@oxyhq/core 12.10.6 → 12.11.1

package/dist/cjs/utils/commonsDelivery.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.selectCommonsDelivery = selectCommonsDelivery;
+exports.pushTargetsFromDelivery = pushTargetsFromDelivery;
+exports.commonsDeliveryPlatform = commonsDeliveryPlatform;
+const platform_1 = require("./platform");
+/**
+ * Choose the ONE primary delivery route for a "Sign in with Oxy" request.
+ *
+ * Decision order (issue #691, "Automatic delivery selection"):
+ *
+ *  1. Mobile with a verified Commons link available → open Commons directly.
+ *     No push is needed when the identity is already reachable on this device.
+ *  2. At least one eligible Commons installation was pushed to → await the push.
+ *  3. Otherwise → QR.
+ *
+ * A caller that already knows it is on step 1 does not need to call
+ * `deliverCommonsSignIn` at all; every other caller runs the delivery
+ * round-trip first and passes its `targets` in here.
+ *
+ * `pushTargets` is server-derived, so it is validated rather than trusted: a
+ * negative, fractional, non-finite, or otherwise malformed count is treated as
+ * "no targets" and degrades to QR instead of parking the user on a "check your
+ * phone" screen that nothing will ever wake.
+ */
+function selectCommonsDelivery(facts) {
+    if (facts.platform === 'mobile' && facts.commonsAvailable) {
+        return 'open-commons';
+    }
+    if (Number.isInteger(facts.pushTargets) && facts.pushTargets >= 1) {
+        return 'await-push';
+    }
+    return 'qr';
+}
+/**
+ * Map a `deliverCommonsSignIn` result onto the `pushTargets` fact for
+ * {@link selectCommonsDelivery}. The server reports eligible install *count*
+ * separately from whether any push was accepted — a transport failure can leave
+ * `delivered: false` with `targets > 0`, which must NOT park the user on
+ * "check your phone".
+ */
+function pushTargetsFromDelivery(result) {
+    return result.delivered ? result.targets : 0;
+}
+/**
+ * Classify the current runtime surface for delivery selection. Callers that
+ * cannot confidently detect the platform should not use this — pass
+ * `'unknown'` explicitly instead.
+ */
+function commonsDeliveryPlatform() {
+    const os = (0, platform_1.getPlatformOS)();
+    if (os === 'ios' || os === 'android') {
+        return 'mobile';
+    }
+    if (os === 'web') {
+        return 'desktop';
+    }
+    return 'unknown';
+}

package/dist/cjs/utils/oauthPkce.js

@@ -17,12 +17,13 @@
  * React Native. No `require()`, so the ESM build stays bundler-clean.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.DEFAULT_OAUTH_SCOPE = exports.OXY_AUTHORIZE_URL = void 0;
+exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.DEFAULT_OAUTH_SCOPE = exports.OXY_AUTHORIZE_URL = void 0;
 exports.computeCodeChallenge = computeCodeChallenge;
 exports.generatePkcePair = generatePkcePair;
 exports.generateOAuthState = generateOAuthState;
 exports.buildOAuthAuthorizeUrl = buildOAuthAuthorizeUrl;
 exports.normalizeOAuthRedirectUri = normalizeOAuthRedirectUri;
+exports.canonicalizeOAuthRedirectUri = canonicalizeOAuthRedirectUri;
 exports.persistOAuthReturnPath = persistOAuthReturnPath;
 exports.consumeOAuthReturnPath = consumeOAuthReturnPath;
 exports.persistOAuthHandshake = persistOAuthHandshake;
@@ -147,12 +148,17 @@ function buildOAuthAuthorizeUrl(params) {
     if (params.prompt) {
         url.searchParams.set('prompt', params.prompt);
     }
+    if (params.responseMode) {
+        url.searchParams.set('response_mode', params.responseMode);
+    }
     return url.toString();
 }
 /** `sessionStorage` key for the OAuth CSRF `state` across an authorize redirect. */
 exports.OXY_OAUTH_STATE_STORAGE_KEY = 'oxy_oauth_state';
 /** `sessionStorage` key for the PKCE `code_verifier` across an authorize redirect. */
 exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = 'oxy_oauth_code_verifier';
+/** `sessionStorage` key — the exact `redirect_uri` sent on the authorize request. */
+exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = 'oxy.oauth_redirect_uri';
 /** `sessionStorage` key — at most one silent OAuth attempt per navigation. */
 exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = 'oxy.silent_oauth_attempted';
 /** `sessionStorage` key — blocks further cross-origin auto-restore in this tab. */
@@ -179,6 +185,25 @@ function normalizeOAuthRedirectUri(input) {
         return input;
     }
 }
+/**
+ * Collapse `https://app.example/` → `https://app.example` for OAuth binding.
+ * Path-qualified redirect URIs are preserved — matches the API token exchange.
+ */
+function canonicalizeOAuthRedirectUri(redirectUri) {
+    try {
+        const parsed = new URL(redirectUri);
+        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+            return redirectUri;
+        }
+        if (parsed.pathname === '/' && !parsed.search && !parsed.hash) {
+            return parsed.origin;
+        }
+        return redirectUri;
+    }
+    catch {
+        return redirectUri;
+    }
+}
 /**
  * Is this a safe same-origin path to restore into the address bar?
  *
@@ -244,13 +269,16 @@ function consumeOAuthReturnPath() {
     }
 }
 /** Persist the OAuth handshake for a full-page redirect return (web only). */
-function persistOAuthHandshake(state, codeVerifier) {
+function persistOAuthHandshake(state, codeVerifier, redirectUri) {
     const store = globalThis.sessionStorage;
     try {
         if (!store)
             throw new Error('sessionStorage is unavailable');
         store.setItem(exports.OXY_OAUTH_STATE_STORAGE_KEY, state);
         store.setItem(exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, codeVerifier);
+        if (redirectUri) {
+            store.setItem(exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, canonicalizeOAuthRedirectUri(redirectUri));
+        }
         return true;
     }
     catch (error) {
@@ -267,7 +295,8 @@ function readOAuthHandshake() {
     const codeVerifier = store.getItem(exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY);
     if (!state || !codeVerifier)
         return null;
-    return { state, codeVerifier };
+    const redirectUri = store.getItem(exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY) ?? undefined;
+    return redirectUri ? { state, codeVerifier, redirectUri } : { state, codeVerifier };
 }
 /** Drop persisted OAuth handshake keys after a successful or aborted return. */
 function clearOAuthHandshake() {
@@ -275,6 +304,7 @@ function clearOAuthHandshake() {
     try {
         store?.removeItem(exports.OXY_OAUTH_STATE_STORAGE_KEY);
         store?.removeItem(exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY);
+        store?.removeItem(exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY);
         // The return path belongs to this handshake. Leaving it behind would let a
         // later, unrelated navigation in the same tab be redirected by it.
         store?.removeItem(exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY);