@oxyhq/core 12.1.0 → 12.2.0

package/dist/esm/session/accountDialogController.js

@@ -24,6 +24,12 @@
  *   - `commonsAvailability` — whether Commons is installed on this device
  *     (native only, via the injected `canOpenApp` probe), so the QR view can
  *     offer a "Get Commons" fallback instead of a same-device dead end.
+ *   - `startPasskeyHubSignIn` — on a non-Oxy web origin (where a WebAuthn
+ *     ceremony can't run locally, the RP-ID is bound to oxy.so), open a popup
+ *     at the auth.oxy.so passkey hub instead, scoped to the SAME device-flow
+ *     session `showQr` creates, and complete it via the SAME poll/socket/claim
+ *     engine. Falls back to `showQr`'s plain QR rendering if the popup is
+ *     blocked.
  *
  * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
  * password, social login, and 2FA were removed ecosystem-wide. Account
@@ -32,6 +38,7 @@
  */
 import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
+import { CENTRAL_IDP_APEX } from '../utils/authWebUrl.js';
 import { projectSwitchableAccounts, switchableAccountIds, } from './accountProjection.js';
 /**
  * Slow FALLBACK poll cadence for the QR flow. The `/auth-session` socket delivers
@@ -86,6 +93,10 @@ export class AccountDialogController {
          * single-use token concurrently.
          */
         this.pollInFlight = false;
+        /** The popup opened by {@link startPasskeyHubSignIn}, or `null`. */
+        this.activePopup = null;
+        /** Watches {@link activePopup}'s `closed` state; see {@link watchPopup}. */
+        this.popupWatchTimer = null;
         // --- Store plumbing ---
         this.unsubscribeSession = null;
         this.unsubscribeTokens = null;
@@ -104,6 +115,8 @@ export class AccountDialogController {
         this.openUrl = options.openUrl;
         this.canOpenApp = options.canOpenApp;
         this.socketFactory = options.socketFactory;
+        this.openPopup = options.openPopup;
+        this.hubBaseUrl = options.hubBaseUrl ?? `https://auth.${CENTRAL_IDP_APEX}`;
         this.snapshot = this.computeSnapshot();
     }
     // =========================================================================
@@ -177,6 +190,7 @@ export class AccountDialogController {
         }
         this.clearPollTimer();
         this.closeAuthSessionSocket();
+        this.closeActivePopup();
         this.signInToken = null;
         this.listeners.clear();
     }
@@ -444,9 +458,62 @@ export class AccountDialogController {
     async showQr() {
         this.cancelSignIn();
         this.setView('qr');
+        await this.startDeviceFlowSession();
+    }
+    /**
+     * Web-only: "Sign in with a passkey" on a non-Oxy origin cannot run the
+     * WebAuthn ceremony locally — a credential minted with `WEBAUTHN_RP_ID=oxy.so`
+     * can only be asserted from `oxy.so`/a subdomain/loopback, a browser-enforced
+     * boundary `isOxyRpOrigin()` (consumer-side) already gates on. Instead, open
+     * a popup at the auth.oxy.so passkey hub, scoped to the SAME device-flow
+     * session {@link showQr} would create (same `authorizeCode`/`sessionToken`
+     * pair), and let the SAME poll/socket/claim engine complete it once the hub
+     * authorizes the session (`POST /auth/session/authorize-code/:authorizeCode`,
+     * bearer-authed, server-side — this method never sees or transmits the
+     * secret `sessionToken`).
+     *
+     * The popup MUST be opened synchronously, before any `await`, or the
+     * browser's popup blocker loses the click-gesture attribution and silently
+     * blocks it — so {@link openPopup} is invoked as the very first step, before
+     * the device-flow session (which needs an async call) even exists. If the
+     * popup is blocked (or no `openPopup` was injected), this falls back to
+     * `showQr`'s plain QR rendering — no dead end.
+     */
+    async startPasskeyHubSignIn() {
+        this.cancelSignIn();
+        this.setView('qr');
+        const popup = this.openPopup?.() ?? null;
+        if (!popup) {
+            await this.startDeviceFlowSession();
+            return;
+        }
+        const handle = await this.startDeviceFlowSession();
+        if (!handle) {
+            popup.close();
+            return;
+        }
+        // The user may have closed the popup during the async session creation
+        // above, before any watcher was attached to catch it — guard rather than
+        // navigate a dead window (browsers vary on whether that throws).
+        if (popup.closed) {
+            this.failSignIn('Sign-in was cancelled.');
+            return;
+        }
+        this.activePopup = popup;
+        popup.location.href = `${this.hubBaseUrl}/hub-passkey?code=${encodeURIComponent(handle.authorizeCode)}`;
+        this.watchPopup(popup);
+    }
+    /**
+     * Shared device-flow session creation for both {@link showQr} (renders the
+     * QR) and {@link startPasskeyHubSignIn} (also opens the hub popup) — the
+     * same `startCommonsSignIn` → poll/socket wiring either way. Returns the
+     * handle on success (already reflected in `signIn`), or `null` on failure
+     * (already set as `signIn.error`).
+     */
+    async startDeviceFlowSession() {
         if (!this.clientId) {
             this.setSignIn({ ...IDLE_SIGN_IN, phase: 'error', error: 'This app is not configured for sign-in (missing clientId).' });
-            return;
+            return null;
         }
         this.setSignIn({ ...IDLE_SIGN_IN, phase: 'starting' });
         try {
@@ -471,9 +538,49 @@ export class AccountDialogController {
             // stay live as the fallback, so a user who dismisses the app-open still
             // completes the sign-in by scanning.
             void this.deepLinkIntoCommonsIfAvailable(handle.qrPayload);
+            return handle;
         }
         catch (error) {
             this.setSignIn({ ...IDLE_SIGN_IN, phase: 'error', error: errorMessage(error) });
+            return null;
+        }
+    }
+    /**
+     * Poll {@link PopupWindowHandle.closed} so a user who dismisses the hub
+     * popup without completing sign-in gets prompt feedback (there is no DOM
+     * event for a cross-origin popup closing — polling is the only mechanism).
+     * Cleared by {@link closeActivePopup}, which every sign-in exit path already
+     * calls.
+     */
+    watchPopup(popup) {
+        this.clearPopupWatchTimer();
+        this.popupWatchTimer = setInterval(() => {
+            if (!popup.closed)
+                return;
+            this.clearPopupWatchTimer();
+            if (this.signIn.phase === 'starting' || this.signIn.phase === 'waiting') {
+                this.failSignIn('Sign-in was cancelled.');
+            }
+        }, 1000);
+    }
+    clearPopupWatchTimer() {
+        if (this.popupWatchTimer !== null) {
+            clearInterval(this.popupWatchTimer);
+            this.popupWatchTimer = null;
+        }
+    }
+    /** Tear down the popup watch timer and close the popup, if any. Idempotent. */
+    closeActivePopup() {
+        this.clearPopupWatchTimer();
+        const popup = this.activePopup;
+        this.activePopup = null;
+        if (!popup || popup.closed)
+            return;
+        try {
+            popup.close();
+        }
+        catch (error) {
+            logger.debug('[AccountDialogController] popup close failed', { component: 'AccountDialogController' }, error);
         }
     }
     /**
@@ -523,10 +630,11 @@ export class AccountDialogController {
             this.openUrl(qrPayload);
         }
     }
-    /** Tear down the active sign-in device flow (timers + socket + token) and reset to idle. */
+    /** Tear down the active sign-in device flow (timers + socket + popup + token) and reset to idle. */
     cancelSignIn() {
         this.clearPollTimer();
         this.closeAuthSessionSocket();
+        this.closeActivePopup();
         this.signInToken = null;
         if (this.signIn !== IDLE_SIGN_IN) {
             this.setSignIn(IDLE_SIGN_IN);
@@ -635,6 +743,7 @@ export class AccountDialogController {
         this.signInToken = null;
         this.clearPollTimer();
         this.closeAuthSessionSocket();
+        this.closeActivePopup();
         this.signIn = IDLE_SIGN_IN;
         this.view = 'accounts';
         this.emit();
@@ -666,6 +775,7 @@ export class AccountDialogController {
     failSignIn(message) {
         this.clearPollTimer();
         this.closeAuthSessionSocket();
+        this.closeActivePopup();
         this.signInToken = null;
         this.setSignIn({ ...IDLE_SIGN_IN, phase: 'error', error: message });
     }