@oxyhq/core 11.0.1 → 12.0.0

package/src/session/__tests__/accountDialogController.test.ts

@@ -664,72 +664,6 @@ describe('AccountDialogController — Commons deep-link (canOpenApp)', () => {
   });
 });
 
-describe('AccountDialogController — openPasswordAtOxyAuth', () => {
-  beforeEach(() => {
-    const store = new Map<string, string>();
-    Object.defineProperty(globalThis, 'sessionStorage', {
-      value: {
-        getItem: (key: string) => store.get(key) ?? null,
-        setItem: (key: string, value: string) => {
-          store.set(key, value);
-        },
-        removeItem: (key: string) => {
-          store.delete(key);
-        },
-      },
-      configurable: true,
-    });
-  });
-
-  it('builds the IdP sign-in URL with redirect_uri + client_id and invokes openUrl', async () => {
-    const oxy = makeOxy();
-    const sc = new TestSessionClient(host());
-    const openUrl = jest.fn();
-    const controller = new AccountDialogController({
-      oxyServices: oxy as unknown as OxyServices,
-      sessionClient: sc,
-      clientId: 'oxy_dk_test',
-      openUrl,
-    });
-
-    const url = await controller.openPasswordAtOxyAuth({ returnUrl: 'https://mention.earth/dashboard' });
-    const parsed = new URL(url);
-    expect(parsed.origin).toBe('https://auth.oxy.so');
-    expect(parsed.pathname).toBe('/login');
-    expect(parsed.searchParams.get('redirect_uri')).toBe('https://mention.earth');
-    expect(parsed.searchParams.get('client_id')).toBe('oxy_dk_test');
-    expect(parsed.searchParams.get('state')).toBeTruthy();
-    expect(parsed.searchParams.get('code_challenge')).toBeTruthy();
-    expect(parsed.searchParams.get('code_challenge_method')).toBe('S256');
-    expect(openUrl).toHaveBeenCalledWith(url);
-  });
-
-  it('honors authRedirectUri over returnUrl', async () => {
-    const oxy = makeOxy();
-    const sc = new TestSessionClient(host());
-    const controller = new AccountDialogController({
-      oxyServices: oxy as unknown as OxyServices,
-      sessionClient: sc,
-      authRedirectUri: 'https://inbox.oxy.so',
-    });
-
-    const url = await controller.openPasswordAtOxyAuth({ returnUrl: 'https://inbox.oxy.so/mail' });
-    expect(new URL(url).searchParams.get('redirect_uri')).toBe('https://inbox.oxy.so');
-  });
-
-  it('honors an idpApex override', async () => {
-    const oxy = makeOxy();
-    const sc = new TestSessionClient(host());
-    const controller = new AccountDialogController({
-      oxyServices: oxy as unknown as OxyServices,
-      sessionClient: sc,
-      idpApex: 'alia.onl',
-    });
-    const url = await controller.openPasswordAtOxyAuth({ returnUrl: 'https://alia.onl/' });
-    expect(new URL(url).origin).toBe('https://auth.alia.onl');
-  });
-});
-
 describe('AccountDialogController — /auth-session socket (instant QR wake)', () => {
   type Handler = (...args: unknown[]) => void;
   class FakeAuthSocket implements MinimalSocket {

package/src/session/accountDialogController.ts

@@ -21,9 +21,8 @@
  *     `oxyServices.signInWithSharedIdentity`, else the cross-device QR handoff
  *     via `startCommonsSignIn` → poll → `claimSessionByToken`).
  *
- * It deliberately owns NO password/2FA logic — those live at the IdP
- * (auth.oxy.so). {@link AccountDialogController.openPasswordAtOxyAuth} only
- * builds the hand-off URL; device-first convergence syncs the session back.
+ * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
+ * password, social login, and 2FA were removed ecosystem-wide.
  */
 
 import type { OxyServices } from '../OxyServices';
@@ -31,13 +30,6 @@ import type { SessionLoginResponse, MinimalUserData } from '../models/session';
 import type { User } from '../models/interfaces';
 import { logger } from '../logger';
 import { extractErrorStatus } from '../utils/errorUtils';
-import { CENTRAL_IDP_APEX } from '../utils/authWebUrl';
-import {
-  generateOAuthState,
-  generatePkcePair,
-  normalizeOAuthRedirectUri,
-  persistOAuthHandshake,
-} from '../utils/oauthPkce';
 import type { SessionClient } from './SessionClient';
 import type { MinimalSocket, SocketIOFactory } from './socketLoader';
 import {
@@ -117,14 +109,6 @@ export interface AccountDialogControllerOptions {
   commitSession?: (session: SessionLoginResponse) => Promise<void>;
   /** Notified after a completed sign-in (bearer planted + session committed). */
   onSignedIn?: (user: MinimalUserData) => void;
-  /** Central IdP apex for `openPasswordAtOxyAuth` (defaults to `CENTRAL_IDP_APEX`). */
-  idpApex?: string;
-  /**
-   * Registered OAuth redirect URI for this RP (exact match against
-   * `Application.redirectUris`). When set, wins over `returnUrl` /
-   * `location.origin` normalization in {@link openPasswordAtOxyAuth}.
-   */
-  authRedirectUri?: string | null;
   /**
    * QR device-flow FALLBACK poll interval in ms (default 12000). The primary
    * approval signal is the `/auth-session` socket's `auth_update` event (instant);
@@ -140,8 +124,8 @@ export interface AccountDialogControllerOptions {
    */
   socketFactory?: SocketIOFactory;
   /**
-   * Optional URL opener. When provided, `openPasswordAtOxyAuth` invokes it with
-   * the built URL in addition to returning it (web: `location.assign`; native:
+   * Optional URL opener. When provided, the controller invokes it to deep-link
+   * the Commons app for the QR handoff (web: `location.assign`; native:
    * `Linking.openURL`). Headless core never touches `window`/`Linking` itself.
    */
   openUrl?: (url: string) => void;
@@ -196,8 +180,6 @@ export class AccountDialogController {
   private readonly locale?: string;
   private readonly commitSession?: (session: SessionLoginResponse) => Promise<void>;
   private readonly onSignedIn?: (user: MinimalUserData) => void;
-  private readonly idpApex: string;
-  private readonly authRedirectUri: string | null;
   private readonly pollIntervalMs: number;
   private readonly openUrl?: (url: string) => void;
   private readonly canOpenApp?: (url: string) => Promise<boolean>;
@@ -247,8 +229,6 @@ export class AccountDialogController {
     this.locale = options.locale;
     this.commitSession = options.commitSession;
     this.onSignedIn = options.onSignedIn;
-    this.idpApex = options.idpApex ?? CENTRAL_IDP_APEX;
-    this.authRedirectUri = options.authRedirectUri ?? null;
     this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
     this.openUrl = options.openUrl;
     this.canOpenApp = options.canOpenApp;
@@ -652,50 +632,6 @@ export class AccountDialogController {
     }
   }
 
-  /**
-   * Build (and, when an `openUrl` handler was supplied, open) the auth.oxy.so
-   * password sign-in URL. Password + 2FA are NOT in the SDK — they live at the
-   * IdP; this only hands off. Device-first: after login at the IdP the device
-   * session converges and the caller is woken via the device socket /
-   * `BroadcastChannel`, so the URL only needs to point at the IdP sign-in with
-   * the right return.
-   *
-   * @param params.returnUrl - Where the IdP returns after login. Defaults to the
-   *   current document URL on web (`globalThis.location.href`); pass explicitly
-   *   on native (no `location`).
-   * @param params.state - Optional opaque state echoed back on return.
-   * @returns The absolute auth.oxy.so sign-in URL.
-   */
-  async openPasswordAtOxyAuth(
-    params: { returnUrl?: string; state?: string; redirectUri?: string } = {},
-  ): Promise<string> {
-    const base = `https://auth.${this.idpApex}`;
-    const url = new URL('/login', base);
-    const rawRedirect =
-      params.redirectUri ??
-      this.authRedirectUri ??
-      params.returnUrl ??
-      currentLocationOrigin();
-    const redirectUri = rawRedirect ? normalizeOAuthRedirectUri(rawRedirect) : '';
-    if (redirectUri) {
-      url.searchParams.set('redirect_uri', redirectUri);
-    }
-    if (this.clientId) {
-      url.searchParams.set('client_id', this.clientId);
-    }
-    const state = params.state ?? (await generateOAuthState());
-    url.searchParams.set('state', state);
-    const { codeChallenge, codeVerifier } = await generatePkcePair();
-    url.searchParams.set('code_challenge', codeChallenge);
-    url.searchParams.set('code_challenge_method', 'S256');
-    if (!persistOAuthHandshake(state, codeVerifier)) {
-      throw new Error('Could not persist OAuth handshake for password sign-in');
-    }
-    const href = url.toString();
-    this.openUrl?.(href);
-    return href;
-  }
-
   // =========================================================================
   // Internal sign-in helpers
   // =========================================================================
@@ -961,13 +897,3 @@ export function createAccountDialogController(
 ): AccountDialogController {
   return new AccountDialogController(options);
 }
-
-// ---------------------------------------------------------------------------
-// Local helpers
-// ---------------------------------------------------------------------------
-
-/** Current document origin on web; empty string where `location` is absent (native/SSR). */
-function currentLocationOrigin(): string {
-  const location = (globalThis as { location?: { origin?: string } }).location;
-  return typeof location?.origin === 'string' ? location.origin : '';
-}

package/src/utils/__tests__/officialOrigins.test.ts

@@ -3,6 +3,7 @@ import {
   buildIdpHubOrigin,
   isAllowedDeviceJoinOrigin,
   isIdpHubOrigin,
+  isLoopbackOrigin,
   isOfficialWebOrigin,
   normalizeOfficialReturnOrigin,
   parseHubSyncReturnUrl,
@@ -19,6 +20,19 @@ describe('officialOrigins', () => {
     expect(isOfficialWebOrigin('https://evil.example')).toBe(false);
   });
 
+  it('flags loopback / local-dev origins on any port', () => {
+    expect(isLoopbackOrigin('http://localhost:3000')).toBe(true);
+    expect(isLoopbackOrigin('http://127.0.0.1:8081')).toBe(true);
+    expect(isLoopbackOrigin('http://[::1]:19006')).toBe(true);
+    expect(isLoopbackOrigin('https://localhost')).toBe(true);
+    expect(isLoopbackOrigin('https://accounts.oxy.so')).toBe(false);
+    expect(isLoopbackOrigin('https://evil.example')).toBe(false);
+  });
+
+  it('treats loopback as an official origin (loopback dev is trusted)', () => {
+    expect(isOfficialWebOrigin('http://localhost:3000')).toBe(true);
+  });
+
   it('keeps the deprecated alias in sync with isOfficialWebOrigin', () => {
     expect(isAllowedDeviceJoinOrigin('https://accounts.oxy.so')).toBe(true);
     expect(isAllowedDeviceJoinOrigin('https://evil.example')).toBe(false);

package/src/utils/officialOrigins.ts

@@ -41,7 +41,12 @@ export function isIdpHubOrigin(): boolean {
   }
 }
 
-function isLoopbackOrigin(origin: string): boolean {
+/**
+ * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
+ * or `[::1]` on any port, http or https). Local dev must never be bounced to a
+ * hosted IdP for cross-origin session restore.
+ */
+export function isLoopbackOrigin(origin: string): boolean {
   try {
     const parsed = new URL(origin);
     if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {

package/src/mixins/__tests__/passwordSignIn.test.ts

@@ -1,115 +0,0 @@
-/**
- * Device-first password sign-in (`passwordSignIn` + `completeTwoFactorSignIn`).
- * Stubs `makeRequest` and asserts the login-result contract handling: the 2FA
- * arm passes through un-planted, the session arm plants its access token and
- * carries the zero-cookie `deviceId` + `deviceSecret` restore credential,
- * `deviceName` / `deviceFingerprint` are threaded into the request, and a 2FA
- * arm returned from verify-login is a protocol error.
- */
-import type { LoginResult } from '@oxyhq/contracts';
-import { OxyServices } from '../../OxyServices';
-
-const SESSION_ARM: LoginResult = {
-  sessionId: 'sess-1',
-  deviceId: 'dev-1',
-  expiresAt: '2030-01-01T00:00:00.000Z',
-  accessToken: 'access-1',
-  deviceSecret: 'ds-secret-1',
-  user: { id: 'user-1', username: 'u' },
-};
-
-const TWO_FACTOR_ARM: LoginResult = { twoFactorRequired: true, loginToken: 'login-token-1' };
-
-describe('passwordSignIn', () => {
-  let oxy: OxyServices;
-  let makeRequest: jest.SpyInstance;
-  let setTokens: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeRequest = jest.spyOn(oxy, 'makeRequest');
-    setTokens = jest.spyOn(oxy, 'setTokens').mockImplementation(() => undefined);
-  });
-
-  afterEach(() => jest.restoreAllMocks());
-
-  it('returns the 2FA arm without planting a token', async () => {
-    makeRequest.mockResolvedValueOnce(TWO_FACTOR_ARM);
-    const result = await oxy.passwordSignIn('alice', 'pw');
-    expect(result).toEqual(TWO_FACTOR_ARM);
-    expect(setTokens).not.toHaveBeenCalled();
-  });
-
-  it('plants the access token on the session arm, exposes the mint credential, and threads deviceName + deviceFingerprint', async () => {
-    makeRequest.mockResolvedValueOnce(SESSION_ARM);
-    const result = await oxy.passwordSignIn('alice', 'pw', { deviceName: 'Phone', deviceFingerprint: 'fp-1' });
-    expect(result).toEqual(SESSION_ARM);
-    // The zero-cookie restore credential is on the session arm the caller persists.
-    expect('twoFactorRequired' in result).toBe(false);
-    if (!('twoFactorRequired' in result)) {
-      expect(result.deviceId).toBe('dev-1');
-      expect(result.deviceSecret).toBe('ds-secret-1');
-    }
-    expect(setTokens).toHaveBeenCalledWith('access-1');
-    expect(makeRequest).toHaveBeenCalledWith(
-      'POST',
-      '/auth/login',
-      { identifier: 'alice', password: 'pw', deviceName: 'Phone', deviceFingerprint: 'fp-1' },
-      { cache: false },
-    );
-  });
-
-  it('preserves the securityAlert on the session arm (contract parse must not strip it)', async () => {
-    const withAlert: LoginResult = {
-      ...SESSION_ARM,
-      securityAlert: {
-        message: 'Unusual activity detected on your account',
-        anomalies: [{ type: 'new_device', reason: 'first seen', details: 'Chrome / macOS' }],
-      },
-    };
-    makeRequest.mockResolvedValueOnce(withAlert);
-    const result = await oxy.passwordSignIn('alice', 'pw');
-    expect('twoFactorRequired' in result).toBe(false);
-    if (!('twoFactorRequired' in result)) {
-      expect(result.securityAlert?.message).toBe('Unusual activity detected on your account');
-      expect(result.securityAlert?.anomalies[0]?.type).toBe('new_device');
-    }
-  });
-
-  it('throws on an unexpected response shape', async () => {
-    makeRequest.mockResolvedValueOnce({ nope: true });
-    await expect(oxy.passwordSignIn('alice', 'pw')).rejects.toThrow();
-  });
-});
-
-describe('completeTwoFactorSignIn', () => {
-  let oxy: OxyServices;
-  let makeRequest: jest.SpyInstance;
-  let setTokens: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeRequest = jest.spyOn(oxy, 'makeRequest');
-    setTokens = jest.spyOn(oxy, 'setTokens').mockImplementation(() => undefined);
-  });
-
-  afterEach(() => jest.restoreAllMocks());
-
-  it('verifies the login token, plants the session, and POSTs to /security/2fa/verify-login', async () => {
-    makeRequest.mockResolvedValueOnce(SESSION_ARM);
-    const result = await oxy.completeTwoFactorSignIn({ loginToken: 'lt', token: '123456', deviceName: 'Phone' });
-    expect(result).toEqual(SESSION_ARM);
-    expect(setTokens).toHaveBeenCalledWith('access-1');
-    expect(makeRequest).toHaveBeenCalledWith(
-      'POST',
-      '/security/2fa/verify-login',
-      { loginToken: 'lt', token: '123456', backupCode: undefined, deviceName: 'Phone' },
-      { cache: false },
-    );
-  });
-
-  it('throws when verify-login unexpectedly returns another 2FA challenge', async () => {
-    makeRequest.mockResolvedValueOnce(TWO_FACTOR_ARM);
-    await expect(oxy.completeTwoFactorSignIn({ loginToken: 'lt', token: '123456' })).rejects.toThrow();
-  });
-});