@oxyhq/core 11.0.1 → 12.1.0

package/src/mixins/OxyServices.identity.ts

@@ -53,7 +53,7 @@ const OXY_IDENTITY_APEX = 'oxy.so';
 export type IdentityRecordType = OxySignedRecordType;
 
 /** Auth-method types that can be unlinked via {@link OxyServicesIdentityMixin}. */
-export type UnlinkableAuthMethodType = 'identity' | 'password' | 'google' | 'apple' | 'github';
+export type UnlinkableAuthMethodType = 'identity' | 'webauthn';
 
 /**
  * Result of a link/unlink auth-method mutation (`POST /auth/link`,
@@ -207,18 +207,18 @@ export function OxyServicesIdentityMixin<T extends typeof OxyServicesBase>(Base:
     }
 
     /**
-     * Link password authentication to the current account. Adds a `password`
-     * auth method (does not remove existing methods).
+     * Unlink an authentication method from the current account. The server
+     * refuses to remove the last remaining method (the account would become
+     * inaccessible). Unlinking `identity` downgrades the account to custodial.
      *
-     * @param email - The email to associate with password auth.
-     * @param password - The new password (server enforces strength rules).
+     * @param type - The auth-method type to remove.
      */
-    async linkPassword(email: string, password: string): Promise<LinkAuthMethodResult> {
+    async unlinkAuthMethod(type: UnlinkableAuthMethodType): Promise<LinkAuthMethodResult> {
       try {
         const result = await this.makeRequest<LinkAuthMethodResult>(
-          'POST',
-          '/auth/link',
-          { type: 'password', email, password },
+          'DELETE',
+          `/auth/link/${encodeURIComponent(type)}`,
+          undefined,
           { cache: false },
         );
         this._invalidateIdentityCaches(this.getCurrentUserId());
@@ -229,17 +229,21 @@ export function OxyServicesIdentityMixin<T extends typeof OxyServicesBase>(Base:
     }
 
     /**
-     * Unlink an authentication method from the current account. The server
-     * refuses to remove the last remaining method (the account would become
-     * inaccessible). Unlinking `identity` downgrades the account to custodial.
+     * Remove ONE passkey (WebAuthn credential) from the current account.
      *
-     * @param type - The auth-method type to remove.
+     * Passkeys are per-credential, so unlike {@link unlinkAuthMethod} (which
+     * removes an auth method by type) this targets a specific credential id.
+     * The server refuses to remove the last remaining auth method (the account
+     * would become inaccessible) and deletes the stored `WebauthnCredential`.
+     *
+     * @param credentialId - The passkey's public credential id
+     *   (`AuthMethodEntry.credentialId`).
      */
-    async unlinkAuthMethod(type: UnlinkableAuthMethodType): Promise<LinkAuthMethodResult> {
+    async removePasskey(credentialId: string): Promise<LinkAuthMethodResult> {
       try {
         const result = await this.makeRequest<LinkAuthMethodResult>(
           'DELETE',
-          `/auth/link/${encodeURIComponent(type)}`,
+          `/auth/link/webauthn/${encodeURIComponent(credentialId)}`,
           undefined,
           { cache: false },
         );

package/src/mixins/__tests__/OxyServices.identity.test.ts

@@ -186,37 +186,49 @@ describe('OxyServices.identity', () => {
     });
   });
 
-  describe('linkPassword', () => {
-    it('POSTs /auth/link with the password method and sweeps cache', async () => {
-      makeRequestSpy.mockResolvedValue({ success: true, message: 'Password auth linked successfully' });
+  describe('unlinkAuthMethod', () => {
+    it('DELETEs /auth/link/:type and sweeps cache', async () => {
+      makeRequestSpy.mockResolvedValue({ success: true, message: 'identity auth unlinked successfully' });
 
-      await oxy.linkPassword('nate@oxy.so', 'sup3r-secret');
+      await oxy.unlinkAuthMethod('identity');
 
       expect(makeRequestSpy).toHaveBeenCalledWith(
-        'POST',
-        '/auth/link',
-        { type: 'password', email: 'nate@oxy.so', password: 'sup3r-secret' },
+        'DELETE',
+        '/auth/link/identity',
+        undefined,
         expect.objectContaining({ cache: false }),
       );
-      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
-      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/auth/methods');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
     });
   });
 
-  describe('unlinkAuthMethod', () => {
-    it('DELETEs /auth/link/:type and sweeps cache', async () => {
-      makeRequestSpy.mockResolvedValue({ success: true, message: 'identity auth unlinked successfully' });
+  describe('removePasskey', () => {
+    it('DELETEs /auth/link/webauthn/:credentialID and sweeps cache', async () => {
+      makeRequestSpy.mockResolvedValue({ success: true, message: 'Passkey unlinked successfully' });
 
-      await oxy.unlinkAuthMethod('identity');
+      await oxy.removePasskey('cred-abc');
 
       expect(makeRequestSpy).toHaveBeenCalledWith(
         'DELETE',
-        '/auth/link/identity',
+        '/auth/link/webauthn/cred-abc',
         undefined,
         expect.objectContaining({ cache: false }),
       );
       expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
     });
+
+    it('URL-encodes the credential id', async () => {
+      makeRequestSpy.mockResolvedValue({ success: true, message: 'Passkey unlinked successfully' });
+
+      await oxy.removePasskey('a/b+c=');
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'DELETE',
+        '/auth/link/webauthn/a%2Fb%2Bc%3D',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+    });
   });
 
   describe('signRecord (client-only)', () => {

package/src/mixins/__tests__/webauthnAuth.test.ts

@@ -3,7 +3,7 @@
  * (`webauthnRegisterOptions` / `webauthnRegisterVerify` /
  * `webauthnLoginOptions` / `webauthnLoginVerify`).
  *
- * Stubs `makeRequest` (HTTP-mock style, like `passwordSignIn.test.ts`) and
+ * Stubs `makeRequest` (HTTP-mock style) and
  * asserts: each method hits the right endpoint with the right body; the opaque
  * ceremony `response` is forwarded verbatim; the login/verify + register/verify
  * (signup) paths parse the login contract and plant the access token on the

package/src/session/__tests__/accountDialogController.test.ts

@@ -152,6 +152,7 @@ describe('AccountDialogController — initial + views', () => {
     expect(snap.loading).toBe(false);
     expect(snap.switchingAccountId).toBeNull();
     expect(snap.signIn.phase).toBe('idle');
+    expect(snap.commonsAvailability).toBe('unknown');
   });
 
   it('setView / add / close move between views and notify subscribers', () => {
@@ -169,6 +170,19 @@ describe('AccountDialogController — initial + views', () => {
     expect(seen).toEqual(['add', 'signin', 'accounts']);
   });
 
+  it('startSignup moves to the signup view and notifies subscribers', () => {
+    const { controller } = makeHarness();
+    const seen: string[] = [];
+    controller.subscribe((s) => seen.push(s.view));
+
+    controller.startSignup();
+    expect(controller.getSnapshot().view).toBe('signup');
+    controller.close();
+    expect(controller.getSnapshot().view).toBe('accounts');
+
+    expect(seen).toEqual(['signup', 'accounts']);
+  });
+
   it('getSnapshot returns a stable reference until a change occurs', () => {
     const { controller } = makeHarness();
     const a = controller.getSnapshot();
@@ -391,6 +405,54 @@ describe('AccountDialogController — switchTo (uniform switch)', () => {
     expect(commitSession.mock.calls[0][0]).toMatchObject({ sessionId: 'sess-org', accessToken: 'access-org' });
   });
 
+  it('commits a graph switch via the IN-PLACE commitSwitchedSession — never the hub-syncing commitSession', async () => {
+    // PROBLEM 2: an account switch must not run the cross-origin hub-sync
+    // full-page redirect. When both funnels are wired, the mint-switch must use
+    // commitSwitchedSession (in-place) and NEVER commitSession (which may
+    // redirect on an official web origin).
+    const oxy = makeOxy();
+    const sc = new TestSessionClient(host());
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
+    jest.spyOn(sc, 'switchAccount').mockResolvedValue(undefined);
+    oxy.switchToAccount.mockResolvedValue({
+      sessionId: 'sess-org',
+      deviceId: 'device-1',
+      expiresAt: '2030-01-01T00:00:00Z',
+      accessToken: 'access-org',
+      user: user('org1'),
+    });
+    const commitSession = jest.fn().mockResolvedValue(undefined);
+    const commitSwitchedSession = jest.fn().mockResolvedValue(undefined);
+    const controller = new AccountDialogController({
+      oxyServices: oxy as unknown as OxyServices,
+      sessionClient: sc,
+      clientId: 'oxy_dk_test',
+      commitSession,
+      commitSwitchedSession,
+    });
+
+    await controller.switchTo('org1');
+
+    expect(commitSwitchedSession).toHaveBeenCalledTimes(1);
+    expect(commitSwitchedSession.mock.calls[0][0]).toMatchObject({ sessionId: 'sess-org', accessToken: 'access-org' });
+    expect(commitSession).not.toHaveBeenCalled();
+  });
+
+  it('surfaces a failed switch as snapshot.error instead of silently no-op\'ing', async () => {
+    // PROBLEM 1: switching into an account the server refuses (e.g. a 403 for a
+    // personal-kind target) must tell the user why — the error is recorded on
+    // the snapshot, the switch does not throw, and switchingAccountId resets.
+    const { controller, oxy, sc } = makeHarness();
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
+    oxy.switchToAccount.mockRejectedValue(new Error('Cannot switch into a personal account'));
+
+    await expect(controller.switchTo('org1')).resolves.toBeUndefined();
+
+    const snap = controller.getSnapshot();
+    expect(snap.error).toBe('Cannot switch into a personal account');
+    expect(snap.switchingAccountId).toBeNull();
+  });
+
   it('falls back to SessionClient.registerAndActivate when no commitSession is supplied', async () => {
     const oxy = makeOxy();
     const sc = new TestSessionClient(host());
@@ -579,7 +641,7 @@ describe('AccountDialogController — sign in with Oxy', () => {
   });
 });
 
-describe('AccountDialogController — Commons deep-link (canOpenApp)', () => {
+describe('AccountDialogController — Commons availability (canOpenApp)', () => {
   const START_HANDLE = {
     sessionToken: 'secret-tok',
     authorizeCode: 'AUTH-CODE',
@@ -621,6 +683,7 @@ describe('AccountDialogController — Commons deep-link (canOpenApp)', () => {
     expect(snap.view).toBe('qr');
     expect(snap.signIn.phase).toBe('waiting');
     expect(snap.signIn.qrPayload).toBe('oxycommons://approve?v=1&code=AUTH-CODE');
+    expect(snap.commonsAvailability).toBe('available');
     controller.cancelSignIn();
   });
 
@@ -635,6 +698,7 @@ describe('AccountDialogController — Commons deep-link (canOpenApp)', () => {
     expect(canOpenApp).toHaveBeenCalledWith('oxycommons://');
     expect(openUrl).not.toHaveBeenCalled();
     expect(controller.getSnapshot().signIn.phase).toBe('waiting');
+    expect(controller.getSnapshot().commonsAvailability).toBe('unavailable');
     controller.cancelSignIn();
   });
 
@@ -647,10 +711,11 @@ describe('AccountDialogController — Commons deep-link (canOpenApp)', () => {
 
     expect(openUrl).not.toHaveBeenCalled();
     expect(controller.getSnapshot().signIn.qrPayload).toBe('oxycommons://approve?v=1&code=AUTH-CODE');
+    expect(controller.getSnapshot().commonsAvailability).toBe('unknown');
     controller.cancelSignIn();
   });
 
-  it('swallows a canOpenApp probe rejection and keeps the QR fallback', async () => {
+  it('swallows a canOpenApp probe rejection, keeps the QR fallback, and records unavailable', async () => {
     const openUrl = jest.fn();
     const canOpenApp = jest.fn().mockRejectedValue(new Error('probe boom'));
     const { controller } = makeController({ openUrl, canOpenApp });
@@ -660,73 +725,19 @@ describe('AccountDialogController — Commons deep-link (canOpenApp)', () => {
 
     expect(openUrl).not.toHaveBeenCalled();
     expect(controller.getSnapshot().signIn.phase).toBe('waiting');
+    expect(controller.getSnapshot().commonsAvailability).toBe('unavailable');
     controller.cancelSignIn();
   });
-});
-
-describe('AccountDialogController — openPasswordAtOxyAuth', () => {
-  beforeEach(() => {
-    const store = new Map<string, string>();
-    Object.defineProperty(globalThis, 'sessionStorage', {
-      value: {
-        getItem: (key: string) => store.get(key) ?? null,
-        setItem: (key: string, value: string) => {
-          store.set(key, value);
-        },
-        removeItem: (key: string) => {
-          store.delete(key);
-        },
-      },
-      configurable: true,
-    });
-  });
-
-  it('builds the IdP sign-in URL with redirect_uri + client_id and invokes openUrl', async () => {
-    const oxy = makeOxy();
-    const sc = new TestSessionClient(host());
-    const openUrl = jest.fn();
-    const controller = new AccountDialogController({
-      oxyServices: oxy as unknown as OxyServices,
-      sessionClient: sc,
-      clientId: 'oxy_dk_test',
-      openUrl,
-    });
-
-    const url = await controller.openPasswordAtOxyAuth({ returnUrl: 'https://mention.earth/dashboard' });
-    const parsed = new URL(url);
-    expect(parsed.origin).toBe('https://auth.oxy.so');
-    expect(parsed.pathname).toBe('/login');
-    expect(parsed.searchParams.get('redirect_uri')).toBe('https://mention.earth');
-    expect(parsed.searchParams.get('client_id')).toBe('oxy_dk_test');
-    expect(parsed.searchParams.get('state')).toBeTruthy();
-    expect(parsed.searchParams.get('code_challenge')).toBeTruthy();
-    expect(parsed.searchParams.get('code_challenge_method')).toBe('S256');
-    expect(openUrl).toHaveBeenCalledWith(url);
-  });
 
-  it('honors authRedirectUri over returnUrl', async () => {
-    const oxy = makeOxy();
-    const sc = new TestSessionClient(host());
-    const controller = new AccountDialogController({
-      oxyServices: oxy as unknown as OxyServices,
-      sessionClient: sc,
-      authRedirectUri: 'https://inbox.oxy.so',
-    });
+  it('start() eagerly resolves commonsAvailability without requiring a QR flow', async () => {
+    const canOpenApp = jest.fn().mockResolvedValue(true);
+    const { controller } = makeController({ canOpenApp });
 
-    const url = await controller.openPasswordAtOxyAuth({ returnUrl: 'https://inbox.oxy.so/mail' });
-    expect(new URL(url).searchParams.get('redirect_uri')).toBe('https://inbox.oxy.so');
-  });
+    controller.start();
+    await flush();
 
-  it('honors an idpApex override', async () => {
-    const oxy = makeOxy();
-    const sc = new TestSessionClient(host());
-    const controller = new AccountDialogController({
-      oxyServices: oxy as unknown as OxyServices,
-      sessionClient: sc,
-      idpApex: 'alia.onl',
-    });
-    const url = await controller.openPasswordAtOxyAuth({ returnUrl: 'https://alia.onl/' });
-    expect(new URL(url).origin).toBe('https://auth.alia.onl');
+    expect(canOpenApp).toHaveBeenCalledWith('oxycommons://');
+    expect(controller.getSnapshot().commonsAvailability).toBe('available');
   });
 });
 

package/src/session/__tests__/accountProjection.test.ts

@@ -164,6 +164,36 @@ describe('projectSwitchableAccounts', () => {
     });
     expect(rows.every((r) => !r.isCurrent)).toBe(true);
   });
+
+  it('keeps the OPERATOR full set when acting-as a sub-account (no collapse to the active account)', () => {
+    // nate operates albert: albert is the active on-device account, nate is also
+    // on-device, and the graph is OPERATOR-anchored (the server returns nate's
+    // full forest regardless of which account is active). The projection must
+    // faithfully union — switching in only changes which row is `isCurrent`,
+    // never which accounts are listed. This is the switcher-collapse regression.
+    const rows = projectSwitchableAccounts({
+      state: state([{ accountId: 'nate', sessionId: 's-nate' }, { accountId: 'albert', sessionId: 's-albert' }], 'albert'),
+      graph: [
+        graphNode('nate', { kind: 'personal', relationship: 'self' }),
+        graphNode('albert', { relationship: 'owner' }),
+        graphNode('oxy', { relationship: 'owner' }),
+        graphNode('faircoin', { relationship: 'owner' }),
+      ],
+      profilesById: mapOf(user('nate'), user('albert'), user('oxy'), user('faircoin')),
+      resolveAvatarUrl: noAvatar,
+    });
+
+    // The full operable set is present even though a leaf sub-account is active.
+    expect(rows.map((r) => r.accountId).sort()).toEqual(['albert', 'faircoin', 'nate', 'oxy']);
+    // Exactly the active sub-account is flagged current; operator + siblings stay.
+    expect(rows.find((r) => r.accountId === 'albert')?.isCurrent).toBe(true);
+    expect(rows.filter((r) => r.isCurrent)).toHaveLength(1);
+    // The operator's own personal account is not dropped by acting-as.
+    expect(rows.find((r) => r.accountId === 'nate')).toBeDefined();
+    // Graph-only siblings (operable but not yet on this device) still appear.
+    expect(rows.find((r) => r.accountId === 'oxy')?.onDevice).toBe(false);
+    expect(rows.find((r) => r.accountId === 'faircoin')?.onDevice).toBe(false);
+  });
 });
 
 describe('switchableAccountIds', () => {