@oxyhq/core 1.1.0 → 1.2.0

package/dist/cjs/AuthManager.js

@@ -103,6 +103,7 @@ class AuthManager {
         this.listeners = new Set();
         this.currentUser = null;
         this.refreshTimer = null;
+        this.refreshPromise = null;
         this.oxyServices = oxyServices;
         this.config = {
             storage: config.storage ?? this.getDefaultStorage(),
@@ -203,9 +204,23 @@ class AuthManager {
         }
     }
     /**
-     * Refresh the access token.
+     * Refresh the access token. Deduplicates concurrent calls so only one
+     * refresh request is in-flight at a time.
      */
     async refreshToken() {
+        // If a refresh is already in-flight, return the same promise
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        this.refreshPromise = this._doRefreshToken();
+        try {
+            return await this.refreshPromise;
+        }
+        finally {
+            this.refreshPromise = null;
+        }
+    }
+    async _doRefreshToken() {
         const refreshToken = await this.storage.getItem(STORAGE_KEYS.REFRESH_TOKEN);
         if (!refreshToken) {
             return false;

package/dist/cjs/HttpService.js

@@ -85,6 +85,7 @@ class TokenStore {
  */
 class HttpService {
     constructor(config) {
+        this.tokenRefreshPromise = null;
         // Performance monitoring
         this.requestMetrics = {
             totalRequests: 0,
@@ -448,24 +449,17 @@ class HttpService {
             const currentTime = Math.floor(Date.now() / 1000);
             // If token expires in less than 60 seconds, refresh it
             if (decoded.exp && decoded.exp - currentTime < 60 && decoded.sessionId) {
+                // Deduplicate concurrent refresh attempts
+                if (!this.tokenRefreshPromise) {
+                    this.tokenRefreshPromise = this._refreshTokenFromSession(decoded.sessionId);
+                }
                 try {
-                    const refreshUrl = `${this.baseURL}/api/session/token/${decoded.sessionId}`;
-                    // Use AbortSignal.timeout for consistent timeout handling
-                    const response = await fetch(refreshUrl, {
-                        method: 'GET',
-                        headers: { 'Accept': 'application/json' },
-                        signal: AbortSignal.timeout(5000),
-                        credentials: 'include', // Include cookies for cross-origin requests
-                    });
-                    if (response.ok) {
-                        const { accessToken: newToken } = await response.json();
-                        this.tokenStore.setTokens(newToken);
-                        this.logger.debug('Token refreshed');
-                        return `Bearer ${newToken}`;
-                    }
+                    const result = await this.tokenRefreshPromise;
+                    if (result)
+                        return result;
                 }
-                catch (refreshError) {
-                    this.logger.warn('Token refresh failed, using current token');
+                finally {
+                    this.tokenRefreshPromise = null;
                 }
             }
             return `Bearer ${accessToken}`;
@@ -475,6 +469,27 @@ class HttpService {
             return `Bearer ${accessToken}`;
         }
     }
+    async _refreshTokenFromSession(sessionId) {
+        try {
+            const refreshUrl = `${this.baseURL}/api/session/token/${sessionId}`;
+            const response = await fetch(refreshUrl, {
+                method: 'GET',
+                headers: { 'Accept': 'application/json' },
+                signal: AbortSignal.timeout(5000),
+                credentials: 'include',
+            });
+            if (response.ok) {
+                const { accessToken: newToken } = await response.json();
+                this.tokenStore.setTokens(newToken);
+                this.logger.debug('Token refreshed');
+                return `Bearer ${newToken}`;
+            }
+        }
+        catch (refreshError) {
+            this.logger.warn('Token refresh failed, using current token');
+        }
+        return null;
+    }
     /**
      * Unwrap standardized API response format
      */

package/dist/cjs/mixins/OxyServices.fedcm.js

@@ -380,11 +380,15 @@ function OxyServicesFedCMMixin(Base) {
              * @private
              */
             generateNonce() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
                 }
-                // Fallback for older browsers
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+                }
+                throw new Error('No secure random source available for nonce generation');
             }
             /**
              * Get the client ID for this origin

package/dist/cjs/mixins/OxyServices.popup.js

@@ -323,10 +323,15 @@ function OxyServicesPopupAuthMixin(Base) {
              * @private
              */
             generateState() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+                }
+                throw new Error('No secure random source available for state generation');
             }
             /**
              * Generate nonce for replay attack prevention
@@ -334,10 +339,15 @@ function OxyServicesPopupAuthMixin(Base) {
              * @private
              */
             generateNonce() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
+                }
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                throw new Error('No secure random source available for nonce generation');
             }
             /**
              * Store auth state in session storage

package/dist/cjs/mixins/OxyServices.redirect.js

@@ -254,10 +254,15 @@ function OxyServicesRedirectAuthMixin(Base) {
              * @private
              */
             generateState() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+                }
+                throw new Error('No secure random source available for state generation');
             }
             /**
              * Generate nonce for replay attack prevention
@@ -265,10 +270,15 @@ function OxyServicesRedirectAuthMixin(Base) {
              * @private
              */
             generateNonce() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
+                }
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                throw new Error('No secure random source available for nonce generation');
             }
             /**
              * Store auth state in session storage

package/dist/cjs/utils/deviceManager.js

@@ -171,16 +171,12 @@ class DeviceManager {
      * Generate a unique device ID
      */
     static generateDeviceId() {
-        // Use crypto.getRandomValues if available, otherwise fallback to Math.random
         if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
             const array = new Uint8Array(32);
             crypto.getRandomValues(array);
             return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');
         }
-        else {
-            // Fallback for environments without crypto.getRandomValues
-            return 'device_' + Date.now().toString(36) + Math.random().toString(36).substr(2);
-        }
+        throw new Error('No secure random source available for device ID generation');
     }
     /**
      * Get a user-friendly device name based on platform

package/dist/esm/AuthManager.js

@@ -99,6 +99,7 @@ export class AuthManager {
         this.listeners = new Set();
         this.currentUser = null;
         this.refreshTimer = null;
+        this.refreshPromise = null;
         this.oxyServices = oxyServices;
         this.config = {
             storage: config.storage ?? this.getDefaultStorage(),
@@ -199,9 +200,23 @@ export class AuthManager {
         }
     }
     /**
-     * Refresh the access token.
+     * Refresh the access token. Deduplicates concurrent calls so only one
+     * refresh request is in-flight at a time.
      */
     async refreshToken() {
+        // If a refresh is already in-flight, return the same promise
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        this.refreshPromise = this._doRefreshToken();
+        try {
+            return await this.refreshPromise;
+        }
+        finally {
+            this.refreshPromise = null;
+        }
+    }
+    async _doRefreshToken() {
         const refreshToken = await this.storage.getItem(STORAGE_KEYS.REFRESH_TOKEN);
         if (!refreshToken) {
             return false;

package/dist/esm/HttpService.js

@@ -82,6 +82,7 @@ class TokenStore {
  */
 export class HttpService {
     constructor(config) {
+        this.tokenRefreshPromise = null;
         // Performance monitoring
         this.requestMetrics = {
             totalRequests: 0,
@@ -445,24 +446,17 @@ export class HttpService {
             const currentTime = Math.floor(Date.now() / 1000);
             // If token expires in less than 60 seconds, refresh it
             if (decoded.exp && decoded.exp - currentTime < 60 && decoded.sessionId) {
+                // Deduplicate concurrent refresh attempts
+                if (!this.tokenRefreshPromise) {
+                    this.tokenRefreshPromise = this._refreshTokenFromSession(decoded.sessionId);
+                }
                 try {
-                    const refreshUrl = `${this.baseURL}/api/session/token/${decoded.sessionId}`;
-                    // Use AbortSignal.timeout for consistent timeout handling
-                    const response = await fetch(refreshUrl, {
-                        method: 'GET',
-                        headers: { 'Accept': 'application/json' },
-                        signal: AbortSignal.timeout(5000),
-                        credentials: 'include', // Include cookies for cross-origin requests
-                    });
-                    if (response.ok) {
-                        const { accessToken: newToken } = await response.json();
-                        this.tokenStore.setTokens(newToken);
-                        this.logger.debug('Token refreshed');
-                        return `Bearer ${newToken}`;
-                    }
+                    const result = await this.tokenRefreshPromise;
+                    if (result)
+                        return result;
                 }
-                catch (refreshError) {
-                    this.logger.warn('Token refresh failed, using current token');
+                finally {
+                    this.tokenRefreshPromise = null;
                 }
             }
             return `Bearer ${accessToken}`;
@@ -472,6 +466,27 @@ export class HttpService {
             return `Bearer ${accessToken}`;
         }
     }
+    async _refreshTokenFromSession(sessionId) {
+        try {
+            const refreshUrl = `${this.baseURL}/api/session/token/${sessionId}`;
+            const response = await fetch(refreshUrl, {
+                method: 'GET',
+                headers: { 'Accept': 'application/json' },
+                signal: AbortSignal.timeout(5000),
+                credentials: 'include',
+            });
+            if (response.ok) {
+                const { accessToken: newToken } = await response.json();
+                this.tokenStore.setTokens(newToken);
+                this.logger.debug('Token refreshed');
+                return `Bearer ${newToken}`;
+            }
+        }
+        catch (refreshError) {
+            this.logger.warn('Token refresh failed, using current token');
+        }
+        return null;
+    }
     /**
      * Unwrap standardized API response format
      */

package/dist/esm/mixins/OxyServices.fedcm.js

@@ -376,11 +376,15 @@ export function OxyServicesFedCMMixin(Base) {
              * @private
              */
             generateNonce() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
                 }
-                // Fallback for older browsers
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+                }
+                throw new Error('No secure random source available for nonce generation');
             }
             /**
              * Get the client ID for this origin

package/dist/esm/mixins/OxyServices.popup.js

@@ -319,10 +319,15 @@ export function OxyServicesPopupAuthMixin(Base) {
              * @private
              */
             generateState() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+                }
+                throw new Error('No secure random source available for state generation');
             }
             /**
              * Generate nonce for replay attack prevention
@@ -330,10 +335,15 @@ export function OxyServicesPopupAuthMixin(Base) {
              * @private
              */
             generateNonce() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
+                }
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                throw new Error('No secure random source available for nonce generation');
             }
             /**
              * Store auth state in session storage

package/dist/esm/mixins/OxyServices.redirect.js

@@ -250,10 +250,15 @@ export function OxyServicesRedirectAuthMixin(Base) {
              * @private
              */
             generateState() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+                }
+                throw new Error('No secure random source available for state generation');
             }
             /**
              * Generate nonce for replay attack prevention
@@ -261,10 +266,15 @@ export function OxyServicesRedirectAuthMixin(Base) {
              * @private
              */
             generateNonce() {
-                if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-                    return window.crypto.randomUUID();
+                if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+                    return crypto.randomUUID();
+                }
+                if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+                    const bytes = new Uint8Array(16);
+                    crypto.getRandomValues(bytes);
+                    return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
                 }
-                return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+                throw new Error('No secure random source available for nonce generation');
             }
             /**
              * Store auth state in session storage

package/dist/esm/utils/deviceManager.js

@@ -135,16 +135,12 @@ export class DeviceManager {
      * Generate a unique device ID
      */
     static generateDeviceId() {
-        // Use crypto.getRandomValues if available, otherwise fallback to Math.random
         if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
             const array = new Uint8Array(32);
             crypto.getRandomValues(array);
             return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');
         }
-        else {
-            // Fallback for environments without crypto.getRandomValues
-            return 'device_' + Date.now().toString(36) + Math.random().toString(36).substr(2);
-        }
+        throw new Error('No secure random source available for device ID generation');
     }
     /**
      * Get a user-friendly device name based on platform

package/dist/types/AuthManager.d.ts

@@ -66,6 +66,7 @@ export declare class AuthManager {
     private listeners;
     private currentUser;
     private refreshTimer;
+    private refreshPromise;
     private config;
     constructor(oxyServices: OxyServices, config?: AuthManagerConfig);
     /**
@@ -95,9 +96,11 @@ export declare class AuthManager {
      */
     private setupTokenRefresh;
     /**
-     * Refresh the access token.
+     * Refresh the access token. Deduplicates concurrent calls so only one
+     * refresh request is in-flight at a time.
      */
     refreshToken(): Promise<boolean>;
+    private _doRefreshToken;
     /**
      * Sign out and clear all auth data.
      */

package/dist/types/HttpService.d.ts

@@ -43,6 +43,7 @@ export declare class HttpService {
     private requestQueue;
     private logger;
     private config;
+    private tokenRefreshPromise;
     private requestMetrics;
     constructor(config: OxyConfig);
     /**
@@ -72,6 +73,7 @@ export declare class HttpService {
      * Get auth header with automatic token refresh
      */
     private getAuthHeader;
+    private _refreshTokenFromSession;
     /**
      * Unwrap standardized API response format
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/AuthManager.ts

@@ -142,6 +142,7 @@ export class AuthManager {
   private listeners: Set<AuthStateChangeCallback> = new Set();
   private currentUser: MinimalUserData | null = null;
   private refreshTimer: ReturnType<typeof setTimeout> | null = null;
+  private refreshPromise: Promise<boolean> | null = null;
   private config: Required<AuthManagerConfig>;
 
   constructor(oxyServices: OxyServices, config: AuthManagerConfig = {}) {
@@ -261,9 +262,24 @@ export class AuthManager {
   }
 
   /**
-   * Refresh the access token.
+   * Refresh the access token. Deduplicates concurrent calls so only one
+   * refresh request is in-flight at a time.
    */
   async refreshToken(): Promise<boolean> {
+    // If a refresh is already in-flight, return the same promise
+    if (this.refreshPromise) {
+      return this.refreshPromise;
+    }
+
+    this.refreshPromise = this._doRefreshToken();
+    try {
+      return await this.refreshPromise;
+    } finally {
+      this.refreshPromise = null;
+    }
+  }
+
+  private async _doRefreshToken(): Promise<boolean> {
     const refreshToken = await this.storage.getItem(STORAGE_KEYS.REFRESH_TOKEN);
     if (!refreshToken) {
       return false;

package/src/HttpService.ts

@@ -131,6 +131,7 @@ export class HttpService {
   private requestQueue: RequestQueue;
   private logger: SimpleLogger;
   private config: OxyConfig;
+  private tokenRefreshPromise: Promise<string | null> | null = null;
 
   // Performance monitoring
   private requestMetrics = {
@@ -563,25 +564,15 @@ export class HttpService {
 
       // If token expires in less than 60 seconds, refresh it
       if (decoded.exp && decoded.exp - currentTime < 60 && decoded.sessionId) {
+        // Deduplicate concurrent refresh attempts
+        if (!this.tokenRefreshPromise) {
+          this.tokenRefreshPromise = this._refreshTokenFromSession(decoded.sessionId);
+        }
         try {
-          const refreshUrl = `${this.baseURL}/api/session/token/${decoded.sessionId}`;
-          
-          // Use AbortSignal.timeout for consistent timeout handling
-          const response = await fetch(refreshUrl, {
-            method: 'GET',
-            headers: { 'Accept': 'application/json' },
-            signal: AbortSignal.timeout(5000),
-            credentials: 'include', // Include cookies for cross-origin requests
-          });
-
-          if (response.ok) {
-            const { accessToken: newToken } = await response.json();
-            this.tokenStore.setTokens(newToken);
-            this.logger.debug('Token refreshed');
-            return `Bearer ${newToken}`;
-          }
-        } catch (refreshError) {
-          this.logger.warn('Token refresh failed, using current token');
+          const result = await this.tokenRefreshPromise;
+          if (result) return result;
+        } finally {
+          this.tokenRefreshPromise = null;
         }
       }
 
@@ -592,6 +583,28 @@ export class HttpService {
     }
   }
 
+  private async _refreshTokenFromSession(sessionId: string): Promise<string | null> {
+    try {
+      const refreshUrl = `${this.baseURL}/api/session/token/${sessionId}`;
+      const response = await fetch(refreshUrl, {
+        method: 'GET',
+        headers: { 'Accept': 'application/json' },
+        signal: AbortSignal.timeout(5000),
+        credentials: 'include',
+      });
+
+      if (response.ok) {
+        const { accessToken: newToken } = await response.json();
+        this.tokenStore.setTokens(newToken);
+        this.logger.debug('Token refreshed');
+        return `Bearer ${newToken}`;
+      }
+    } catch (refreshError) {
+      this.logger.warn('Token refresh failed, using current token');
+    }
+    return null;
+  }
+
   /**
    * Unwrap standardized API response format
    */

package/src/mixins/OxyServices.fedcm.ts

@@ -439,11 +439,15 @@ export function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(Base: T)
    * @private
    */
   public generateNonce(): string {
-    if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-      return window.crypto.randomUUID();
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+      return crypto.randomUUID();
     }
-    // Fallback for older browsers
-    return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+    if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+      const bytes = new Uint8Array(16);
+      crypto.getRandomValues(bytes);
+      return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+    }
+    throw new Error('No secure random source available for nonce generation');
   }
 
   /**

package/src/mixins/OxyServices.popup.ts

@@ -397,10 +397,15 @@ export function OxyServicesPopupAuthMixin<T extends typeof OxyServicesBase>(Base
    * @private
    */
   public generateState(): string {
-    if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-      return window.crypto.randomUUID();
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+      return crypto.randomUUID();
     }
-    return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+    if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+      const bytes = new Uint8Array(16);
+      crypto.getRandomValues(bytes);
+      return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+    }
+    throw new Error('No secure random source available for state generation');
   }
 
   /**
@@ -409,10 +414,15 @@ export function OxyServicesPopupAuthMixin<T extends typeof OxyServicesBase>(Base
    * @private
    */
   public generateNonce(): string {
-    if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-      return window.crypto.randomUUID();
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+      return crypto.randomUUID();
+    }
+    if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+      const bytes = new Uint8Array(16);
+      crypto.getRandomValues(bytes);
+      return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
     }
-    return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+    throw new Error('No secure random source available for nonce generation');
   }
 
   /**

package/src/mixins/OxyServices.redirect.ts

@@ -299,10 +299,15 @@ export function OxyServicesRedirectAuthMixin<T extends typeof OxyServicesBase>(B
    * @private
    */
   public generateState(): string {
-    if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-      return window.crypto.randomUUID();
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+      return crypto.randomUUID();
     }
-    return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+    if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+      const bytes = new Uint8Array(16);
+      crypto.getRandomValues(bytes);
+      return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+    }
+    throw new Error('No secure random source available for state generation');
   }
 
   /**
@@ -311,10 +316,15 @@ export function OxyServicesRedirectAuthMixin<T extends typeof OxyServicesBase>(B
    * @private
    */
   public generateNonce(): string {
-    if (typeof window !== 'undefined' && window.crypto && window.crypto.randomUUID) {
-      return window.crypto.randomUUID();
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+      return crypto.randomUUID();
+    }
+    if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+      const bytes = new Uint8Array(16);
+      crypto.getRandomValues(bytes);
+      return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
     }
-    return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
+    throw new Error('No secure random source available for nonce generation');
   }
 
   /**

package/src/utils/deviceManager.ts

@@ -170,15 +170,12 @@ export class DeviceManager {
    * Generate a unique device ID
    */
   private static generateDeviceId(): string {
-    // Use crypto.getRandomValues if available, otherwise fallback to Math.random
     if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
       const array = new Uint8Array(32);
       crypto.getRandomValues(array);
       return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');
-    } else {
-      // Fallback for environments without crypto.getRandomValues
-      return 'device_' + Date.now().toString(36) + Math.random().toString(36).substr(2);
     }
+    throw new Error('No secure random source available for device ID generation');
   }
 
   /**