@oxyhq/core 1.0.0

package/dist/esm/mixins/OxyServices.privacy.js

@@ -0,0 +1,159 @@
+export function OxyServicesPrivacyMixin(Base) {
+    return class extends Base {
+        constructor(...args) {
+            super(...args);
+        }
+        /**
+         * Extract user ID from blocked/restricted user object
+         */
+        extractUserId(userIdField) {
+            return typeof userIdField === 'string' ? userIdField : userIdField._id;
+        }
+        /**
+         * Check if a user is in a list (blocked or restricted)
+         */
+        async isUserInList(userId, getUserList, getIdField) {
+            try {
+                if (!userId) {
+                    return false;
+                }
+                const users = await getUserList();
+                return users.some(item => {
+                    const itemId = this.extractUserId(getIdField(item));
+                    return itemId === userId;
+                });
+            }
+            catch (error) {
+                // If there's an error, assume not in list to avoid breaking functionality
+                if (__DEV__) {
+                    console.warn('Error checking user list:', error);
+                }
+                return false;
+            }
+        }
+        // ============================================================================
+        // BLOCKED USERS METHODS
+        // ============================================================================
+        /**
+         * Get list of blocked users
+         * @returns Array of blocked users
+         */
+        async getBlockedUsers() {
+            try {
+                return await this.makeRequest('GET', '/api/privacy/blocked', undefined, {
+                    cache: true,
+                    cacheTTL: 1 * 60 * 1000, // 1 minute cache
+                });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Block a user
+         * @param userId - The user ID to block
+         * @returns Success message
+         */
+        async blockUser(userId) {
+            try {
+                if (!userId) {
+                    throw new Error('User ID is required');
+                }
+                return await this.makeRequest('POST', `/api/privacy/blocked/${userId}`, undefined, {
+                    cache: false,
+                });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Unblock a user
+         * @param userId - The user ID to unblock
+         * @returns Success message
+         */
+        async unblockUser(userId) {
+            try {
+                if (!userId) {
+                    throw new Error('User ID is required');
+                }
+                return await this.makeRequest('DELETE', `/api/privacy/blocked/${userId}`, undefined, {
+                    cache: false,
+                });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Check if a user is blocked
+         * @param userId - The user ID to check
+         * @returns True if the user is blocked, false otherwise
+         */
+        async isUserBlocked(userId) {
+            return this.isUserInList(userId, () => this.getBlockedUsers(), (block) => block.blockedId);
+        }
+        // ============================================================================
+        // RESTRICTED USERS METHODS
+        // ============================================================================
+        /**
+         * Get list of restricted users
+         * @returns Array of restricted users
+         */
+        async getRestrictedUsers() {
+            try {
+                return await this.makeRequest('GET', '/api/privacy/restricted', undefined, {
+                    cache: true,
+                    cacheTTL: 1 * 60 * 1000, // 1 minute cache
+                });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Restrict a user (limit their interactions without fully blocking)
+         * @param userId - The user ID to restrict
+         * @returns Success message
+         */
+        async restrictUser(userId) {
+            try {
+                if (!userId) {
+                    throw new Error('User ID is required');
+                }
+                return await this.makeRequest('POST', `/api/privacy/restricted/${userId}`, undefined, {
+                    cache: false,
+                });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Unrestrict a user
+         * @param userId - The user ID to unrestrict
+         * @returns Success message
+         */
+        async unrestrictUser(userId) {
+            try {
+                if (!userId) {
+                    throw new Error('User ID is required');
+                }
+                return await this.makeRequest('DELETE', `/api/privacy/restricted/${userId}`, undefined, {
+                    cache: false,
+                });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Check if a user is restricted
+         * @param userId - The user ID to check
+         * @returns True if the user is restricted, false otherwise
+         */
+        async isUserRestricted(userId) {
+            return this.isUserInList(userId, () => this.getRestrictedUsers(), (restrict) => restrict.restrictedId);
+        }
+    };
+}

package/dist/esm/mixins/OxyServices.redirect.js

@@ -0,0 +1,343 @@
+import { OxyAuthenticationError } from '../OxyServices.errors';
+/**
+ * Redirect-based Cross-Domain Authentication Mixin
+ *
+ * Implements traditional OAuth2 redirect flow as a fallback when popup or
+ * FedCM are not available or fail (e.g., mobile browsers, popup blockers).
+ *
+ * Flow:
+ * 1. Save current URL
+ * 2. Redirect to auth.oxy.so/login
+ * 3. User signs in
+ * 4. Redirect back with token in URL
+ * 5. Extract token, restore session, clean URL
+ *
+ * Features:
+ * - Works on all browsers (including old mobile browsers)
+ * - Automatic URL cleanup after auth
+ * - State preservation option
+ * - CSRF protection via state parameter
+ *
+ * Trade-offs:
+ * - Loses JavaScript app state (full page navigation)
+ * - Visible redirect (user sees navigation)
+ * - Slower perceived performance
+ */
+export function OxyServicesRedirectAuthMixin(Base) {
+    var _a;
+    return _a = class extends Base {
+            constructor(...args) {
+                super(...args);
+            }
+            /**
+             * Sign in using full page redirect
+             *
+             * Redirects the user to auth.oxy.so for authentication. After successful
+             * sign-in, the user will be redirected back to the current page (or custom
+             * redirect URI) with authentication tokens in the URL.
+             *
+             * Call handleAuthCallback() on app startup to complete the flow.
+             *
+             * @param options - Redirect configuration options
+             *
+             * @example
+             * ```typescript
+             * // Initiate sign-in
+             * const handleSignIn = () => {
+             *   oxyServices.signInWithRedirect();
+             * };
+             *
+             * // Handle callback on app startup
+             * useEffect(() => {
+             *   const session = oxyServices.handleAuthCallback();
+             *   if (session) {
+             *     setUser(session.user);
+             *   }
+             * }, []);
+             * ```
+             */
+            signInWithRedirect(options = {}) {
+                if (typeof window === 'undefined') {
+                    throw new OxyAuthenticationError('Redirect authentication requires browser environment');
+                }
+                const redirectUri = options.redirectUri || window.location.href;
+                const mode = options.mode || 'login';
+                const state = this.generateState();
+                const nonce = this.generateNonce();
+                // Store state for CSRF protection
+                this.storeAuthState(state, nonce);
+                // Save current URL to restore after auth (optional)
+                if (options.preserveUrl !== false) {
+                    this.savePreAuthUrl(window.location.href);
+                }
+                const authUrl = this.buildAuthUrl({
+                    mode,
+                    redirectUri,
+                    state,
+                    nonce,
+                    clientId: window.location.origin,
+                });
+                // Perform redirect
+                window.location.href = authUrl;
+            }
+            /**
+             * Sign up using full page redirect
+             *
+             * Same as signInWithRedirect but opens the signup page by default.
+             */
+            signUpWithRedirect(options = {}) {
+                this.signInWithRedirect({ ...options, mode: 'signup' });
+            }
+            /**
+             * Handle authentication callback
+             *
+             * Call this on app startup to check if the current page load is a
+             * redirect back from the authentication server. If it is, this method
+             * will extract the tokens, store them, and clean up the URL.
+             *
+             * @returns Session data if this is a callback, null otherwise
+             * @throws {OxyAuthenticationError} If state validation fails (CSRF attack)
+             *
+             * @example
+             * ```typescript
+             * // In your app's root component or startup logic
+             * useEffect(() => {
+             *   try {
+             *     const session = oxyServices.handleAuthCallback();
+             *     if (session) {
+             *       console.log('Logged in:', session.user);
+             *       setUser(session.user);
+             *     } else {
+             *       // Not a callback, check for existing session
+             *       const restored = oxyServices.restoreSession();
+             *       if (!restored) {
+             *         // No session, show login button
+             *       }
+             *     }
+             *   } catch (error) {
+             *     console.error('Auth callback failed:', error);
+             *   }
+             * }, []);
+             * ```
+             */
+            handleAuthCallback() {
+                if (typeof window === 'undefined') {
+                    return null;
+                }
+                const url = new URL(window.location.href);
+                const accessToken = url.searchParams.get('access_token');
+                const sessionId = url.searchParams.get('session_id');
+                const expiresAt = url.searchParams.get('expires_at');
+                const state = url.searchParams.get('state');
+                const error = url.searchParams.get('error');
+                const errorDescription = url.searchParams.get('error_description');
+                // Check if this is an error callback
+                if (error) {
+                    this.clearAuthState();
+                    throw new OxyAuthenticationError(errorDescription || error);
+                }
+                // Check if this is an auth callback
+                if (!accessToken || !sessionId) {
+                    return null; // Not a callback
+                }
+                // Verify state to prevent CSRF attacks
+                const savedState = this.getStoredState();
+                if (!savedState || state !== savedState) {
+                    this.clearAuthState();
+                    throw new OxyAuthenticationError('Invalid state parameter. Possible CSRF attack.');
+                }
+                // Store tokens
+                this.storeTokens(accessToken, sessionId);
+                this.httpService.setTokens(accessToken);
+                // Build session response (minimal - we'll fetch full user data separately)
+                const session = {
+                    sessionId,
+                    deviceId: '', // Not available in redirect flow
+                    expiresAt: expiresAt || new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),
+                    user: {}, // Will be fetched separately
+                };
+                // Clean up URL (remove auth parameters)
+                this.cleanAuthCallbackUrl(url);
+                // Clean up storage
+                this.clearAuthState();
+                return session;
+            }
+            /**
+             * Restore session from storage
+             *
+             * Attempts to restore a previously authenticated session from localStorage.
+             * Call this on app startup if handleAuthCallback() returns null.
+             *
+             * @returns True if session was restored, false otherwise
+             *
+             * @example
+             * ```typescript
+             * useEffect(() => {
+             *   const session = oxyServices.handleAuthCallback();
+             *   if (!session) {
+             *     const restored = oxyServices.restoreSession();
+             *     if (!restored) {
+             *       // No session, user needs to sign in
+             *       setShowLogin(true);
+             *     }
+             *   }
+             * }, []);
+             * ```
+             */
+            restoreSession() {
+                if (typeof window === 'undefined') {
+                    return false;
+                }
+                const token = localStorage.getItem(this.constructor.TOKEN_STORAGE_KEY);
+                const sessionId = localStorage.getItem(this.constructor.SESSION_STORAGE_KEY);
+                if (token && sessionId) {
+                    this.httpService.setTokens(token);
+                    return true;
+                }
+                return false;
+            }
+            /**
+             * Clear stored session
+             *
+             * Removes all authentication data from storage. Call this on logout.
+             */
+            clearStoredSession() {
+                if (typeof window === 'undefined') {
+                    return;
+                }
+                localStorage.removeItem(this.constructor.TOKEN_STORAGE_KEY);
+                localStorage.removeItem(this.constructor.SESSION_STORAGE_KEY);
+                this.httpService.clearTokens();
+            }
+            /**
+             * Get stored session ID
+             */
+            getStoredSessionId() {
+                if (typeof window === 'undefined') {
+                    return null;
+                }
+                return localStorage.getItem(this.constructor.SESSION_STORAGE_KEY);
+            }
+            /**
+             * Build authentication URL with query parameters
+             *
+             * @private
+             */
+            buildAuthUrl(params) {
+                const url = new URL(`${this.constructor.AUTH_URL}/${params.mode}`);
+                url.searchParams.set('redirect_uri', params.redirectUri);
+                url.searchParams.set('state', params.state);
+                url.searchParams.set('nonce', params.nonce);
+                url.searchParams.set('client_id', params.clientId);
+                url.searchParams.set('response_type', 'token');
+                return url.toString();
+            }
+            /**
+             * Store tokens in localStorage
+             *
+             * @private
+             */
+            storeTokens(accessToken, sessionId) {
+                if (typeof window === 'undefined') {
+                    return;
+                }
+                localStorage.setItem(this.constructor.TOKEN_STORAGE_KEY, accessToken);
+                localStorage.setItem(this.constructor.SESSION_STORAGE_KEY, sessionId);
+            }
+            /**
+             * Generate cryptographically secure state for CSRF protection
+             *
+             * @private
+             */
+            generateState() {
+                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
+                    return window.crypto.randomUUID();
+                }
+                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+            }
+            /**
+             * Generate nonce for replay attack prevention
+             *
+             * @private
+             */
+            generateNonce() {
+                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
+                    return window.crypto.randomUUID();
+                }
+                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+            }
+            /**
+             * Store auth state in session storage
+             *
+             * @private
+             */
+            storeAuthState(state, nonce) {
+                if (typeof window === 'undefined') {
+                    return;
+                }
+                sessionStorage.setItem(this.constructor.STATE_STORAGE_KEY, state);
+                sessionStorage.setItem(this.constructor.NONCE_STORAGE_KEY, nonce);
+            }
+            /**
+             * Get stored state
+             *
+             * @private
+             */
+            getStoredState() {
+                if (typeof window === 'undefined') {
+                    return null;
+                }
+                return sessionStorage.getItem(this.constructor.STATE_STORAGE_KEY);
+            }
+            /**
+             * Clear auth state from storage
+             *
+             * @private
+             */
+            clearAuthState() {
+                if (typeof window === 'undefined') {
+                    return;
+                }
+                sessionStorage.removeItem(this.constructor.STATE_STORAGE_KEY);
+                sessionStorage.removeItem(this.constructor.NONCE_STORAGE_KEY);
+                sessionStorage.removeItem(this.constructor.PRE_AUTH_URL_KEY);
+            }
+            /**
+             * Save pre-authentication URL to restore later
+             *
+             * @private
+             */
+            savePreAuthUrl(url) {
+                if (typeof window === 'undefined') {
+                    return;
+                }
+                sessionStorage.setItem(this.constructor.PRE_AUTH_URL_KEY, url);
+            }
+            /**
+             * Clean authentication parameters from URL
+             *
+             * @private
+             */
+            cleanAuthCallbackUrl(url) {
+                // Remove auth parameters
+                url.searchParams.delete('access_token');
+                url.searchParams.delete('session_id');
+                url.searchParams.delete('expires_at');
+                url.searchParams.delete('state');
+                url.searchParams.delete('nonce');
+                url.searchParams.delete('error');
+                url.searchParams.delete('error_description');
+                // Update URL without reloading page
+                window.history.replaceState({}, '', url.toString());
+            }
+        },
+        _a.AUTH_URL = 'https://auth.oxy.so',
+        _a.TOKEN_STORAGE_KEY = 'oxy_access_token',
+        _a.SESSION_STORAGE_KEY = 'oxy_session_id',
+        _a.STATE_STORAGE_KEY = 'oxy_auth_state',
+        _a.PRE_AUTH_URL_KEY = 'oxy_pre_auth_url',
+        _a.NONCE_STORAGE_KEY = 'oxy_auth_nonce',
+        _a;
+}
+// Export the mixin function as both named and default
+export { OxyServicesRedirectAuthMixin as RedirectAuthMixin };

package/dist/esm/mixins/OxyServices.security.js

@@ -0,0 +1,78 @@
+export function OxyServicesSecurityMixin(Base) {
+    return class extends Base {
+        constructor(...args) {
+            super(...args);
+        }
+        /**
+         * Get user's security activity with pagination
+         * @param limit - Number of results (default: 50, max: 100)
+         * @param offset - Pagination offset (default: 0)
+         * @param eventType - Optional filter by event type
+         * @returns Security activity response with pagination
+         */
+        async getSecurityActivity(limit, offset, eventType) {
+            try {
+                const params = {};
+                if (limit !== undefined)
+                    params.limit = limit;
+                if (offset !== undefined)
+                    params.offset = offset;
+                if (eventType)
+                    params.eventType = eventType;
+                const response = await this.makeRequest('GET', '/api/security/activity', params, { cache: false });
+                return response;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Get recent security activity (convenience method)
+         * @param limit - Number of recent events to fetch (default: 10)
+         * @returns Array of recent security activities
+         */
+        async getRecentSecurityActivity(limit = 10) {
+            try {
+                const response = await this.getSecurityActivity(limit, 0);
+                return response.data || [];
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Log private key exported event
+         * @param deviceId - Optional device ID for tracking
+         * @returns Promise that resolves when event is logged
+         */
+        async logPrivateKeyExported(deviceId) {
+            try {
+                await this.makeRequest('POST', '/api/security/activity/private-key-exported', { deviceId }, { cache: false });
+            }
+            catch (error) {
+                // Don't throw - logging failures shouldn't break user flow
+                // But log for monitoring
+                if (__DEV__) {
+                    console.warn('[OxyServices] Failed to log private key exported event:', error);
+                }
+            }
+        }
+        /**
+         * Log backup created event
+         * @param deviceId - Optional device ID for tracking
+         * @returns Promise that resolves when event is logged
+         */
+        async logBackupCreated(deviceId) {
+            try {
+                await this.makeRequest('POST', '/api/security/activity/backup-created', { deviceId }, { cache: false });
+            }
+            catch (error) {
+                // Don't throw - logging failures shouldn't break user flow
+                // But log for monitoring
+                if (__DEV__) {
+                    console.warn('[OxyServices] Failed to log backup created event:', error);
+                }
+            }
+        }
+    };
+}