceFingerprint: 'fp-123', deviceId: 'persisted-dev' },
-    );
-    // The session arm is projected onto the exact commitSession input.
-    expect(deps.commit).toHaveBeenCalledWith(expectedCommitInput);
-  });
-
-  it('forwards the username to getLoginOptions for the username-first (hardware-key) path', async () => {
-    const order: string[] = [];
-    const deps = buildDeps(order, { username: 'alice' });
-
-    await runPasskeyLogin(deps);
-
-    // The username scopes login options to that user's passkeys — the path a
-    // non-discoverable U2F/security key needs.
-    expect(deps.getLoginOptions).toHaveBeenCalledWith('alice');
-  });
-
-  it('passes undefined to getLoginOptions for the usernameless (discoverable) path', async () => {
-    const order: string[] = [];
-    const deps = buildDeps(order);
-
-    await runPasskeyLogin(deps);
-
-    // No username → discoverable-credential ceremony (server returns an empty allow-list).
-    expect(deps.getLoginOptions).toHaveBeenCalledWith(undefined);
-  });
-
-  it('throws and touches nothing when passkeys are unsupported', async () => {
-    const order: string[] = [];
-    const deps = buildDeps(order, { isSupported: jest.fn(() => false) });
-
-    await expect(runPasskeyLogin(deps)).rejects.toThrow(PASSKEY_UNSUPPORTED_MESSAGE);
-    expect(deps.getLoginOptions).not.toHaveBeenCalled();
-    expect(deps.commit).not.toHaveBeenCalled();
-  });
-});
-
-describe('runPasskeyAdd', () => {
-  const buildDeps = (
-    order: string[],
-    overrides: Partial<RunPasskeyAddDeps> = {},
-  ): RunPasskeyAddDeps => ({
-    isSupported: jest.fn(() => true),
-    getRegisterOptions: jest.fn(async () => {
-      order.push('getRegisterOptions');
-      return { challenge: 'add-opts' };
-    }),
-    runCeremony: jest.fn(async () => {
-      order.push('runCeremony');
-      return { id: 'attestation' };
-    }),
-    registerVerify: jest.fn(async () => {
-      order.push('registerVerify');
-      return linkResult;
-    }),
-    onLinked: jest.fn(() => {
-      order.push('onLinked');
-    }),
-    deviceName: 'My Laptop',
-    ...overrides,
-  });
-
-  it('links the passkey WITHOUT committing a session and fires onLinked', async () => {
-    const order: string[] = [];
-    const deps = buildDeps(order);
-
-    await runPasskeyAdd(deps);
-
-    expect(order).toEqual(['getRegisterOptions', 'runCeremony', 'registerVerify', 'onLinked']);
-    // Add requests options with NO username (bearer scopes it to the signed-in user).
-    expect(deps.getRegisterOptions).toHaveBeenCalledWith();
-    expect(deps.registerVerify).toHaveBeenCalledWith({ id: 'attestation' }, { deviceName: 'My Laptop' });
-    expect(deps.onLinked).toHaveBeenCalledTimes(1);
-    // There is no `commit` dependency at all — structurally cannot commit a session.
-    expect('commit' in deps).toBe(false);
-  });
-
-  it('throws (no onLinked) if verify unexpectedly mints a session', async () => {
-    const order: string[] = [];
-    const deps = buildDeps(order, {
-      registerVerify: jest.fn(async () => sessionResult),
-    });
-
-    await expect(runPasskeyAdd(deps)).rejects.toThrow(/instead of linking/i);
-    expect(deps.onLinked).not.toHaveBeenCalled();
-  });
-
-  it('throws and touches nothing when passkeys are unsupported', async () => {
-    const order: string[] = [];
-    const deps = buildDeps(order, { isSupported: jest.fn(() => false) });
-
-    await expect(runPasskeyAdd(deps)).rejects.toThrow(PASSKEY_UNSUPPORTED_MESSAGE);
-    expect(deps.getRegisterOptions).not.toHaveBeenCalled();
-    expect(deps.onLinked).not.toHaveBeenCalled();
-  });
-});
-
-describe('runPasskeyRegisterSignIn', () => {
-  it('runs options → ceremony → verify → commit, and commits the session it minted', async () => {
-    const order: string[] = [];
-    const commit = jest.fn(async (result: LoginSessionResult) => {
-      order.push('commit');
-      expect(result).toBe(sessionResult);
-    });
-    await runPasskeyRegisterSignIn({
-      isSupported: () => true,
-      getRegisterOptions: async () => {
-        order.push('register-options');
-        return { challenge: 'c' };
-      },
-      runCeremony: async (options) => {
-        order.push('ceremony');
-        expect(options).toEqual({ challenge: 'c' });
-        return { id: 'cred' };
-      },
-      registerVerify: async (response) => {
-        order.push('verify');
-        expect(response).toEqual({ id: 'cred' });
-        return sessionResult;
-      },
-      commit,
-    });
-    expect(order).toEqual(['register-options', 'ceremony', 'verify', 'commit']);
-  });
-
-  it('refuses a verify that linked instead of signing in', async () => {
-    const commit = jest.fn();
-    await expect(
-      runPasskeyRegisterSignIn({
-        isSupported: () => true,
-        getRegisterOptions: async () => ({}),
-        runCeremony: async () => ({}),
-        registerVerify: async () => linkResult,
-        commit,
-      }),
-    ).rejects.toThrow('without signing in');
-    expect(commit).not.toHaveBeenCalled();
-  });
-
-  it('fails before any ceremony where passkeys are unsupported', async () => {
-    const getRegisterOptions = jest.fn();
-    await expect(
-      runPasskeyRegisterSignIn({
-        isSupported: () => false,
-        getRegisterOptions,
-        runCeremony: jest.fn(),
-        registerVerify: jest.fn(),
-        commit: jest.fn(),
-      }),
-    ).rejects.toThrow(PASSKEY_UNSUPPORTED_MESSAGE);
-    expect(getRegisterOptions).not.toHaveBeenCalled();
-  });
-});

package/src/ui/context/passkeyFlow.ts

@@ -1,145 +0,0 @@
-/**
- * Pure passkey (WebAuthn) sign-in / registration orchestration.
- *
- * Extracted from `OxyContext` so the fixed `options → ceremony → verify → commit`
- * ordering is unit-testable with injected deps — the exact pattern
- * `commitSessionFlow.ts` (`commitDeviceSetAndResolve`) uses. The context methods
- * (`signInWithPasskey` / `addPasskey`) are thin wrappers
- * that supply the real deps: the core `webauthn*` methods, the platform ceremony
- * client (`webauthn/passkeyClient`), and the internal `commitSession` funnel.
- *
- * Both GATE on `isSupported()` first (the platform client returns `false`
- * off the web) so an unsupported surface fails loudly before touching a ceremony.
- */
-
-import type { LoginResult, LoginSessionResult } from '@oxy.so/contracts';
-import type { CommitInput } from './oxyContextTypes';
-
-/**
- * The result of `OxyServices.webauthnRegisterVerify` — either the LINK branch
- * (`{ success, message }`, bearer present, no session) or the SIGNUP branch (a
- * full {@link LoginResult}, which carries a `sessionId` on its session arm).
- */
-export type PasskeyRegisterVerifyResult = { success: true; message: string } | LoginResult;
-
-/** Thrown when a passkey flow is attempted on a surface that cannot run WebAuthn. */
-export const PASSKEY_UNSUPPORTED_MESSAGE =
-  'Passkeys are not available in this environment. Use another sign-in method.';
-
-/** Project a session-arm login result onto the internal `commitSession` input. */
-function toCommitInput(result: LoginSessionResult): CommitInput {
-  return {
-    sessionId: result.sessionId,
-    accessToken: result.accessToken,
-    deviceSecret: result.deviceSecret,
-    deviceId: result.deviceId,
-    expiresAt: result.expiresAt,
-    userId: result.user.id,
-    user: result.user,
-  };
-}
-
-/** Injected dependencies for {@link runPasskeyLogin}. */
-export interface RunPasskeyLoginDeps {
-  isSupported: () => boolean;
-  getLoginOptions: (username?: string) => Promise<unknown>;
-  runCeremony: (optionsJSON: unknown) => Promise<unknown>;
-  loginVerify: (
-    response: unknown,
-    envelope: { deviceName?: string; deviceFingerprint?: string; deviceId?: string },
-  ) => Promise<LoginResult>;
-  commit: (input: CommitInput) => Promise<void>;
-  /**
-   * When present, scopes login options to that user's registered passkeys
-   * (username-first) — the path a NON-discoverable hardware key (e.g. a U2F
-   * security key) needs, since it can't be found by a usernameless ceremony.
-   * Omit for the discoverable / resident-credential path.
-   */
-  username?: string;
-  deviceId?: string;
-  deviceName?: string;
-  deviceFingerprint?: string;
-}
-
-/**
- * Passkey SIGN-IN. With no `username` this is the usernameless
- * (discoverable-credential) flow; with a `username` it is username-first —
- * the server scopes `allowCredentials` to that user's passkeys so a
- * non-discoverable hardware key (U2F/security key) can be selected. Either way:
- * request login options, run the authentication ceremony, verify, then commit
- * the session. A passkey assertion is itself the strong factor — sign-in always
- * resolves to a completed session.
- */
-export async function runPasskeyLogin(deps: RunPasskeyLoginDeps): Promise<void> {
-  if (!deps.isSupported()) {
-    throw new Error(PASSKEY_UNSUPPORTED_MESSAGE);
-  }
-  const options = await deps.getLoginOptions(deps.username);
-  const response = await deps.runCeremony(options);
-  const result = await deps.loginVerify(response, {
-    deviceName: deps.deviceName,
-    deviceFingerprint: deps.deviceFingerprint,
-    deviceId: deps.deviceId,
-  });
-  await deps.commit(toCommitInput(result));
-}
-
-/** Injected dependencies for {@link runPasskeyAdd}. */
-export interface RunPasskeyAddDeps {
-  isSupported: () => boolean;
-  getRegisterOptions: () => Promise<unknown>;
-  runCeremony: (optionsJSON: unknown) => Promise<unknown>;
-  registerVerify: (
-    response: unknown,
-    envelope: { deviceName?: string },
-  ) => Promise<PasskeyRegisterVerifyResult>;
-  onLinked: () => void;
-  deviceName?: string;
-}
-
-/**
- * ADD a passkey to the already-signed-in account (bearer present). The verify
- * link branch returns `{ success, message }` with NO session — so this never
- * commits a session; it just fires `onLinked` (which invalidates the
- * auth-methods query). A session arm here would be a server contract violation.
- */
-export async function runPasskeyAdd(deps: RunPasskeyAddDeps): Promise<void> {
-  if (!deps.isSupported()) {
-    throw new Error(PASSKEY_UNSUPPORTED_MESSAGE);
-  }
-  const options = await deps.getRegisterOptions();
-  const response = await deps.runCeremony(options);
-  const result = await deps.registerVerify(response, { deviceName: deps.deviceName });
-  if ('sessionId' in result) {
-    throw new Error('addPasskey unexpectedly minted a new session instead of linking.');
-  }
-  deps.onLinked();
-}
-
-/** Injected dependencies for {@link runPasskeyRegisterSignIn}. */
-export interface RunPasskeyRegisterSignInDeps {
-  isSupported: () => boolean;
-  getRegisterOptions: () => Promise<unknown>;
-  runCeremony: (optionsJSON: unknown) => Promise<unknown>;
-  registerVerify: (response: unknown) => Promise<PasskeyRegisterVerifyResult>;
-  commit: (result: LoginSessionResult) => Promise<void>;
-}
-
-/**
- * Register a passkey SIGNED OUT and sign in with the account it belongs to —
- * a new passkey account (username + confirmed recovery email), or a recovery's
- * new passkey (ADR 0029 D3). Options, ceremony, verify, then commit; the verify
- * must mint a session, since there is no bearer to link to.
- */
-export async function runPasskeyRegisterSignIn(deps: RunPasskeyRegisterSignInDeps): Promise<void> {
-  if (!deps.isSupported()) {
-    throw new Error(PASSKEY_UNSUPPORTED_MESSAGE);
-  }
-  const options = await deps.getRegisterOptions();
-  const response = await deps.runCeremony(options);
-  const result = await deps.registerVerify(response);
-  if (!('sessionId' in result)) {
-    throw new Error('The passkey was registered without signing in.');
-  }
-  await deps.commit(result);
-}