@oxyhq/core 10.1.2 → 10.1.3

package/dist/types/models/interfaces.d.ts

@@ -551,7 +551,6 @@ export interface SecurityActivity {
     eventType: SecurityEventType;
     eventDescription: string;
     metadata?: Record<string, any>;
-    ipAddress?: string;
     userAgent?: string;
     deviceId?: string;
     timestamp: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "10.1.2",
+  "version": "10.1.3",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/models/interfaces.ts

@@ -648,7 +648,6 @@ export interface SecurityActivity {
   eventType: SecurityEventType;
   eventDescription: string;
   metadata?: Record<string, any>;
-  ipAddress?: string;
   userAgent?: string;
   deviceId?: string;
   timestamp: string;

package/src/session/__tests__/accountDialogController.test.ts

@@ -4,6 +4,7 @@ import type { User } from '../../models/interfaces';
 import type { SessionLoginResponse, MinimalUserData } from '../../models/session';
 import type { AccountNode } from '../../mixins/OxyServices.accounts';
 import { SessionClient, type SessionClientHost } from '../SessionClient';
+import { logger } from '../../utils/loggerUtils';
 import {
   AccountDialogController,
   createAccountDialogController,
@@ -206,6 +207,7 @@ describe('AccountDialogController — account list', () => {
   });
 
   it('keeps device rows and surfaces the error when listAccounts fails', async () => {
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
     const { controller, oxy, sc } = makeHarness();
     sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
     oxy.getUsersByIds.mockResolvedValue([user('a1')]);
@@ -216,6 +218,40 @@ describe('AccountDialogController — account list', () => {
     const snap = controller.getSnapshot();
     expect(snap.error).toBe('graph boom');
     expect(snap.accounts.map((r) => r.accountId)).toEqual(['a1']);
+    // A genuine (non-401) failure STILL warns.
+    expect(warnSpy).toHaveBeenCalledWith(
+      '[AccountDialogController] listAccounts failed',
+      { component: 'AccountDialogController' },
+      expect.any(Error),
+    );
+    warnSpy.mockRestore();
+  });
+
+  it('treats a 401 from listAccounts as the signed-out edge — debug, no surfaced error, no warn', async () => {
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
+    const debugSpy = jest.spyOn(logger, 'debug').mockImplementation(() => undefined);
+    const { controller, oxy, sc } = makeHarness();
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
+    oxy.getUsersByIds.mockResolvedValue([user('a1')]);
+    // A stale/revoked bearer 401s: an EXPECTED signed-out outcome, not a failure.
+    oxy.listAccounts.mockRejectedValue(
+      Object.assign(new Error('Invalid or missing authorization header'), { status: 401 }),
+    );
+
+    await controller.refresh();
+
+    const snap = controller.getSnapshot();
+    // Never surface an error for a normal signed-out state; device rows still render.
+    expect(snap.error).toBeNull();
+    expect(snap.accounts.map((r) => r.accountId)).toEqual(['a1']);
+    expect(warnSpy).not.toHaveBeenCalled();
+    expect(debugSpy).toHaveBeenCalledWith(
+      '[AccountDialogController] listAccounts unauthorized (signed out)',
+      { component: 'AccountDialogController' },
+      expect.objectContaining({ status: 401 }),
+    );
+    warnSpy.mockRestore();
+    debugSpy.mockRestore();
   });
 });
 

package/src/session/accountDialogController.ts

@@ -30,6 +30,7 @@ import type { OxyServices } from '../OxyServices';
 import type { SessionLoginResponse, MinimalUserData } from '../models/session';
 import type { User } from '../models/interfaces';
 import { logger } from '../utils/loggerUtils';
+import { extractErrorStatus } from '../utils/errorUtils';
 import { CENTRAL_IDP_APEX } from '../utils/authWebUrl';
 import {
   generateOAuthState,
@@ -392,10 +393,19 @@ export class AccountDialogController {
     try {
       graph = await this.oxyServices.listAccounts();
     } catch (error) {
-      // A graph-load failure is non-fatal: device rows still render. Surface the
-      // message but keep going with whatever graph we already had.
-      this.error = errorMessage(error);
-      logger.warn('[AccountDialogController] listAccounts failed', { component: 'AccountDialogController' }, error);
+      // A 401 here is the EXPECTED signed-out edge, not a failure: the bearer was
+      // stale/revoked, so `HttpService` already cleared it and emitted
+      // `onTokensChanged(null)`, which drops the graph via `reconcileAuth`. Log at
+      // debug and leave the dialog error-free — a signed-out device with zero
+      // accounts is a normal state, not a warning. Any other error (network, 5xx,
+      // malformed) IS unexpected: surface it and warn while keeping the prior graph
+      // so device rows still render.
+      if (extractErrorStatus(error) === 401) {
+        logger.debug('[AccountDialogController] listAccounts unauthorized (signed out)', { component: 'AccountDialogController' }, error);
+      } else {
+        this.error = errorMessage(error);
+        logger.warn('[AccountDialogController] listAccounts failed', { component: 'AccountDialogController' }, error);
+      }
     }
     if (seq !== this.refreshSeq) return; // superseded by a newer refresh
 
@@ -432,9 +442,15 @@ export class AccountDialogController {
     try {
       profiles = await this.oxyServices.getUsersByIds(ids);
     } catch (error) {
-      // `getUsersByIds` already swallows per-chunk failures and returns `[]`;
-      // this guards the unexpected total failure. Non-fatal — keep prior map.
-      logger.warn('[AccountDialogController] getUsersByIds failed', { component: 'AccountDialogController' }, error);
+      // A 401 is the EXPECTED signed-out edge (stale/cleared bearer) — log at debug.
+      // `getUsersByIds` already swallows per-chunk failures and returns `[]`, so any
+      // OTHER error here is an unexpected total failure worth a warn. Either way keep
+      // the prior profile map.
+      if (extractErrorStatus(error) === 401) {
+        logger.debug('[AccountDialogController] getUsersByIds unauthorized (signed out)', { component: 'AccountDialogController' }, error);
+      } else {
+        logger.warn('[AccountDialogController] getUsersByIds failed', { component: 'AccountDialogController' }, error);
+      }
       return;
     }
     if (seq !== this.refreshSeq) return; // superseded