@oxyhq/core 12.11.0 → 13.0.0

package/dist/esm/HttpService.js

@@ -53,11 +53,30 @@ const CSRF_FETCH_MAX_ATTEMPTS = 2;
 const CSRF_FETCH_RETRY_DELAY_MS = 500;
 /**
  * Cooldown (ms) applied after a failed access-token refresh before another
- * refresh is attempted. Prevents a refresh storm (and server hammering) when
+ * refresh is attempted while the CURRENT token is still valid (a proactive,
+ * near-expiry refresh). Prevents a refresh storm (and server hammering) when
  * the auth refresh handler is failing — every in-flight request that
- * hits a 401 would otherwise trigger its own refresh.
+ * hits a 401 would otherwise trigger its own refresh. A still-valid token can
+ * afford to wait this out; the request keeps carrying it in the meantime.
  */
 const TOKEN_REFRESH_COOLDOWN_MS = 15000;
+/**
+ * Cooldown (ms) applied after a failed refresh when the CURRENT access token is
+ * already past its `exp`. Much shorter than {@link TOKEN_REFRESH_COOLDOWN_MS}:
+ * an expired token is UNUSABLE, so the client must re-mint as soon as the mint
+ * endpoint is reachable again (e.g. a few seconds after an ECS rolling-deploy
+ * blip drains/restarts a task) instead of waiting out the full proactive
+ * cooldown while every request forwards or omits a stale bearer → server 401.
+ *
+ * Still NON-ZERO on purpose: it bounds the request-driven retry rate to at most
+ * one attempt per this interval so a PROLONGED outage cannot become a tight
+ * network storm. Combined with the process-wide single-flight below (concurrent
+ * requests coalesce to one in-flight mint) and the refresh handler's own
+ * terminal-state handling (a genuinely revoked session clears its device
+ * credential and stops issuing network mints), this recovers a transient blip
+ * ~15× faster without weakening the storm guard.
+ */
+const EXPIRED_TOKEN_REFRESH_COOLDOWN_MS = 1000;
 /**
  * Lead time (seconds) before access-token expiry at which a preflight refresh
  * is triggered. A token within this window of `exp` is treated as effectively
@@ -130,7 +149,15 @@ class TokenStore {
 export class HttpService {
     constructor(config) {
         this.tokenRefreshPromise = null;
-        this.tokenRefreshCooldownUntil = 0;
+        /**
+         * Epoch ms of the last FAILED refresh (0 = none since the last success). The
+         * post-failure cooldown is measured from here; its length depends on whether
+         * the current token is still valid ({@link TOKEN_REFRESH_COOLDOWN_MS}) or
+         * already expired ({@link EXPIRED_TOKEN_REFRESH_COOLDOWN_MS}), so an expired
+         * token recovers promptly the instant it crosses `exp` — without storing a
+         * fixed deadline that could not shrink once the token expired mid-cooldown.
+         */
+        this.lastRefreshFailureAt = 0;
         this.authRefreshHandler = null;
         this.accessTokenProvider = null;
         this.deviceSecretMintInFlight = null;
@@ -820,26 +847,38 @@ export class HttpService {
         if (!this.authRefreshHandler) {
             return null;
         }
-        if (Date.now() < this.tokenRefreshCooldownUntil) {
+        // Post-failure cooldown. A genuinely EXPIRED current token uses a much
+        // shorter cooldown than a still-valid (proactive, near-expiry) one: an
+        // expired token is unusable, so re-mint as soon as the endpoint is reachable
+        // again rather than waiting out the full window while requests carry a stale
+        // bearer. Both cooldowns are measured from the last failure, so the moment a
+        // still-valid token crosses `exp` mid-cooldown the shorter window applies.
+        const cooldownMs = this.isAccessTokenExpired()
+            ? EXPIRED_TOKEN_REFRESH_COOLDOWN_MS
+            : TOKEN_REFRESH_COOLDOWN_MS;
+        if (Date.now() - this.lastRefreshFailureAt < cooldownMs) {
             return null;
         }
         if (!this.tokenRefreshPromise) {
             this.tokenRefreshPromise = this.authRefreshHandler(reason)
                 .then((newToken) => {
                 if (!newToken) {
-                    this.tokenRefreshCooldownUntil = Date.now() + TOKEN_REFRESH_COOLDOWN_MS;
+                    this.lastRefreshFailureAt = Date.now();
                     return null;
                 }
                 if (this.tokenStore.getAccessToken() !== newToken) {
                     this.tokenStore.setTokens(newToken);
                     this.notifyTokenChange();
                 }
+                // A success clears the failure timestamp so the next refresh is never
+                // throttled by a stale cooldown.
+                this.lastRefreshFailureAt = 0;
                 this.logger.debug('Token refreshed via the auth refresh handler');
                 return newToken;
             })
                 .catch((error) => {
                 this.logger.warn('Token refresh failed:', error);
-                this.tokenRefreshCooldownUntil = Date.now() + TOKEN_REFRESH_COOLDOWN_MS;
+                this.lastRefreshFailureAt = Date.now();
                 return null;
             })
                 .finally(() => {
@@ -848,6 +887,27 @@ export class HttpService {
         }
         return this.tokenRefreshPromise;
     }
+    /**
+     * Whether the CURRENT stored access token is already past its `exp`. Drives
+     * the shorter post-failure refresh cooldown ({@link EXPIRED_TOKEN_REFRESH_COOLDOWN_MS}):
+     * a still-valid (near-expiry) token can wait out the full cooldown, but an
+     * expired one must re-mint promptly. Returns `false` for an absent or
+     * opaque/no-`exp` token — no proof it is expired, so keep the conservative
+     * (longer) cooldown and avoid an unnecessary retry loop.
+     */
+    isAccessTokenExpired() {
+        const token = this.tokenStore.getAccessToken();
+        if (!token) {
+            return false;
+        }
+        try {
+            const decoded = jwtDecode(token);
+            return typeof decoded.exp === 'number' && decoded.exp <= Math.floor(Date.now() / 1000);
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * PROCESS-WIDE single-flight for the rotating device-secret mint
      * (`POST /session/device/token`).

package/dist/esm/index.js

@@ -148,9 +148,8 @@ export { runColdBoot } from './utils/coldBoot.js';
 // OAuth 2.0 Authorization Code + PKCE helpers ("Sign in with Oxy" third party).
 // Standard OAuth against auth.oxy.so/authorize — no FedCM/cookies/SSO bounce.
 // ---------------------------------------------------------------------------
-export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY, OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, canonicalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce.js';
-export { buildIdpHubOrigin, buildHubSyncUrl, isIdpHubOrigin, isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, normalizeOfficialReturnOrigin, parseHubSyncReturnUrl, } from './utils/officialOrigins.js';
-export { syncHubAfterSignIn, redeemHubTicketOnHub, } from './session/hubSync.js';
+export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, canonicalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce.js';
+export { isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, } from './utils/officialOrigins.js';
 // ---------------------------------------------------------------------------
 // Session sync (device-scoped multi-account session client)
 // ---------------------------------------------------------------------------

package/dist/esm/mixins/OxyServices.deviceBoot.js

@@ -13,7 +13,7 @@
  * the cold boot / re-mint handler own persistence and `setTokens`, so the same
  * primitive can be reused from either without double-planting.
  */
-import { deviceTokenMintResponseSchema, deviceHubTicketIssueResponseSchema, deviceHubTicketRedeemResponseSchema, safeParseContract, } from '@oxyhq/contracts';
+import { deviceTokenMintResponseSchema, safeParseContract, } from '@oxyhq/contracts';
 /**
  * The server's `401 account_not_on_device` for a PINNED mint: the requested
  * `accountId` is not (or is no longer) a live account of this device session.
@@ -105,36 +105,5 @@ export function OxyServicesDeviceBootMixin(Base) {
                 throw normalized;
             }
         }
-        /** Mint a one-time hub sync ticket (bearer required). */
-        async issueHubTicket(returnOrigin) {
-            try {
-                const res = await this.makeRequest('POST', '/session/device/hub-ticket', { returnOrigin }, { cache: false });
-                const parsed = safeParseContract(deviceHubTicketIssueResponseSchema, res);
-                if (!parsed) {
-                    throw new Error('session/device/hub-ticket returned an unexpected response shape');
-                }
-                return parsed;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /** Redeem a hub sync ticket for a fresh device secret (public). */
-        async redeemHubTicket(ticket, returnOrigin) {
-            try {
-                const res = await this.makeRequest('POST', '/session/device/redeem-ticket', { ticket, returnOrigin }, 
-                // Public device-hub sync mint (bearer-less). Same control-plane class as
-                // the device-secret mint — bypassQueue so it never waits for a slot.
-                { cache: false, skipAuth: true, bypassQueue: true });
-                const parsed = safeParseContract(deviceHubTicketRedeemResponseSchema, res);
-                if (!parsed) {
-                    throw new Error('session/device/redeem-ticket returned an unexpected response shape');
-                }
-                return parsed;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
     };
 }

package/dist/esm/mixins/OxyServices.privacy.js

@@ -149,6 +149,9 @@ export function OxyServicesPrivacyMixin(Base) {
                     cache: false,
                 });
                 this.clearCacheEntry('GET:/privacy/restricted');
+                // The restriction changed the viewer's graph (`restrictedIds`) — bust the
+                // cached consolidated `GET /users/me/graph` so the next read reflects it.
+                this.clearCacheEntry('GET:/users/me/graph');
                 return result;
             }
             catch (error) {
@@ -172,6 +175,9 @@ export function OxyServicesPrivacyMixin(Base) {
                     cache: false,
                 });
                 this.clearCacheEntry('GET:/privacy/restricted');
+                // Symmetric to restrictUser: the unrestrict changed the viewer's
+                // `restrictedIds`, so bust the consolidated `GET /users/me/graph` cache.
+                this.clearCacheEntry('GET:/users/me/graph');
                 return result;
             }
             catch (error) {

package/dist/esm/mixins/OxyServices.user.js

@@ -818,6 +818,7 @@ export function OxyServicesUserMixin(Base) {
                     followingIds: graph?.followingIds || [],
                     mutualIds: graph?.mutualIds || [],
                     blockedIds: graph?.blockedIds || [],
+                    restrictedIds: graph?.restrictedIds || [],
                 };
             }
             catch (error) {

package/dist/esm/server/index.js

@@ -27,4 +27,4 @@ export { verifySecret } from './verifySecret.js';
 // Pure host handling (no browser deps), so it is safe on the server subpath and
 // lets `@oxyhq/api` derive `auth.<apex>` without duplicating PSL logic.
 export { registrableApex } from '../utils/registrableApex.js';
-export { buildIdpHubOrigin, buildHubSyncUrl, isIdpHubOrigin, isOfficialWebOrigin, normalizeOfficialReturnOrigin, parseHubSyncReturnUrl, } from '../utils/officialOrigins.js';
+export { isOfficialWebOrigin } from '../utils/officialOrigins.js';

package/dist/esm/server/rateLimit.js

@@ -168,6 +168,9 @@ export function createOxyRateLimit(oxy, options = {}) {
         standardHeaders: true,
         legacyHeaders: false,
         skip,
+        // hashAnonymousIp already buckets IPv6 to /56 before HMAC; disable the v8
+        // static source scan that false-positives on req.ip (ERR_ERL_KEY_GEN_IPV6).
+        validate: { keyGeneratorIpFallback: false },
     });
     return (req, res, next) => {
         // Skipped paths bypass BOTH session resolution and limiting — cheap and

package/dist/esm/session/accountDialogController.js

@@ -477,9 +477,9 @@ export class AccountDialogController {
                     user: result.user,
                     accessToken: result.accessToken,
                 }, result.user, 
-                // A switch is IN-PLACE: commit without the hub-sync redirect (the
-                // device is already known/synced). Cross-tab/app propagation rides the
-                // server's `session_state` socket broadcast, not a navigation.
+                // A switch is IN-PLACE: use the switch commit funnel (not sign-in).
+                // Cross-tab/app propagation rides the server's `session_state` socket
+                // broadcast, not a navigation.
                 { fromSwitch: true });
             }
             // Re-project + refetch immediately; the subscription also fires.
@@ -982,11 +982,9 @@ export class AccountDialogController {
      * consumer's commit funnel (durable persist + hydration); falls back to
      * `SessionClient.registerAndActivate` (registration + activation only).
      *
-     * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel
-     * so it never runs the cross-origin hub-sync redirect; a SIGN-IN uses
-     * `commitSession` (which may hub-sync on an official web origin). When the
-     * switch funnel is not wired it falls back to the sign-in funnel, then to
-     * `registerAndActivate`.
+     * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel;
+     * a SIGN-IN uses `commitSession`. When the switch funnel is not wired it falls
+     * back to the sign-in funnel, then to `registerAndActivate`.
      */
     async commitAuthorizedSession(session, user, opts) {
         const commit = opts?.fromSwitch

package/dist/esm/utils/oauthPkce.js

@@ -145,10 +145,6 @@ export const OXY_OAUTH_STATE_STORAGE_KEY = 'oxy_oauth_state';
 export const OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = 'oxy_oauth_code_verifier';
 /** `sessionStorage` key — the exact `redirect_uri` sent on the authorize request. */
 export const OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = 'oxy.oauth_redirect_uri';
-/** `sessionStorage` key — at most one silent OAuth attempt per navigation. */
-export const OXY_SILENT_OAUTH_ATTEMPTED_KEY = 'oxy.silent_oauth_attempted';
-/** `sessionStorage` key — blocks further cross-origin auto-restore in this tab. */
-export const OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = 'oxy.cross_origin_restore_attempted';
 /**
  * `sessionStorage` key for the in-app path to return to after an authorize
  * round trip. See {@link persistOAuthReturnPath}.

package/dist/esm/utils/officialOrigins.js

@@ -1,6 +1,6 @@
 /**
- * Official first-party web origin allowlist — shared by hub-ticket issuance,
- * OAuth redirect validation, and cross-origin session restore.
+ * Official first-party web origin allowlist — shared by OAuth redirect
+ * validation and the server-side trusted-origin checks.
  */
 import { CENTRAL_IDP_APEX } from './authWebUrl.js';
 import { registrableApex } from './registrableApex.js';
@@ -17,30 +17,9 @@ const OFFICIAL_APEXES = new Set([
     'moovo.now',
     'mercaria.co',
 ]);
-export function buildIdpHubOrigin() {
-    return `https://auth.${CENTRAL_IDP_APEX}`;
-}
-/** Whether the current web origin is the central IdP hub (`auth.oxy.so`). */
-export function isIdpHubOrigin() {
-    if (typeof globalThis === 'undefined') {
-        return false;
-    }
-    const location = globalThis.location;
-    if (!location) {
-        return false;
-    }
-    try {
-        const { hostname } = new URL(location.href);
-        return hostname === `auth.${CENTRAL_IDP_APEX}`;
-    }
-    catch {
-        return false;
-    }
-}
 /**
  * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
- * or `[::1]` on any port, http or https). Local dev must never be bounced to a
- * hosted IdP for cross-origin session restore.
+ * or `[::1]` on any port, http or https).
  */
 export function isLoopbackOrigin(origin) {
     try {
@@ -76,49 +55,5 @@ export function isOfficialWebOrigin(origin) {
         return false;
     }
 }
-/** Normalize and validate a return URL against official origins. Returns origin only. */
-export function normalizeOfficialReturnOrigin(raw) {
-    try {
-        const parsed = new URL(raw);
-        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-            return null;
-        }
-        if (!isOfficialWebOrigin(parsed.origin)) {
-            return null;
-        }
-        return parsed.origin;
-    }
-    catch {
-        return null;
-    }
-}
-/** Validate a hub-sync return URL; returns the full normalized URL string. */
-export function parseHubSyncReturnUrl(raw) {
-    if (!raw) {
-        return null;
-    }
-    try {
-        const parsed = new URL(raw);
-        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-            return null;
-        }
-        if (!isOfficialWebOrigin(parsed.origin)) {
-            return null;
-        }
-        return parsed.toString();
-    }
-    catch {
-        return null;
-    }
-}
-/** Build auth.oxy.so/sync redirect URL with a one-time hub ticket. */
-export function buildHubSyncUrl(ticket, returnUrl) {
-    const url = new URL('/sync', buildIdpHubOrigin());
-    url.searchParams.set('ticket', ticket);
-    if (returnUrl) {
-        url.searchParams.set('return', returnUrl);
-    }
-    return url.toString();
-}
 /** @deprecated Use {@link isOfficialWebOrigin}. */
 export const isAllowedDeviceJoinOrigin = isOfficialWebOrigin;