@oxyhq/core 1.6.6 → 1.8.0

package/dist/cjs/AuthManager.js

@@ -296,11 +296,12 @@ class AuthManager {
      * Sign out and clear all auth data.
      */
     async signOut() {
-        // Clear refresh timer
+        // Clear refresh timer and cancel any in-flight refresh
         if (this.refreshTimer) {
             clearTimeout(this.refreshTimer);
             this.refreshTimer = null;
         }
+        this.refreshPromise = null;
         // Invalidate current session on the server (best-effort)
         try {
             const sessionJson = await this.storage.getItem(STORAGE_KEYS.SESSION);

package/dist/cjs/HttpService.js

@@ -244,8 +244,9 @@ class HttpService {
                                 // Token decode failed, fall through to clear
                             }
                         }
-                        // Refresh failed or no token — clear tokens
+                        // Refresh failed or no token — clear tokens and stale CSRF
                         this.tokenStore.clearTokens();
+                        this.tokenStore.clearCsrfToken();
                     }
                     // On 403 with CSRF error, clear cached token and retry once
                     if (response.status === 403 && !config._isCsrfRetry) {
@@ -503,12 +504,14 @@ class HttpService {
                 const result = await this.tokenRefreshPromise;
                 if (result)
                     return result;
+                // Refresh failed — don't use the expired token (would cause 401 loop)
+                return null;
             }
             return `Bearer ${accessToken}`;
         }
         catch (error) {
             this.logger.error('Error processing token:', error);
-            return `Bearer ${accessToken}`;
+            return null;
         }
     }
     async _refreshTokenFromSession(sessionId) {

package/dist/cjs/mixins/OxyServices.fedcm.js

@@ -87,12 +87,14 @@ function OxyServicesFedCMMixin(Base) {
                     const loginHint = options.loginHint || this.getStoredLoginHint();
                     debug.log('Interactive sign-in: Requesting credential for', clientId, loginHint ? `(hint: ${loginHint})` : '');
                     // Request credential from browser's native identity flow
+                    // mode: 'button' signals this is a user-gesture-initiated flow (Chrome 125+)
                     const credential = await this.requestIdentityCredential({
                         configURL: this.constructor.DEFAULT_CONFIG_URL,
                         clientId,
                         nonce,
                         context: options.context,
                         loginHint,
+                        mode: 'button',
                     });
                     if (!credential || !credential.token) {
                         throw new OxyServices_errors_1.OxyAuthenticationError('No credential received from browser');
@@ -302,7 +304,7 @@ function OxyServicesFedCMMixin(Base) {
                     try {
                         debug.log('Calling navigator.credentials.get with mediation:', requestedMediation);
                         // Type assertion needed as FedCM types may not be in all TypeScript versions
-                        const credential = (await navigator.credentials.get({
+                        const credentialOptions = {
                             identity: {
                                 providers: [
                                     {
@@ -316,10 +318,12 @@ function OxyServicesFedCMMixin(Base) {
                                         ...(options.loginHint && { loginHint: options.loginHint }),
                                     },
                                 ],
+                                ...(options.mode && { mode: options.mode }),
                             },
                             mediation: requestedMediation,
                             signal: controller.signal,
-                        }));
+                        };
+                        const credential = (await navigator.credentials.get(credentialOptions));
                         debug.log('navigator.credentials.get returned:', {
                             hasCredential: !!credential,
                             type: credential?.type,
@@ -329,8 +333,9 @@ function OxyServicesFedCMMixin(Base) {
                             debug.log('No valid identity credential returned');
                             return null;
                         }
-                        debug.log('Got valid identity credential with token');
-                        return { token: credential.token };
+                        const isAutoSelected = !!credential.isAutoSelected;
+                        debug.log('Got valid identity credential with token', { isAutoSelected });
+                        return { token: credential.token, isAutoSelected };
                     }
                     catch (error) {
                         const errorName = error instanceof Error ? error.name : 'Unknown';
@@ -373,25 +378,30 @@ function OxyServicesFedCMMixin(Base) {
             /**
              * Revoke FedCM credential (sign out)
              *
-             * This tells the browser to forget the FedCM credential for this app.
-             * The user will need to re-authenticate next time.
+             * Uses IdentityCredential.disconnect() to tell the browser to forget
+             * the RP-IdP-account association. This resets the "returning account"
+             * state, which is required for silent mediation to work again.
              */
             async revokeFedCMCredential() {
+                // Read hint before clearing so we can pass it to disconnect()
+                const accountHint = this.getStoredLoginHint();
+                this.clearLoginHint();
                 if (!this.isFedCMSupported()) {
                     return;
                 }
                 try {
-                    // FedCM logout API (if available)
-                    if ('IdentityCredential' in window && 'logout' in window.IdentityCredential) {
+                    if ('IdentityCredential' in window && 'disconnect' in window.IdentityCredential) {
                         const clientId = this.getClientId();
-                        await window.IdentityCredential.logout({
+                        await window.IdentityCredential.disconnect({
                             configURL: this.constructor.DEFAULT_CONFIG_URL,
                             clientId,
+                            accountHint: accountHint || '*',
                         });
+                        debug.log('FedCM credential disconnected');
                     }
                 }
                 catch (error) {
-                    // Silent failure
+                    debug.log('FedCM disconnect failed (non-critical):', error instanceof Error ? error.message : String(error));
                 }
             }
             /**
@@ -455,6 +465,17 @@ function OxyServicesFedCMMixin(Base) {
                     // Storage full or blocked
                 }
             }
+            /** @internal */
+            clearLoginHint() {
+                if (typeof window === 'undefined')
+                    return;
+                try {
+                    localStorage.removeItem(FEDCM_LOGIN_HINT_KEY);
+                }
+                catch {
+                    // Storage blocked
+                }
+            }
         },
         _a.DEFAULT_CONFIG_URL = 'https://auth.oxy.so/fedcm.json',
         _a.FEDCM_TIMEOUT = 15000 // 15 seconds for interactive

package/dist/esm/AuthManager.js

@@ -292,11 +292,12 @@ export class AuthManager {
      * Sign out and clear all auth data.
      */
     async signOut() {
-        // Clear refresh timer
+        // Clear refresh timer and cancel any in-flight refresh
         if (this.refreshTimer) {
             clearTimeout(this.refreshTimer);
             this.refreshTimer = null;
         }
+        this.refreshPromise = null;
         // Invalidate current session on the server (best-effort)
         try {
             const sessionJson = await this.storage.getItem(STORAGE_KEYS.SESSION);

package/dist/esm/HttpService.js

@@ -241,8 +241,9 @@ export class HttpService {
                                 // Token decode failed, fall through to clear
                             }
                         }
-                        // Refresh failed or no token — clear tokens
+                        // Refresh failed or no token — clear tokens and stale CSRF
                         this.tokenStore.clearTokens();
+                        this.tokenStore.clearCsrfToken();
                     }
                     // On 403 with CSRF error, clear cached token and retry once
                     if (response.status === 403 && !config._isCsrfRetry) {
@@ -500,12 +501,14 @@ export class HttpService {
                 const result = await this.tokenRefreshPromise;
                 if (result)
                     return result;
+                // Refresh failed — don't use the expired token (would cause 401 loop)
+                return null;
             }
             return `Bearer ${accessToken}`;
         }
         catch (error) {
             this.logger.error('Error processing token:', error);
-            return `Bearer ${accessToken}`;
+            return null;
         }
     }
     async _refreshTokenFromSession(sessionId) {

package/dist/esm/mixins/OxyServices.fedcm.js

@@ -83,12 +83,14 @@ export function OxyServicesFedCMMixin(Base) {
                     const loginHint = options.loginHint || this.getStoredLoginHint();
                     debug.log('Interactive sign-in: Requesting credential for', clientId, loginHint ? `(hint: ${loginHint})` : '');
                     // Request credential from browser's native identity flow
+                    // mode: 'button' signals this is a user-gesture-initiated flow (Chrome 125+)
                     const credential = await this.requestIdentityCredential({
                         configURL: this.constructor.DEFAULT_CONFIG_URL,
                         clientId,
                         nonce,
                         context: options.context,
                         loginHint,
+                        mode: 'button',
                     });
                     if (!credential || !credential.token) {
                         throw new OxyAuthenticationError('No credential received from browser');
@@ -298,7 +300,7 @@ export function OxyServicesFedCMMixin(Base) {
                     try {
                         debug.log('Calling navigator.credentials.get with mediation:', requestedMediation);
                         // Type assertion needed as FedCM types may not be in all TypeScript versions
-                        const credential = (await navigator.credentials.get({
+                        const credentialOptions = {
                             identity: {
                                 providers: [
                                     {
@@ -312,10 +314,12 @@ export function OxyServicesFedCMMixin(Base) {
                                         ...(options.loginHint && { loginHint: options.loginHint }),
                                     },
                                 ],
+                                ...(options.mode && { mode: options.mode }),
                             },
                             mediation: requestedMediation,
                             signal: controller.signal,
-                        }));
+                        };
+                        const credential = (await navigator.credentials.get(credentialOptions));
                         debug.log('navigator.credentials.get returned:', {
                             hasCredential: !!credential,
                             type: credential?.type,
@@ -325,8 +329,9 @@ export function OxyServicesFedCMMixin(Base) {
                             debug.log('No valid identity credential returned');
                             return null;
                         }
-                        debug.log('Got valid identity credential with token');
-                        return { token: credential.token };
+                        const isAutoSelected = !!credential.isAutoSelected;
+                        debug.log('Got valid identity credential with token', { isAutoSelected });
+                        return { token: credential.token, isAutoSelected };
                     }
                     catch (error) {
                         const errorName = error instanceof Error ? error.name : 'Unknown';
@@ -369,25 +374,30 @@ export function OxyServicesFedCMMixin(Base) {
             /**
              * Revoke FedCM credential (sign out)
              *
-             * This tells the browser to forget the FedCM credential for this app.
-             * The user will need to re-authenticate next time.
+             * Uses IdentityCredential.disconnect() to tell the browser to forget
+             * the RP-IdP-account association. This resets the "returning account"
+             * state, which is required for silent mediation to work again.
              */
             async revokeFedCMCredential() {
+                // Read hint before clearing so we can pass it to disconnect()
+                const accountHint = this.getStoredLoginHint();
+                this.clearLoginHint();
                 if (!this.isFedCMSupported()) {
                     return;
                 }
                 try {
-                    // FedCM logout API (if available)
-                    if ('IdentityCredential' in window && 'logout' in window.IdentityCredential) {
+                    if ('IdentityCredential' in window && 'disconnect' in window.IdentityCredential) {
                         const clientId = this.getClientId();
-                        await window.IdentityCredential.logout({
+                        await window.IdentityCredential.disconnect({
                             configURL: this.constructor.DEFAULT_CONFIG_URL,
                             clientId,
+                            accountHint: accountHint || '*',
                         });
+                        debug.log('FedCM credential disconnected');
                     }
                 }
                 catch (error) {
-                    // Silent failure
+                    debug.log('FedCM disconnect failed (non-critical):', error instanceof Error ? error.message : String(error));
                 }
             }
             /**
@@ -451,6 +461,17 @@ export function OxyServicesFedCMMixin(Base) {
                     // Storage full or blocked
                 }
             }
+            /** @internal */
+            clearLoginHint() {
+                if (typeof window === 'undefined')
+                    return;
+                try {
+                    localStorage.removeItem(FEDCM_LOGIN_HINT_KEY);
+                }
+                catch {
+                    // Storage blocked
+                }
+            }
         },
         _a.DEFAULT_CONFIG_URL = 'https://auth.oxy.so/fedcm.json',
         _a.FEDCM_TIMEOUT = 15000 // 15 seconds for interactive

package/dist/types/mixins/OxyServices.fedcm.d.ts

@@ -110,8 +110,10 @@ export declare function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(
             context?: string;
             loginHint?: string;
             mediation?: "silent" | "optional" | "required";
+            mode?: "button" | "widget";
         }): Promise<{
             token: string;
+            isAutoSelected: boolean;
         } | null>;
         /**
          * Exchange FedCM ID token for Oxy session
@@ -125,8 +127,9 @@ export declare function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(
         /**
          * Revoke FedCM credential (sign out)
          *
-         * This tells the browser to forget the FedCM credential for this app.
-         * The user will need to re-authenticate next time.
+         * Uses IdentityCredential.disconnect() to tell the browser to forget
+         * the RP-IdP-account association. This resets the "returning account"
+         * state, which is required for silent mediation to work again.
          */
         revokeFedCMCredential(): Promise<void>;
         /**
@@ -151,6 +154,8 @@ export declare function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(
         getStoredLoginHint(): string | undefined;
         /** @internal */
         storeLoginHint(userId: string): void;
+        /** @internal */
+        clearLoginHint(): void;
         httpService: import("../HttpService").HttpService;
         cloudURL: string;
         config: import("../OxyServices.base").OxyConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "1.6.6",
+  "version": "1.8.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/AuthManager.ts

@@ -361,11 +361,12 @@ export class AuthManager {
    * Sign out and clear all auth data.
    */
   async signOut(): Promise<void> {
-    // Clear refresh timer
+    // Clear refresh timer and cancel any in-flight refresh
     if (this.refreshTimer) {
       clearTimeout(this.refreshTimer);
       this.refreshTimer = null;
     }
+    this.refreshPromise = null;
 
     // Invalidate current session on the server (best-effort)
     try {

package/src/HttpService.ts

@@ -337,8 +337,9 @@ export class HttpService {
                 // Token decode failed, fall through to clear
               }
             }
-            // Refresh failed or no token — clear tokens
+            // Refresh failed or no token — clear tokens and stale CSRF
             this.tokenStore.clearTokens();
+            this.tokenStore.clearCsrfToken();
           }
 
           // On 403 with CSRF error, clear cached token and retry once
@@ -616,12 +617,14 @@ export class HttpService {
         }
         const result = await this.tokenRefreshPromise;
         if (result) return result;
+        // Refresh failed — don't use the expired token (would cause 401 loop)
+        return null;
       }
 
       return `Bearer ${accessToken}`;
     } catch (error) {
       this.logger.error('Error processing token:', error);
-      return `Bearer ${accessToken}`;
+      return null;
     }
   }
 

package/src/mixins/OxyServices.fedcm.ts

@@ -111,12 +111,14 @@ export function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(Base: T)
       debug.log('Interactive sign-in: Requesting credential for', clientId, loginHint ? `(hint: ${loginHint})` : '');
 
       // Request credential from browser's native identity flow
+      // mode: 'button' signals this is a user-gesture-initiated flow (Chrome 125+)
       const credential = await this.requestIdentityCredential({
         configURL: (this.constructor as any).DEFAULT_CONFIG_URL,
         clientId,
         nonce,
         context: options.context,
         loginHint,
+        mode: 'button',
       });
 
       if (!credential || !credential.token) {
@@ -205,7 +207,7 @@ export function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(Base: T)
     // We intentionally do NOT fall back to optional mediation here because
     // this runs on app startup — showing browser UI without user action is bad UX.
     // Optional/interactive mediation should only happen when the user clicks "Sign In".
-    let credential: { token: string } | null = null;
+    let credential: { token: string; isAutoSelected: boolean } | null = null;
 
     const loginHint = this.getStoredLoginHint();
 
@@ -308,7 +310,8 @@ export function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(Base: T)
     context?: string;
     loginHint?: string;
     mediation?: 'silent' | 'optional' | 'required';
-  }): Promise<{ token: string } | null> {
+    mode?: 'button' | 'widget';
+  }): Promise<{ token: string; isAutoSelected: boolean } | null> {
     const requestedMediation = options.mediation || 'optional';
     const isInteractive = requestedMediation !== 'silent';
 
@@ -356,7 +359,7 @@ export function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(Base: T)
       try {
         debug.log('Calling navigator.credentials.get with mediation:', requestedMediation);
         // Type assertion needed as FedCM types may not be in all TypeScript versions
-        const credential = (await (navigator.credentials as any).get({
+        const credentialOptions: any = {
           identity: {
             providers: [
               {
@@ -370,10 +373,12 @@ export function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(Base: T)
                 ...(options.loginHint && { loginHint: options.loginHint }),
               },
             ],
+            ...(options.mode && { mode: options.mode }),
           },
           mediation: requestedMediation,
           signal: controller.signal,
-        })) as any;
+        };
+        const credential = (await (navigator.credentials as any).get(credentialOptions)) as any;
 
         debug.log('navigator.credentials.get returned:', {
           hasCredential: !!credential,
@@ -386,8 +391,9 @@ export function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(Base: T)
           return null;
         }
 
-        debug.log('Got valid identity credential with token');
-        return { token: credential.token };
+        const isAutoSelected = !!credential.isAutoSelected;
+        debug.log('Got valid identity credential with token', { isAutoSelected });
+        return { token: credential.token, isAutoSelected };
       } catch (error) {
         const errorName = error instanceof Error ? error.name : 'Unknown';
         const errorMessage = error instanceof Error ? error.message : String(error);
@@ -438,25 +444,31 @@ export function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(Base: T)
   /**
    * Revoke FedCM credential (sign out)
    *
-   * This tells the browser to forget the FedCM credential for this app.
-   * The user will need to re-authenticate next time.
+   * Uses IdentityCredential.disconnect() to tell the browser to forget
+   * the RP-IdP-account association. This resets the "returning account"
+   * state, which is required for silent mediation to work again.
    */
   async revokeFedCMCredential(): Promise<void> {
+    // Read hint before clearing so we can pass it to disconnect()
+    const accountHint = this.getStoredLoginHint();
+    this.clearLoginHint();
+
     if (!this.isFedCMSupported()) {
       return;
     }
 
     try {
-      // FedCM logout API (if available)
-      if ('IdentityCredential' in window && 'logout' in (window as any).IdentityCredential) {
+      if ('IdentityCredential' in window && 'disconnect' in (window as any).IdentityCredential) {
         const clientId = this.getClientId();
-        await (window as any).IdentityCredential.logout({
+        await (window as any).IdentityCredential.disconnect({
           configURL: (this.constructor as any).DEFAULT_CONFIG_URL,
           clientId,
+          accountHint: accountHint || '*',
         });
+        debug.log('FedCM credential disconnected');
       }
     } catch (error) {
-      // Silent failure
+      debug.log('FedCM disconnect failed (non-critical):', error instanceof Error ? error.message : String(error));
     }
   }
 
@@ -521,6 +533,16 @@ export function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(Base: T)
       // Storage full or blocked
     }
   }
+
+  /** @internal */
+  public clearLoginHint(): void {
+    if (typeof window === 'undefined') return;
+    try {
+      localStorage.removeItem(FEDCM_LOGIN_HINT_KEY);
+    } catch {
+      // Storage blocked
+    }
+  }
   };
 }