@oxyhq/core 12.11.1 → 13.0.0

package/src/utils/officialOrigins.ts

@@ -1,6 +1,6 @@
 /**
- * Official first-party web origin allowlist — shared by hub-ticket issuance,
- * OAuth redirect validation, and cross-origin session restore.
+ * Official first-party web origin allowlist — shared by OAuth redirect
+ * validation and the server-side trusted-origin checks.
  */
 
 import { CENTRAL_IDP_APEX } from './authWebUrl';
@@ -20,31 +20,9 @@ const OFFICIAL_APEXES = new Set([
   'mercaria.co',
 ]);
 
-export function buildIdpHubOrigin(): string {
-  return `https://auth.${CENTRAL_IDP_APEX}`;
-}
-
-/** Whether the current web origin is the central IdP hub (`auth.oxy.so`). */
-export function isIdpHubOrigin(): boolean {
-  if (typeof globalThis === 'undefined') {
-    return false;
-  }
-  const location = (globalThis as { location?: Location }).location;
-  if (!location) {
-    return false;
-  }
-  try {
-    const { hostname } = new URL(location.href);
-    return hostname === `auth.${CENTRAL_IDP_APEX}`;
-  } catch {
-    return false;
-  }
-}
-
 /**
  * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
- * or `[::1]` on any port, http or https). Local dev must never be bounced to a
- * hosted IdP for cross-origin session restore.
+ * or `[::1]` on any port, http or https).
  */
 export function isLoopbackOrigin(origin: string): boolean {
   try {
@@ -80,50 +58,5 @@ export function isOfficialWebOrigin(origin: string): boolean {
   }
 }
 
-/** Normalize and validate a return URL against official origins. Returns origin only. */
-export function normalizeOfficialReturnOrigin(raw: string): string | null {
-  try {
-    const parsed = new URL(raw);
-    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-      return null;
-    }
-    if (!isOfficialWebOrigin(parsed.origin)) {
-      return null;
-    }
-    return parsed.origin;
-  } catch {
-    return null;
-  }
-}
-
-/** Validate a hub-sync return URL; returns the full normalized URL string. */
-export function parseHubSyncReturnUrl(raw: string | null): string | null {
-  if (!raw) {
-    return null;
-  }
-  try {
-    const parsed = new URL(raw);
-    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-      return null;
-    }
-    if (!isOfficialWebOrigin(parsed.origin)) {
-      return null;
-    }
-    return parsed.toString();
-  } catch {
-    return null;
-  }
-}
-
-/** Build auth.oxy.so/sync redirect URL with a one-time hub ticket. */
-export function buildHubSyncUrl(ticket: string, returnUrl?: string): string {
-  const url = new URL('/sync', buildIdpHubOrigin());
-  url.searchParams.set('ticket', ticket);
-  if (returnUrl) {
-    url.searchParams.set('return', returnUrl);
-  }
-  return url.toString();
-}
-
 /** @deprecated Use {@link isOfficialWebOrigin}. */
 export const isAllowedDeviceJoinOrigin = isOfficialWebOrigin;

package/dist/cjs/session/hubSync.js

@@ -1,55 +0,0 @@
-"use strict";
-/**
- * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
- * one-time server ticket (no secrets in URL fragments).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.syncHubAfterSignIn = syncHubAfterSignIn;
-exports.redeemHubTicketOnHub = redeemHubTicketOnHub;
-const officialOrigins_1 = require("../utils/officialOrigins");
-/**
- * After a successful sign-in on an official web app, mint a hub ticket and
- * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
- * shared device credential for silent OAuth restore on other origins.
- *
- * No-op on native, non-official origins, and when already on the IdP hub.
- */
-async function syncHubAfterSignIn(oxy, opts) {
-    if (opts?.enabled === false) {
-        return false;
-    }
-    if (typeof globalThis === 'undefined') {
-        return false;
-    }
-    const location = globalThis.location;
-    if (!location) {
-        return false;
-    }
-    if ((0, officialOrigins_1.isIdpHubOrigin)()) {
-        return false;
-    }
-    if (!(0, officialOrigins_1.isOfficialWebOrigin)(location.origin)) {
-        return false;
-    }
-    const hubOrigin = (0, officialOrigins_1.buildIdpHubOrigin)();
-    const issued = await oxy.issueHubTicket(hubOrigin);
-    const returnUrl = `${location.origin}${location.pathname}${location.search}${location.hash}`;
-    const syncUrl = (0, officialOrigins_1.buildHubSyncUrl)(issued.ticket, returnUrl);
-    window.location.assign(syncUrl);
-    return true;
-}
-/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
-async function redeemHubTicketOnHub(oxy, store, ticket) {
-    const hubOrigin = (0, officialOrigins_1.buildIdpHubOrigin)();
-    const creds = await oxy.redeemHubTicket(ticket, hubOrigin);
-    const prior = await store.load();
-    await store.save({
-        sessionId: prior?.sessionId ?? '',
-        userId: prior?.userId ?? '',
-        deviceId: creds.deviceId,
-        deviceSecret: creds.deviceSecret,
-        ...(prior?.accessToken ? { accessToken: prior.accessToken } : {}),
-        ...(prior?.expiresAt ? { expiresAt: prior.expiresAt } : {}),
-    });
-    return true;
-}

package/dist/esm/session/hubSync.js

@@ -1,51 +0,0 @@
-/**
- * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
- * one-time server ticket (no secrets in URL fragments).
- */
-import { buildHubSyncUrl, buildIdpHubOrigin, isIdpHubOrigin, isOfficialWebOrigin, } from '../utils/officialOrigins.js';
-/**
- * After a successful sign-in on an official web app, mint a hub ticket and
- * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
- * shared device credential for silent OAuth restore on other origins.
- *
- * No-op on native, non-official origins, and when already on the IdP hub.
- */
-export async function syncHubAfterSignIn(oxy, opts) {
-    if (opts?.enabled === false) {
-        return false;
-    }
-    if (typeof globalThis === 'undefined') {
-        return false;
-    }
-    const location = globalThis.location;
-    if (!location) {
-        return false;
-    }
-    if (isIdpHubOrigin()) {
-        return false;
-    }
-    if (!isOfficialWebOrigin(location.origin)) {
-        return false;
-    }
-    const hubOrigin = buildIdpHubOrigin();
-    const issued = await oxy.issueHubTicket(hubOrigin);
-    const returnUrl = `${location.origin}${location.pathname}${location.search}${location.hash}`;
-    const syncUrl = buildHubSyncUrl(issued.ticket, returnUrl);
-    window.location.assign(syncUrl);
-    return true;
-}
-/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
-export async function redeemHubTicketOnHub(oxy, store, ticket) {
-    const hubOrigin = buildIdpHubOrigin();
-    const creds = await oxy.redeemHubTicket(ticket, hubOrigin);
-    const prior = await store.load();
-    await store.save({
-        sessionId: prior?.sessionId ?? '',
-        userId: prior?.userId ?? '',
-        deviceId: creds.deviceId,
-        deviceSecret: creds.deviceSecret,
-        ...(prior?.accessToken ? { accessToken: prior.accessToken } : {}),
-        ...(prior?.expiresAt ? { expiresAt: prior.expiresAt } : {}),
-    });
-    return true;
-}

package/dist/types/session/hubSync.d.ts

@@ -1,20 +0,0 @@
-/**
- * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
- * one-time server ticket (no secrets in URL fragments).
- */
-import type { OxyServices } from '../OxyServices';
-import type { AuthStateStore } from './authStateStore';
-export interface SyncHubAfterSignInOptions {
-    /** Skip sync when false (OxyProvider hubSync prop). @default true */
-    enabled?: boolean;
-}
-/**
- * After a successful sign-in on an official web app, mint a hub ticket and
- * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
- * shared device credential for silent OAuth restore on other origins.
- *
- * No-op on native, non-official origins, and when already on the IdP hub.
- */
-export declare function syncHubAfterSignIn(oxy: Pick<OxyServices, 'issueHubTicket'>, opts?: SyncHubAfterSignInOptions): Promise<boolean>;
-/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
-export declare function redeemHubTicketOnHub(oxy: Pick<OxyServices, 'redeemHubTicket'>, store: AuthStateStore, ticket: string): Promise<boolean>;

package/src/session/__tests__/hubSync.test.ts

@@ -1,51 +0,0 @@
-import { syncHubAfterSignIn } from '../hubSync';
-
-jest.mock('../../utils/officialOrigins', () => {
-  const actual = jest.requireActual('../../utils/officialOrigins');
-  return {
-    ...actual,
-    isIdpHubOrigin: jest.fn(() => false),
-    isOfficialWebOrigin: jest.fn(() => true),
-    buildIdpHubOrigin: jest.fn(() => 'https://auth.oxy.so'),
-  };
-});
-
-describe('syncHubAfterSignIn', () => {
-  const originalLocation = globalThis.location;
-  const originalAssign = (globalThis as { location?: Location }).location?.assign;
-
-  afterEach(() => {
-    Object.defineProperty(globalThis, 'location', {
-      configurable: true,
-      value: originalLocation,
-    });
-    jest.restoreAllMocks();
-  });
-
-  it('includes the hash fragment in the hub-sync return URL', async () => {
-    const assign = jest.fn();
-    Object.defineProperty(globalThis, 'location', {
-      configurable: true,
-      value: {
-        origin: 'https://oxy.so',
-        pathname: '/pricing',
-        search: '?plan=pro',
-        hash: '#compare',
-        assign,
-      },
-    });
-    Object.defineProperty(globalThis, 'window', {
-      configurable: true,
-      value: { location: globalThis.location },
-    });
-
-    const issueHubTicket = jest.fn().mockResolvedValue({ ticket: 'tk-1' });
-
-    const redirected = await syncHubAfterSignIn({ issueHubTicket });
-
-    expect(redirected).toBe(true);
-    expect(issueHubTicket).toHaveBeenCalledWith('https://auth.oxy.so');
-    const syncUrl = new URL(String(assign.mock.calls[0]?.[0] ?? ''));
-    expect(syncUrl.searchParams.get('return')).toBe('https://oxy.so/pricing?plan=pro#compare');
-  });
-});

package/src/session/hubSync.ts

@@ -1,79 +0,0 @@
-/**
- * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
- * one-time server ticket (no secrets in URL fragments).
- */
-
-import type { OxyServices } from '../OxyServices';
-import type { AuthStateStore } from './authStateStore';
-import {
-  buildHubSyncUrl,
-  buildIdpHubOrigin,
-  isIdpHubOrigin,
-  isOfficialWebOrigin,
-} from '../utils/officialOrigins';
-
-export interface SyncHubAfterSignInOptions {
-  /** Skip sync when false (OxyProvider hubSync prop). @default true */
-  enabled?: boolean;
-}
-
-/**
- * After a successful sign-in on an official web app, mint a hub ticket and
- * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
- * shared device credential for silent OAuth restore on other origins.
- *
- * No-op on native, non-official origins, and when already on the IdP hub.
- */
-export async function syncHubAfterSignIn(
-  oxy: Pick<OxyServices, 'issueHubTicket'>,
-  opts?: SyncHubAfterSignInOptions,
-): Promise<boolean> {
-  if (opts?.enabled === false) {
-    return false;
-  }
-
-  if (typeof globalThis === 'undefined') {
-    return false;
-  }
-
-  const location = (globalThis as { location?: Location }).location;
-  if (!location) {
-    return false;
-  }
-
-  if (isIdpHubOrigin()) {
-    return false;
-  }
-
-  if (!isOfficialWebOrigin(location.origin)) {
-    return false;
-  }
-
-  const hubOrigin = buildIdpHubOrigin();
-  const issued = await oxy.issueHubTicket(hubOrigin);
-  const returnUrl = `${location.origin}${location.pathname}${location.search}${location.hash}`;
-  const syncUrl = buildHubSyncUrl(issued.ticket, returnUrl);
-
-  window.location.assign(syncUrl);
-  return true;
-}
-
-/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
-export async function redeemHubTicketOnHub(
-  oxy: Pick<OxyServices, 'redeemHubTicket'>,
-  store: AuthStateStore,
-  ticket: string,
-): Promise<boolean> {
-  const hubOrigin = buildIdpHubOrigin();
-  const creds = await oxy.redeemHubTicket(ticket, hubOrigin);
-  const prior = await store.load();
-  await store.save({
-    sessionId: prior?.sessionId ?? '',
-    userId: prior?.userId ?? '',
-    deviceId: creds.deviceId,
-    deviceSecret: creds.deviceSecret,
-    ...(prior?.accessToken ? { accessToken: prior.accessToken } : {}),
-    ...(prior?.expiresAt ? { expiresAt: prior.expiresAt } : {}),
-  });
-  return true;
-}