@oxyhq/core 11.0.0 → 11.0.1

package/dist/cjs/index.js

@@ -20,8 +20,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.ORGANIZATION_CATEGORIES = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
 exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = void 0;
-exports.buildIdpHubOrigin = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.normalizeOAuthRedirectUri = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidDisplayName = exports.isValidPassword = void 0;
-exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.redeemHubTicketOnHub = exports.syncHubAfterSignIn = exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = void 0;
+exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.normalizeOAuthRedirectUri = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidDisplayName = exports.isValidPassword = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.redeemHubTicketOnHub = exports.syncHubAfterSignIn = exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = exports.buildIdpHubOrigin = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -270,6 +270,11 @@ var registrableApex_1 = require("./utils/registrableApex");
 Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return registrableApex_1.registrableApex; } });
 var authWebUrl_1 = require("./utils/authWebUrl");
 Object.defineProperty(exports, "CENTRAL_IDP_APEX", { enumerable: true, get: function () { return authWebUrl_1.CENTRAL_IDP_APEX; } });
+// WebAuthn relying-party origin guard (client side). Mirrors the server's
+// `isOxyApexOrigin` so consumers can decide whether to offer passkey UI on the
+// current page (first-party Oxy origin / loopback only).
+var webauthnOrigin_1 = require("./utils/webauthnOrigin");
+Object.defineProperty(exports, "isOxyRpOrigin", { enumerable: true, get: function () { return webauthnOrigin_1.isOxyRpOrigin; } });
 var coldBoot_1 = require("./utils/coldBoot");
 Object.defineProperty(exports, "runColdBoot", { enumerable: true, get: function () { return coldBoot_1.runColdBoot; } });
 // ---------------------------------------------------------------------------

package/dist/cjs/mixins/OxyServices.auth.js

@@ -852,6 +852,108 @@ function OxyServicesAuthMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * Begin a WebAuthn / passkey REGISTRATION ceremony. Requests the
+         * `PublicKeyCredentialCreationOptions` the browser's `navigator.credentials
+         * .create()` (or `@simplewebauthn/browser`'s `startRegistration`) needs.
+         *
+         * With a bearer token planted this links a passkey to the signed-in account
+         * (`username` ignored); without one it is a prospective signup and `username`
+         * is the desired handle. The returned options are OPAQUE — Oxy does not own
+         * their shape (the browser / `@simplewebauthn` does), so they pass through
+         * as `unknown` for the caller to hand straight to the ceremony.
+         */
+        async webauthnRegisterOptions(username) {
+            try {
+                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Finish a WebAuthn / passkey REGISTRATION ceremony. Forwards the opaque
+         * browser `RegistrationResponseJSON` (`response`) alongside the Oxy envelope
+         * (desired `username` for signup + the device-session naming fields).
+         *
+         * Two server branches, disambiguated by the response shape:
+         *  - **Signup** (no bearer): the account is created and a session minted —
+         *    the response carries `sessionId`, is the SAME {@link LoginResult}
+         *    contract as `POST /auth/verify`, and its access token is planted here.
+         *  - **Link** (bearer present): the passkey is attached to the signed-in
+         *    account and the server returns `{ success, message }` with no session,
+         *    which is returned verbatim (no token planting).
+         */
+        async webauthnRegisterVerify(response, envelope = {}) {
+            try {
+                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false });
+                if (res && typeof res === 'object') {
+                    const record = res;
+                    // Signup branch: mints a session (LoginSessionResult, carries
+                    // `sessionId`). Parse against the login contract and plant the token.
+                    if ('sessionId' in record) {
+                        const parsed = (0, contracts_1.safeParseContract)(contracts_1.loginResultSchema, record);
+                        if (!parsed) {
+                            throw new Error('auth/webauthn/register/verify returned an unexpected response shape');
+                        }
+                        if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
+                            this.setTokens(parsed.accessToken);
+                        }
+                        return parsed;
+                    }
+                    // Link branch: passkey attached to the signed-in account, no session.
+                    if (record.success === true && typeof record.message === 'string') {
+                        return { success: true, message: record.message };
+                    }
+                }
+                throw new Error('auth/webauthn/register/verify returned an unexpected response shape');
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Begin a WebAuthn / passkey AUTHENTICATION ceremony. Requests the
+         * `PublicKeyCredentialRequestOptions` the browser's `navigator.credentials
+         * .get()` (or `@simplewebauthn/browser`'s `startAuthentication`) needs.
+         *
+         * When `username` is present the server scopes `allowCredentials` to that
+         * user's passkeys (username-first); when omitted it returns an empty
+         * allow-list for the usernameless / discoverable-credential flow. The
+         * returned options are OPAQUE and pass through as `unknown`.
+         */
+        async webauthnLoginOptions(username) {
+            try {
+                return await this.makeRequest('POST', '/auth/webauthn/login/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Finish a WebAuthn / passkey AUTHENTICATION ceremony. Forwards the opaque
+         * browser `AuthenticationResponseJSON` (`response`) alongside the
+         * device-session envelope. Resolves to the SAME {@link LoginResult} contract
+         * as `POST /auth/verify`; on the session arm the access token is planted
+         * immediately (mirroring {@link passwordSignIn}), and the response's
+         * `deviceId` + `deviceSecret` are the zero-cookie restore credential.
+         */
+        async webauthnLoginVerify(response, envelope = {}) {
+            try {
+                const res = await this.makeRequest('POST', '/auth/webauthn/login/verify', { response, ...envelope }, { cache: false });
+                const parsed = (0, contracts_1.safeParseContract)(contracts_1.loginResultSchema, res);
+                if (!parsed) {
+                    throw new Error('auth/webauthn/login/verify returned an unexpected response shape');
+                }
+                if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
+                    this.setTokens(parsed.accessToken);
+                }
+                return parsed;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
         /**
          * Exchange an OAuth authorization code (returned to the RP redirect URI
          * after password sign-in at auth.oxy.so) for a device-first session.

package/dist/cjs/utils/webauthnOrigin.js

@@ -0,0 +1,51 @@
+"use strict";
+/**
+ * WebAuthn relying-party origin guard (client side).
+ *
+ * The passkey ceremonies (`OxyServices.webauthn*`) are only meaningful when the
+ * page is served from a first-party Oxy web origin: a credential minted with
+ * `WEBAUTHN_RP_ID=oxy.so` can only be created/asserted from `oxy.so`, one of its
+ * subdomains, or a loopback dev server. This is the browser-side mirror of the
+ * server's `isOxyApexOrigin` (`packages/api/src/utils/origin.ts`), which forms
+ * the server's `expectedOrigin` allow-set — consumers use it to decide whether to
+ * even offer the passkey UI on the current page.
+ *
+ * It reads `globalThis.location` directly (no argument) because that is the only
+ * origin the browser will let a WebAuthn ceremony run against. On native / SSR /
+ * any environment without a DOM `location`, it returns `false` (there is no
+ * relying-party origin, so passkeys are not applicable).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isOxyRpOrigin = isOxyRpOrigin;
+/**
+ * True iff the current page's host is a first-party Oxy relying-party origin:
+ * `oxy.so`, any `*.oxy.so` subdomain, or a loopback dev host
+ * (`localhost` / `127.0.0.1` / `[::1]`).
+ *
+ * Fails closed: no `location` (native/SSR), a non-string/empty hostname, or a
+ * host that merely ends in the literal `oxy.so` without the dot boundary
+ * (`evil-oxy.so`, `oxy.so.evil.com`) all return `false`.
+ *
+ * @example
+ *   isOxyRpOrigin() // true  on https://accounts.oxy.so
+ *   isOxyRpOrigin() // true  on http://localhost:8081
+ *   isOxyRpOrigin() // false on https://evil.com
+ *   isOxyRpOrigin() // false in a React Native / SSR context (no location)
+ */
+function isOxyRpOrigin() {
+    // `globalThis.location` is typed `Location` by the DOM lib, but is genuinely
+    // `undefined` on native/SSR — widen to a nullable local so the guard is a real
+    // runtime check, not a type-level no-op.
+    const location = globalThis.location;
+    if (!location || typeof location.hostname !== 'string') {
+        return false;
+    }
+    const hostname = location.hostname.toLowerCase();
+    if (hostname.length === 0) {
+        return false;
+    }
+    if (hostname === 'oxy.so' || hostname.endsWith('.oxy.so')) {
+        return true;
+    }
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+}