@oxyhq/core 1.0.0

package/src/mixins/OxyServices.redirect.ts

@@ -0,0 +1,397 @@
+import type { OxyServicesBase } from '../OxyServices.base';
+import { OxyAuthenticationError } from '../OxyServices.errors';
+import type { SessionLoginResponse } from '../models/session';
+
+export interface RedirectAuthOptions {
+  redirectUri?: string;
+  mode?: 'login' | 'signup';
+  preserveUrl?: boolean;
+}
+
+/**
+ * Redirect-based Cross-Domain Authentication Mixin
+ *
+ * Implements traditional OAuth2 redirect flow as a fallback when popup or
+ * FedCM are not available or fail (e.g., mobile browsers, popup blockers).
+ *
+ * Flow:
+ * 1. Save current URL
+ * 2. Redirect to auth.oxy.so/login
+ * 3. User signs in
+ * 4. Redirect back with token in URL
+ * 5. Extract token, restore session, clean URL
+ *
+ * Features:
+ * - Works on all browsers (including old mobile browsers)
+ * - Automatic URL cleanup after auth
+ * - State preservation option
+ * - CSRF protection via state parameter
+ *
+ * Trade-offs:
+ * - Loses JavaScript app state (full page navigation)
+ * - Visible redirect (user sees navigation)
+ * - Slower perceived performance
+ */
+export function OxyServicesRedirectAuthMixin<T extends typeof OxyServicesBase>(Base: T) {
+  return class extends Base {
+    constructor(...args: any[]) {
+      super(...(args as [any]));
+    }
+  public static readonly AUTH_URL = 'https://auth.oxy.so';
+  public static readonly TOKEN_STORAGE_KEY = 'oxy_access_token';
+  public static readonly SESSION_STORAGE_KEY = 'oxy_session_id';
+  public static readonly STATE_STORAGE_KEY = 'oxy_auth_state';
+  public static readonly PRE_AUTH_URL_KEY = 'oxy_pre_auth_url';
+  public static readonly NONCE_STORAGE_KEY = 'oxy_auth_nonce';
+
+  /**
+   * Sign in using full page redirect
+   *
+   * Redirects the user to auth.oxy.so for authentication. After successful
+   * sign-in, the user will be redirected back to the current page (or custom
+   * redirect URI) with authentication tokens in the URL.
+   *
+   * Call handleAuthCallback() on app startup to complete the flow.
+   *
+   * @param options - Redirect configuration options
+   *
+   * @example
+   * ```typescript
+   * // Initiate sign-in
+   * const handleSignIn = () => {
+   *   oxyServices.signInWithRedirect();
+   * };
+   *
+   * // Handle callback on app startup
+   * useEffect(() => {
+   *   const session = oxyServices.handleAuthCallback();
+   *   if (session) {
+   *     setUser(session.user);
+   *   }
+   * }, []);
+   * ```
+   */
+  signInWithRedirect(options: RedirectAuthOptions = {}): void {
+    if (typeof window === 'undefined') {
+      throw new OxyAuthenticationError('Redirect authentication requires browser environment');
+    }
+
+    const redirectUri = options.redirectUri || window.location.href;
+    const mode = options.mode || 'login';
+    const state = this.generateState();
+    const nonce = this.generateNonce();
+
+    // Store state for CSRF protection
+    this.storeAuthState(state, nonce);
+
+    // Save current URL to restore after auth (optional)
+    if (options.preserveUrl !== false) {
+      this.savePreAuthUrl(window.location.href);
+    }
+
+    const authUrl = this.buildAuthUrl({
+      mode,
+      redirectUri,
+      state,
+      nonce,
+      clientId: window.location.origin,
+    });
+
+    // Perform redirect
+    window.location.href = authUrl;
+  }
+
+  /**
+   * Sign up using full page redirect
+   *
+   * Same as signInWithRedirect but opens the signup page by default.
+   */
+  signUpWithRedirect(options: RedirectAuthOptions = {}): void {
+    this.signInWithRedirect({ ...options, mode: 'signup' });
+  }
+
+  /**
+   * Handle authentication callback
+   *
+   * Call this on app startup to check if the current page load is a
+   * redirect back from the authentication server. If it is, this method
+   * will extract the tokens, store them, and clean up the URL.
+   *
+   * @returns Session data if this is a callback, null otherwise
+   * @throws {OxyAuthenticationError} If state validation fails (CSRF attack)
+   *
+   * @example
+   * ```typescript
+   * // In your app's root component or startup logic
+   * useEffect(() => {
+   *   try {
+   *     const session = oxyServices.handleAuthCallback();
+   *     if (session) {
+   *       console.log('Logged in:', session.user);
+   *       setUser(session.user);
+   *     } else {
+   *       // Not a callback, check for existing session
+   *       const restored = oxyServices.restoreSession();
+   *       if (!restored) {
+   *         // No session, show login button
+   *       }
+   *     }
+   *   } catch (error) {
+   *     console.error('Auth callback failed:', error);
+   *   }
+   * }, []);
+   * ```
+   */
+  handleAuthCallback(): SessionLoginResponse | null {
+    if (typeof window === 'undefined') {
+      return null;
+    }
+
+    const url = new URL(window.location.href);
+    const accessToken = url.searchParams.get('access_token');
+    const sessionId = url.searchParams.get('session_id');
+    const expiresAt = url.searchParams.get('expires_at');
+    const state = url.searchParams.get('state');
+    const error = url.searchParams.get('error');
+    const errorDescription = url.searchParams.get('error_description');
+
+    // Check if this is an error callback
+    if (error) {
+      this.clearAuthState();
+      throw new OxyAuthenticationError(errorDescription || error);
+    }
+
+    // Check if this is an auth callback
+    if (!accessToken || !sessionId) {
+      return null; // Not a callback
+    }
+
+    // Verify state to prevent CSRF attacks
+    const savedState = this.getStoredState();
+    if (!savedState || state !== savedState) {
+      this.clearAuthState();
+      throw new OxyAuthenticationError('Invalid state parameter. Possible CSRF attack.');
+    }
+
+    // Store tokens
+    this.storeTokens(accessToken, sessionId);
+    this.httpService.setTokens(accessToken);
+
+    // Build session response (minimal - we'll fetch full user data separately)
+    const session: SessionLoginResponse = {
+      sessionId,
+      deviceId: '', // Not available in redirect flow
+      expiresAt: expiresAt || new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),
+      user: {} as any, // Will be fetched separately
+    };
+
+    // Clean up URL (remove auth parameters)
+    this.cleanAuthCallbackUrl(url);
+
+    // Clean up storage
+    this.clearAuthState();
+
+    return session;
+  }
+
+  /**
+   * Restore session from storage
+   *
+   * Attempts to restore a previously authenticated session from localStorage.
+   * Call this on app startup if handleAuthCallback() returns null.
+   *
+   * @returns True if session was restored, false otherwise
+   *
+   * @example
+   * ```typescript
+   * useEffect(() => {
+   *   const session = oxyServices.handleAuthCallback();
+   *   if (!session) {
+   *     const restored = oxyServices.restoreSession();
+   *     if (!restored) {
+   *       // No session, user needs to sign in
+   *       setShowLogin(true);
+   *     }
+   *   }
+   * }, []);
+   * ```
+   */
+  restoreSession(): boolean {
+    if (typeof window === 'undefined') {
+      return false;
+    }
+
+    const token = localStorage.getItem((this.constructor as any).TOKEN_STORAGE_KEY);
+    const sessionId = localStorage.getItem((this.constructor as any).SESSION_STORAGE_KEY);
+
+    if (token && sessionId) {
+      this.httpService.setTokens(token);
+      return true;
+    }
+
+    return false;
+  }
+
+  /**
+   * Clear stored session
+   *
+   * Removes all authentication data from storage. Call this on logout.
+   */
+  clearStoredSession(): void {
+    if (typeof window === 'undefined') {
+      return;
+    }
+
+    localStorage.removeItem((this.constructor as any).TOKEN_STORAGE_KEY);
+    localStorage.removeItem((this.constructor as any).SESSION_STORAGE_KEY);
+    this.httpService.clearTokens();
+  }
+
+  /**
+   * Get stored session ID
+   */
+  getStoredSessionId(): string | null {
+    if (typeof window === 'undefined') {
+      return null;
+    }
+
+    return localStorage.getItem((this.constructor as any).SESSION_STORAGE_KEY);
+  }
+
+  /**
+   * Build authentication URL with query parameters
+   *
+   * @private
+   */
+  public buildAuthUrl(params: {
+    mode: string;
+    redirectUri: string;
+    state: string;
+    nonce: string;
+    clientId: string;
+  }): string {
+    const url = new URL(`${(this.constructor as any).AUTH_URL}/${params.mode}`);
+    url.searchParams.set('redirect_uri', params.redirectUri);
+    url.searchParams.set('state', params.state);
+    url.searchParams.set('nonce', params.nonce);
+    url.searchParams.set('client_id', params.clientId);
+    url.searchParams.set('response_type', 'token');
+    return url.toString();
+  }
+
+  /**
+   * Store tokens in localStorage
+   *
+   * @private
+   */
+  public storeTokens(accessToken: string, sessionId: string): void {
+    if (typeof window === 'undefined') {
+      return;
+    }
+
+    localStorage.setItem((this.constructor as any).TOKEN_STORAGE_KEY, accessToken);
+    localStorage.setItem((this.constructor as any).SESSION_STORAGE_KEY, sessionId);
+  }
+
+  /**
+   * Generate cryptographically secure state for CSRF protection
+   *
+   * @private
+   */
+  public generateState(): string {
+    if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
+      return window.crypto.randomUUID();
+    }
+    return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+  }
+
+  /**
+   * Generate nonce for replay attack prevention
+   *
+   * @private
+   */
+  public generateNonce(): string {
+    if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
+      return window.crypto.randomUUID();
+    }
+    return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+  }
+
+  /**
+   * Store auth state in session storage
+   *
+   * @private
+   */
+  public storeAuthState(state: string, nonce: string): void {
+    if (typeof window === 'undefined') {
+      return;
+    }
+
+    sessionStorage.setItem((this.constructor as any).STATE_STORAGE_KEY, state);
+    sessionStorage.setItem((this.constructor as any).NONCE_STORAGE_KEY, nonce);
+  }
+
+  /**
+   * Get stored state
+   *
+   * @private
+   */
+  public getStoredState(): string | null {
+    if (typeof window === 'undefined') {
+      return null;
+    }
+
+    return sessionStorage.getItem((this.constructor as any).STATE_STORAGE_KEY);
+  }
+
+  /**
+   * Clear auth state from storage
+   *
+   * @private
+   */
+  public clearAuthState(): void {
+    if (typeof window === 'undefined') {
+      return;
+    }
+
+    sessionStorage.removeItem((this.constructor as any).STATE_STORAGE_KEY);
+    sessionStorage.removeItem((this.constructor as any).NONCE_STORAGE_KEY);
+    sessionStorage.removeItem((this.constructor as any).PRE_AUTH_URL_KEY);
+  }
+
+  /**
+   * Save pre-authentication URL to restore later
+   *
+   * @private
+   */
+  public savePreAuthUrl(url: string): void {
+    if (typeof window === 'undefined') {
+      return;
+    }
+
+    sessionStorage.setItem((this.constructor as any).PRE_AUTH_URL_KEY, url);
+  }
+
+  /**
+   * Clean authentication parameters from URL
+   *
+   * @private
+   */
+  public cleanAuthCallbackUrl(url: URL): void {
+    // Remove auth parameters
+    url.searchParams.delete('access_token');
+    url.searchParams.delete('session_id');
+    url.searchParams.delete('expires_at');
+    url.searchParams.delete('state');
+    url.searchParams.delete('nonce');
+    url.searchParams.delete('error');
+    url.searchParams.delete('error_description');
+
+    // Update URL without reloading page
+    window.history.replaceState({}, '', url.toString());
+  }
+  };
+}
+
+// Export the mixin function as both named and default
+export { OxyServicesRedirectAuthMixin as RedirectAuthMixin };

package/src/mixins/OxyServices.security.ts

@@ -0,0 +1,103 @@
+/**
+ * Security Methods Mixin
+ */
+import type { OxyServicesBase } from '../OxyServices.base';
+import type { SecurityActivity, SecurityActivityResponse, SecurityEventType } from '../models/interfaces';
+
+export function OxyServicesSecurityMixin<T extends typeof OxyServicesBase>(Base: T) {
+  return class extends Base {
+    constructor(...args: any[]) {
+      super(...(args as [any]));
+    }
+
+    /**
+     * Get user's security activity with pagination
+     * @param limit - Number of results (default: 50, max: 100)
+     * @param offset - Pagination offset (default: 0)
+     * @param eventType - Optional filter by event type
+     * @returns Security activity response with pagination
+     */
+    async getSecurityActivity(
+      limit?: number,
+      offset?: number,
+      eventType?: SecurityEventType
+    ): Promise<SecurityActivityResponse> {
+      try {
+        const params: any = {};
+        if (limit !== undefined) params.limit = limit;
+        if (offset !== undefined) params.offset = offset;
+        if (eventType) params.eventType = eventType;
+
+        const response = await this.makeRequest<SecurityActivityResponse>(
+          'GET',
+          '/api/security/activity',
+          params,
+          { cache: false }
+        );
+
+        return response;
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    /**
+     * Get recent security activity (convenience method)
+     * @param limit - Number of recent events to fetch (default: 10)
+     * @returns Array of recent security activities
+     */
+    async getRecentSecurityActivity(limit: number = 10): Promise<SecurityActivity[]> {
+      try {
+        const response = await this.getSecurityActivity(limit, 0);
+        return response.data || [];
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    /**
+     * Log private key exported event
+     * @param deviceId - Optional device ID for tracking
+     * @returns Promise that resolves when event is logged
+     */
+    async logPrivateKeyExported(deviceId?: string): Promise<void> {
+      try {
+        await this.makeRequest<{ success: boolean }>(
+          'POST',
+          '/api/security/activity/private-key-exported',
+          { deviceId },
+          { cache: false }
+        );
+      } catch (error) {
+        // Don't throw - logging failures shouldn't break user flow
+        // But log for monitoring
+        if (__DEV__) {
+          console.warn('[OxyServices] Failed to log private key exported event:', error);
+        }
+      }
+    }
+
+    /**
+     * Log backup created event
+     * @param deviceId - Optional device ID for tracking
+     * @returns Promise that resolves when event is logged
+     */
+    async logBackupCreated(deviceId?: string): Promise<void> {
+      try {
+        await this.makeRequest<{ success: boolean }>(
+          'POST',
+          '/api/security/activity/backup-created',
+          { deviceId },
+          { cache: false }
+        );
+      } catch (error) {
+        // Don't throw - logging failures shouldn't break user flow
+        // But log for monitoring
+        if (__DEV__) {
+          console.warn('[OxyServices] Failed to log backup created event:', error);
+        }
+      }
+    }
+  };
+}
+