@oxyhq/core 11.0.1 → 12.1.0

package/src/session/accountDialogController.ts

@@ -12,18 +12,23 @@
  *   - the unified account list (via {@link projectSwitchableAccounts}), fetched
  *     from `SessionClient` state ∪ `oxyServices.listAccounts()` and hydrated
  *     with `oxyServices.getUsersByIds()`;
- *   - the dialog `view` state machine (`accounts` | `signin` | `qr` | `add`);
+ *   - the dialog `view` state machine (`accounts` | `signin` | `qr` | `add` |
+ *     `signup`);
  *   - `switchTo` (the uniform switch: `SessionClient.switchAccount` for an
  *     account already on the device, `oxyServices.switchToAccount` to mint on
  *     first entry into a graph account — reusing the existing SDK primitives, no
  *     new switch path);
  *   - the "Sign in with Oxy" device flow (same-device shared-keychain via
  *     `oxyServices.signInWithSharedIdentity`, else the cross-device QR handoff
- *     via `startCommonsSignIn` → poll → `claimSessionByToken`).
+ *     via `startCommonsSignIn` → poll → `claimSessionByToken`);
+ *   - `commonsAvailability` — whether Commons is installed on this device
+ *     (native only, via the injected `canOpenApp` probe), so the QR view can
+ *     offer a "Get Commons" fallback instead of a same-device dead end.
  *
- * It deliberately owns NO password/2FA logic — those live at the IdP
- * (auth.oxy.so). {@link AccountDialogController.openPasswordAtOxyAuth} only
- * builds the hand-off URL; device-first convergence syncs the session back.
+ * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
+ * password, social login, and 2FA were removed ecosystem-wide. Account
+ * creation (`signup` view) is the same two identity backends: a passkey
+ * ceremony on web, or a Commons-created identity.
  */
 
 import type { OxyServices } from '../OxyServices';
@@ -31,13 +36,6 @@ import type { SessionLoginResponse, MinimalUserData } from '../models/session';
 import type { User } from '../models/interfaces';
 import { logger } from '../logger';
 import { extractErrorStatus } from '../utils/errorUtils';
-import { CENTRAL_IDP_APEX } from '../utils/authWebUrl';
-import {
-  generateOAuthState,
-  generatePkcePair,
-  normalizeOAuthRedirectUri,
-  persistOAuthHandshake,
-} from '../utils/oauthPkce';
 import type { SessionClient } from './SessionClient';
 import type { MinimalSocket, SocketIOFactory } from './socketLoader';
 import {
@@ -48,7 +46,20 @@ import {
 import type { AccountNode } from '../mixins/OxyServices.accounts';
 
 /** The dialog's top-level view. */
-export type AccountDialogView = 'accounts' | 'signin' | 'qr' | 'add';
+export type AccountDialogView = 'accounts' | 'signin' | 'qr' | 'add' | 'signup';
+
+/**
+ * Whether Commons is installed on this device, as resolved by the injected
+ * `canOpenApp` probe:
+ *   - `'unknown'` — not yet probed, OR no probe was injected (web — there is
+ *     no API to ask a browser whether a custom URL scheme is registered, so
+ *     this stays `'unknown'` forever there and the QR view renders
+ *     unconditionally, no gating).
+ *   - `'checking'` — the probe is in flight.
+ *   - `'available'` / `'unavailable'` — the probe's resolved terminal answer
+ *     (native only). A probe error is treated as `'unavailable'` (fail-closed).
+ */
+export type CommonsAvailability = 'unknown' | 'checking' | 'available' | 'unavailable';
 
 /** Lifecycle phase of the "Sign in with Oxy" device flow. */
 export type SignInFlowPhase = 'idle' | 'starting' | 'waiting' | 'authorized' | 'error';
@@ -88,6 +99,8 @@ export interface AccountDialogSnapshot {
   switchingAccountId: string | null;
   /** The "Sign in with Oxy" device-flow state. */
   signIn: SignInFlowState;
+  /** Whether Commons is installed on this device. See {@link CommonsAvailability}. */
+  commonsAvailability: CommonsAvailability;
 }
 
 /** Construction options for {@link AccountDialogController}. */
@@ -106,25 +119,38 @@ export interface AccountDialogControllerOptions {
   /** Locale for display-name resolution. */
   locale?: string;
   /**
-   * Commit a freshly-authorized session (device flow / shared identity / minted
-   * graph switch) into the host's session set — device-first registration +
-   * durable persist + profile hydration. The consumer supplies its provider's
-   * commit path (`useOxy().handleWebSession` / the auth-sdk equivalent). Called
-   * AFTER the SDK has planted the access token. When omitted the controller
-   * falls back to `SessionClient.registerAndActivate` (registration + activation
-   * only — no provider-side durable persist/hydration).
+   * Commit a freshly-authorized SIGN-IN session (device flow / shared identity)
+   * into the host's session set — device-first registration + durable persist +
+   * profile hydration. The consumer supplies its provider's commit path
+   * (`useOxy().handleWebSession` / the auth-sdk equivalent). Called AFTER the SDK
+   * has planted the access token. When omitted the controller falls back to
+   * `SessionClient.registerAndActivate` (registration + activation only — no
+   * provider-side durable persist/hydration).
+   *
+   * This is the SIGN-IN commit: on an official web origin it may run the
+   * cross-origin hub-sync (a full-page redirect to `auth.oxy.so/sync`) that
+   * bootstraps silent OAuth restore on OTHER origins. A first sign-in on a web
+   * origin legitimately needs that. An account SWITCH does NOT — see
+   * {@link commitSwitchedSession}.
    */
   commitSession?: (session: SessionLoginResponse) => Promise<void>;
-  /** Notified after a completed sign-in (bearer planted + session committed). */
-  onSignedIn?: (user: MinimalUserData) => void;
-  /** Central IdP apex for `openPasswordAtOxyAuth` (defaults to `CENTRAL_IDP_APEX`). */
-  idpApex?: string;
   /**
-   * Registered OAuth redirect URI for this RP (exact match against
-   * `Application.redirectUris`). When set, wins over `returnUrl` /
-   * `location.origin` normalization in {@link openPasswordAtOxyAuth}.
+   * Commit a minted graph SWITCH session into the host's session set — same
+   * device-first registration + durable persist + profile hydration as
+   * {@link commitSession}, but IN-PLACE: it must NOT trigger the cross-origin
+   * hub-sync redirect. Switching into an account you already operate reuses the
+   * device credential that was already hub-synced at the original sign-in, so
+   * re-syncing is redundant and a full-page redirect on switch is the exact
+   * regression this separation prevents. Cross-tab/app propagation of the switch
+   * still happens instantly via the server's device-scoped `session_state` /
+   * `session_accounts_changed` socket broadcast — no navigation required.
+   *
+   * When omitted the controller falls back to {@link commitSession} (if wired)
+   * and then to `SessionClient.registerAndActivate`.
    */
-  authRedirectUri?: string | null;
+  commitSwitchedSession?: (session: SessionLoginResponse) => Promise<void>;
+  /** Notified after a completed sign-in (bearer planted + session committed). */
+  onSignedIn?: (user: MinimalUserData) => void;
   /**
    * QR device-flow FALLBACK poll interval in ms (default 12000). The primary
    * approval signal is the `/auth-session` socket's `auth_update` event (instant);
@@ -140,8 +166,8 @@ export interface AccountDialogControllerOptions {
    */
   socketFactory?: SocketIOFactory;
   /**
-   * Optional URL opener. When provided, `openPasswordAtOxyAuth` invokes it with
-   * the built URL in addition to returning it (web: `location.assign`; native:
+   * Optional URL opener. When provided, the controller invokes it to deep-link
+   * the Commons app for the QR handoff (web: `location.assign`; native:
    * `Linking.openURL`). Headless core never touches `window`/`Linking` itself.
    */
   openUrl?: (url: string) => void;
@@ -195,9 +221,8 @@ export class AccountDialogController {
   private readonly clientId: string | null;
   private readonly locale?: string;
   private readonly commitSession?: (session: SessionLoginResponse) => Promise<void>;
+  private readonly commitSwitchedSession?: (session: SessionLoginResponse) => Promise<void>;
   private readonly onSignedIn?: (user: MinimalUserData) => void;
-  private readonly idpApex: string;
-  private readonly authRedirectUri: string | null;
   private readonly pollIntervalMs: number;
   private readonly openUrl?: (url: string) => void;
   private readonly canOpenApp?: (url: string) => Promise<boolean>;
@@ -213,6 +238,7 @@ export class AccountDialogController {
   private error: string | null = null;
   private switchingAccountId: string | null = null;
   private signIn: SignInFlowState = IDLE_SIGN_IN;
+  private commonsAvailability: CommonsAvailability = 'unknown';
 
   // --- Sign-in device-flow bookkeeping ---
   /** The secret device-flow token of the active QR flow (never surfaced). */
@@ -246,9 +272,8 @@ export class AccountDialogController {
     this.clientId = options.clientId ?? null;
     this.locale = options.locale;
     this.commitSession = options.commitSession;
+    this.commitSwitchedSession = options.commitSwitchedSession;
     this.onSignedIn = options.onSignedIn;
-    this.idpApex = options.idpApex ?? CENTRAL_IDP_APEX;
-    this.authRedirectUri = options.authRedirectUri ?? null;
     this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
     this.openUrl = options.openUrl;
     this.canOpenApp = options.canOpenApp;
@@ -308,6 +333,11 @@ export class AccountDialogController {
     // bearer is already planted (warm start); when signed out (cold boot before
     // restore) it re-projects from device state and makes NO private call.
     void this.refresh();
+    // Eager, cached Commons-availability probe (native only — a no-op when no
+    // `canOpenApp` was injected). It's a cheap local OS check, so by the time a
+    // user actually opens the sign-in entry it has almost always resolved —
+    // `showQr`'s own lazy probe below is only the safety net for the rare race.
+    void this.resolveCommonsAvailability();
   }
 
   /**
@@ -398,6 +428,11 @@ export class AccountDialogController {
     this.setView('add');
   }
 
+  /** Switch to the "create account" view (passkey / Commons signup entry). */
+  startSignup(): void {
+    this.setView('signup');
+  }
+
   // =========================================================================
   // Account list
   // =========================================================================
@@ -543,6 +578,10 @@ export class AccountDialogController {
             accessToken: result.accessToken,
           },
           result.user,
+          // A switch is IN-PLACE: commit without the hub-sync redirect (the
+          // device is already known/synced). Cross-tab/app propagation rides the
+          // server's `session_state` socket broadcast, not a navigation.
+          { fromSwitch: true },
         );
       }
       // Re-project + refetch immediately; the subscription also fires.
@@ -611,34 +650,65 @@ export class AccountDialogController {
       // connect, so it now runs at the slow fallback cadence.
       this.openAuthSessionSocket(handle.sessionToken);
       this.scheduleNextPoll(handle.sessionToken);
-      // Same-device convenience: if Commons is installed (native only — `canOpenApp`
-      // is undefined/false on web), deep-link straight into its approve screen with
-      // the same `oxycommons://approve?...` payload the QR encodes. The QR + polling
+      // Same-device convenience: if Commons is confirmed installed (native
+      // only — stays `'unknown'` on web, where this never opens anything),
+      // deep-link straight into its approve screen with the same
+      // `oxycommons://approve?...` payload the QR encodes. The QR + polling
       // stay live as the fallback, so a user who dismisses the app-open still
       // completes the sign-in by scanning.
-      void this.maybeOpenCommons(handle.qrPayload);
+      void this.deepLinkIntoCommonsIfAvailable(handle.qrPayload);
     } catch (error) {
       this.setSignIn({ ...IDLE_SIGN_IN, phase: 'error', error: errorMessage(error) });
     }
   }
 
   /**
-   * When a `canOpenApp` probe is injected and reports Commons installed, open the
-   * approve deep link via the injected `openUrl`. Best-effort and non-blocking: a
-   * probe/open failure is logged and swallowed — the QR/polling fallback remains.
+   * Resolve whether Commons is installed on this device via the injected
+   * `canOpenApp` probe, updating {@link commonsAvailability} as durable,
+   * observable snapshot state. Native only — a no-op when `canOpenApp` was
+   * not injected (web), where `commonsAvailability` stays `'unknown'` forever
+   * and the QR view renders unconditionally (no gating).
+   *
+   * Replaces the old `maybeOpenCommons` fire-and-forget probe, whose outcome
+   * was only ever reflected by whether Commons silently opened — a probe
+   * failure or "not installed" answer was swallowed into a debug log with no
+   * way for the UI to react. `commonsAvailability` fixes that.
    */
-  private async maybeOpenCommons(qrPayload: string): Promise<void> {
-    if (!this.canOpenApp || !this.openUrl) return;
+  private async resolveCommonsAvailability(): Promise<void> {
+    if (!this.canOpenApp) return;
+    this.commonsAvailability = 'checking';
+    this.emit();
+    let available = false;
     try {
-      if (await this.canOpenApp(COMMONS_APP_SCHEME)) {
-        this.openUrl(qrPayload);
-      }
+      available = await this.canOpenApp(COMMONS_APP_SCHEME);
     } catch (error) {
       logger.debug(
-        '[AccountDialogController] Commons deep-link probe failed (QR fallback active)',
+        '[AccountDialogController] Commons availability probe failed',
         { component: 'AccountDialogController' },
         error,
       );
+      available = false; // fail-closed — treat a probe error as "not installed"
+    }
+    this.commonsAvailability = available ? 'available' : 'unavailable';
+    this.emit();
+  }
+
+  /**
+   * When Commons is confirmed installed, deep-link straight into its approve
+   * screen via the injected `openUrl` with the same `oxycommons://approve?...`
+   * payload the QR encodes. Best-effort and non-blocking — the QR/polling
+   * fallback stays live regardless of the outcome here.
+   */
+  private async deepLinkIntoCommonsIfAvailable(qrPayload: string): Promise<void> {
+    if (!this.openUrl) return;
+    if (this.commonsAvailability === 'unknown' || this.commonsAvailability === 'checking') {
+      // The eager `start()` probe hasn't resolved yet (or was never run, e.g.
+      // `showQr` called without a prior `start()`) — resolve it now rather
+      // than skipping the deep link.
+      await this.resolveCommonsAvailability();
+    }
+    if (this.commonsAvailability === 'available') {
+      this.openUrl(qrPayload);
     }
   }
 
@@ -652,50 +722,6 @@ export class AccountDialogController {
     }
   }
 
-  /**
-   * Build (and, when an `openUrl` handler was supplied, open) the auth.oxy.so
-   * password sign-in URL. Password + 2FA are NOT in the SDK — they live at the
-   * IdP; this only hands off. Device-first: after login at the IdP the device
-   * session converges and the caller is woken via the device socket /
-   * `BroadcastChannel`, so the URL only needs to point at the IdP sign-in with
-   * the right return.
-   *
-   * @param params.returnUrl - Where the IdP returns after login. Defaults to the
-   *   current document URL on web (`globalThis.location.href`); pass explicitly
-   *   on native (no `location`).
-   * @param params.state - Optional opaque state echoed back on return.
-   * @returns The absolute auth.oxy.so sign-in URL.
-   */
-  async openPasswordAtOxyAuth(
-    params: { returnUrl?: string; state?: string; redirectUri?: string } = {},
-  ): Promise<string> {
-    const base = `https://auth.${this.idpApex}`;
-    const url = new URL('/login', base);
-    const rawRedirect =
-      params.redirectUri ??
-      this.authRedirectUri ??
-      params.returnUrl ??
-      currentLocationOrigin();
-    const redirectUri = rawRedirect ? normalizeOAuthRedirectUri(rawRedirect) : '';
-    if (redirectUri) {
-      url.searchParams.set('redirect_uri', redirectUri);
-    }
-    if (this.clientId) {
-      url.searchParams.set('client_id', this.clientId);
-    }
-    const state = params.state ?? (await generateOAuthState());
-    url.searchParams.set('state', state);
-    const { codeChallenge, codeVerifier } = await generatePkcePair();
-    url.searchParams.set('code_challenge', codeChallenge);
-    url.searchParams.set('code_challenge_method', 'S256');
-    if (!persistOAuthHandshake(state, codeVerifier)) {
-      throw new Error('Could not persist OAuth handshake for password sign-in');
-    }
-    const href = url.toString();
-    this.openUrl?.(href);
-    return href;
-  }
-
   // =========================================================================
   // Internal sign-in helpers
   // =========================================================================
@@ -819,15 +845,25 @@ export class AccountDialogController {
 
   /**
    * Register a token-planted session into the device set. Prefers the
-   * consumer's `commitSession` (durable persist + hydration); falls back to
+   * consumer's commit funnel (durable persist + hydration); falls back to
    * `SessionClient.registerAndActivate` (registration + activation only).
+   *
+   * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel
+   * so it never runs the cross-origin hub-sync redirect; a SIGN-IN uses
+   * `commitSession` (which may hub-sync on an official web origin). When the
+   * switch funnel is not wired it falls back to the sign-in funnel, then to
+   * `registerAndActivate`.
    */
   private async commitAuthorizedSession(
     session: SessionLoginResponse,
     user: MinimalUserData,
+    opts?: { fromSwitch?: boolean },
   ): Promise<void> {
-    if (this.commitSession) {
-      await this.commitSession(session);
+    const commit = opts?.fromSwitch
+      ? this.commitSwitchedSession ?? this.commitSession
+      : this.commitSession;
+    if (commit) {
+      await commit(session);
     } else {
       await this.sessionClient.registerAndActivate(user.id);
     }
@@ -939,6 +975,7 @@ export class AccountDialogController {
       error: this.error,
       switchingAccountId: this.switchingAccountId,
       signIn: this.signIn,
+      commonsAvailability: this.commonsAvailability,
     };
   }
 
@@ -961,13 +998,3 @@ export function createAccountDialogController(
 ): AccountDialogController {
   return new AccountDialogController(options);
 }
-
-// ---------------------------------------------------------------------------
-// Local helpers
-// ---------------------------------------------------------------------------
-
-/** Current document origin on web; empty string where `location` is absent (native/SSR). */
-function currentLocationOrigin(): string {
-  const location = (globalThis as { location?: { origin?: string } }).location;
-  return typeof location?.origin === 'string' ? location.origin : '';
-}

package/src/utils/__tests__/officialOrigins.test.ts

@@ -3,6 +3,7 @@ import {
   buildIdpHubOrigin,
   isAllowedDeviceJoinOrigin,
   isIdpHubOrigin,
+  isLoopbackOrigin,
   isOfficialWebOrigin,
   normalizeOfficialReturnOrigin,
   parseHubSyncReturnUrl,
@@ -19,6 +20,19 @@ describe('officialOrigins', () => {
     expect(isOfficialWebOrigin('https://evil.example')).toBe(false);
   });
 
+  it('flags loopback / local-dev origins on any port', () => {
+    expect(isLoopbackOrigin('http://localhost:3000')).toBe(true);
+    expect(isLoopbackOrigin('http://127.0.0.1:8081')).toBe(true);
+    expect(isLoopbackOrigin('http://[::1]:19006')).toBe(true);
+    expect(isLoopbackOrigin('https://localhost')).toBe(true);
+    expect(isLoopbackOrigin('https://accounts.oxy.so')).toBe(false);
+    expect(isLoopbackOrigin('https://evil.example')).toBe(false);
+  });
+
+  it('treats loopback as an official origin (loopback dev is trusted)', () => {
+    expect(isOfficialWebOrigin('http://localhost:3000')).toBe(true);
+  });
+
   it('keeps the deprecated alias in sync with isOfficialWebOrigin', () => {
     expect(isAllowedDeviceJoinOrigin('https://accounts.oxy.so')).toBe(true);
     expect(isAllowedDeviceJoinOrigin('https://evil.example')).toBe(false);

package/src/utils/officialOrigins.ts

@@ -41,7 +41,12 @@ export function isIdpHubOrigin(): boolean {
   }
 }
 
-function isLoopbackOrigin(origin: string): boolean {
+/**
+ * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
+ * or `[::1]` on any port, http or https). Local dev must never be bounced to a
+ * hosted IdP for cross-origin session restore.
+ */
+export function isLoopbackOrigin(origin: string): boolean {
   try {
     const parsed = new URL(origin);
     if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {

package/src/mixins/__tests__/passwordSignIn.test.ts

@@ -1,115 +0,0 @@
-/**
- * Device-first password sign-in (`passwordSignIn` + `completeTwoFactorSignIn`).
- * Stubs `makeRequest` and asserts the login-result contract handling: the 2FA
- * arm passes through un-planted, the session arm plants its access token and
- * carries the zero-cookie `deviceId` + `deviceSecret` restore credential,
- * `deviceName` / `deviceFingerprint` are threaded into the request, and a 2FA
- * arm returned from verify-login is a protocol error.
- */
-import type { LoginResult } from '@oxyhq/contracts';
-import { OxyServices } from '../../OxyServices';
-
-const SESSION_ARM: LoginResult = {
-  sessionId: 'sess-1',
-  deviceId: 'dev-1',
-  expiresAt: '2030-01-01T00:00:00.000Z',
-  accessToken: 'access-1',
-  deviceSecret: 'ds-secret-1',
-  user: { id: 'user-1', username: 'u' },
-};
-
-const TWO_FACTOR_ARM: LoginResult = { twoFactorRequired: true, loginToken: 'login-token-1' };
-
-describe('passwordSignIn', () => {
-  let oxy: OxyServices;
-  let makeRequest: jest.SpyInstance;
-  let setTokens: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeRequest = jest.spyOn(oxy, 'makeRequest');
-    setTokens = jest.spyOn(oxy, 'setTokens').mockImplementation(() => undefined);
-  });
-
-  afterEach(() => jest.restoreAllMocks());
-
-  it('returns the 2FA arm without planting a token', async () => {
-    makeRequest.mockResolvedValueOnce(TWO_FACTOR_ARM);
-    const result = await oxy.passwordSignIn('alice', 'pw');
-    expect(result).toEqual(TWO_FACTOR_ARM);
-    expect(setTokens).not.toHaveBeenCalled();
-  });
-
-  it('plants the access token on the session arm, exposes the mint credential, and threads deviceName + deviceFingerprint', async () => {
-    makeRequest.mockResolvedValueOnce(SESSION_ARM);
-    const result = await oxy.passwordSignIn('alice', 'pw', { deviceName: 'Phone', deviceFingerprint: 'fp-1' });
-    expect(result).toEqual(SESSION_ARM);
-    // The zero-cookie restore credential is on the session arm the caller persists.
-    expect('twoFactorRequired' in result).toBe(false);
-    if (!('twoFactorRequired' in result)) {
-      expect(result.deviceId).toBe('dev-1');
-      expect(result.deviceSecret).toBe('ds-secret-1');
-    }
-    expect(setTokens).toHaveBeenCalledWith('access-1');
-    expect(makeRequest).toHaveBeenCalledWith(
-      'POST',
-      '/auth/login',
-      { identifier: 'alice', password: 'pw', deviceName: 'Phone', deviceFingerprint: 'fp-1' },
-      { cache: false },
-    );
-  });
-
-  it('preserves the securityAlert on the session arm (contract parse must not strip it)', async () => {
-    const withAlert: LoginResult = {
-      ...SESSION_ARM,
-      securityAlert: {
-        message: 'Unusual activity detected on your account',
-        anomalies: [{ type: 'new_device', reason: 'first seen', details: 'Chrome / macOS' }],
-      },
-    };
-    makeRequest.mockResolvedValueOnce(withAlert);
-    const result = await oxy.passwordSignIn('alice', 'pw');
-    expect('twoFactorRequired' in result).toBe(false);
-    if (!('twoFactorRequired' in result)) {
-      expect(result.securityAlert?.message).toBe('Unusual activity detected on your account');
-      expect(result.securityAlert?.anomalies[0]?.type).toBe('new_device');
-    }
-  });
-
-  it('throws on an unexpected response shape', async () => {
-    makeRequest.mockResolvedValueOnce({ nope: true });
-    await expect(oxy.passwordSignIn('alice', 'pw')).rejects.toThrow();
-  });
-});
-
-describe('completeTwoFactorSignIn', () => {
-  let oxy: OxyServices;
-  let makeRequest: jest.SpyInstance;
-  let setTokens: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeRequest = jest.spyOn(oxy, 'makeRequest');
-    setTokens = jest.spyOn(oxy, 'setTokens').mockImplementation(() => undefined);
-  });
-
-  afterEach(() => jest.restoreAllMocks());
-
-  it('verifies the login token, plants the session, and POSTs to /security/2fa/verify-login', async () => {
-    makeRequest.mockResolvedValueOnce(SESSION_ARM);
-    const result = await oxy.completeTwoFactorSignIn({ loginToken: 'lt', token: '123456', deviceName: 'Phone' });
-    expect(result).toEqual(SESSION_ARM);
-    expect(setTokens).toHaveBeenCalledWith('access-1');
-    expect(makeRequest).toHaveBeenCalledWith(
-      'POST',
-      '/security/2fa/verify-login',
-      { loginToken: 'lt', token: '123456', backupCode: undefined, deviceName: 'Phone' },
-      { cache: false },
-    );
-  });
-
-  it('throws when verify-login unexpectedly returns another 2FA challenge', async () => {
-    makeRequest.mockResolvedValueOnce(TWO_FACTOR_ARM);
-    await expect(oxy.completeTwoFactorSignIn({ loginToken: 'lt', token: '123456' })).rejects.toThrow();
-  });
-});