@oxyhq/core 12.11.1 → 13.2.0

package/src/mixins/OxyServices.deviceBoot.ts

@@ -15,12 +15,8 @@
  */
 import {
   deviceTokenMintResponseSchema,
-  deviceHubTicketIssueResponseSchema,
-  deviceHubTicketRedeemResponseSchema,
   safeParseContract,
   type DeviceTokenMintResponse,
-  type DeviceHubTicketIssueResponse,
-  type DeviceHubTicketRedeemResponse,
 } from '@oxyhq/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
 
@@ -124,48 +120,5 @@ export function OxyServicesDeviceBootMixin<T extends typeof OxyServicesBase>(Bas
         throw normalized;
       }
     }
-
-    /** Mint a one-time hub sync ticket (bearer required). */
-    async issueHubTicket(returnOrigin: string): Promise<DeviceHubTicketIssueResponse> {
-      try {
-        const res = await this.makeRequest<unknown>(
-          'POST',
-          '/session/device/hub-ticket',
-          { returnOrigin },
-          { cache: false },
-        );
-        const parsed = safeParseContract(deviceHubTicketIssueResponseSchema, res);
-        if (!parsed) {
-          throw new Error('session/device/hub-ticket returned an unexpected response shape');
-        }
-        return parsed;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /** Redeem a hub sync ticket for a fresh device secret (public). */
-    async redeemHubTicket(
-      ticket: string,
-      returnOrigin: string,
-    ): Promise<DeviceHubTicketRedeemResponse> {
-      try {
-        const res = await this.makeRequest<unknown>(
-          'POST',
-          '/session/device/redeem-ticket',
-          { ticket, returnOrigin },
-          // Public device-hub sync mint (bearer-less). Same control-plane class as
-          // the device-secret mint — bypassQueue so it never waits for a slot.
-          { cache: false, skipAuth: true, bypassQueue: true },
-        );
-        const parsed = safeParseContract(deviceHubTicketRedeemResponseSchema, res);
-        if (!parsed) {
-          throw new Error('session/device/redeem-ticket returned an unexpected response shape');
-        }
-        return parsed;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
   };
 }

package/src/mixins/OxyServices.user.ts

@@ -19,7 +19,12 @@ import type {
 } from '@oxyhq/contracts';
 import { recommendationRequestSchema } from '@oxyhq/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
-import { buildSearchParams, buildPaginationParams, type PaginationParams } from '../utils/apiUtils';
+import {
+  buildQueryParams,
+  buildPaginationParams,
+  type PaginationParams,
+  type FollowGraphParams,
+} from '../utils/apiUtils';
 import { KeyManager } from '../crypto/keyManager';
 import { SignatureService } from '../crypto/signatureService';
 import { normalizeUserIdentity, normalizeUserIdentityOrNull } from '../utils/userIdentity';
@@ -198,14 +203,10 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
      */
     async searchProfiles(query: string, pagination?: PaginationParams): Promise<SearchProfilesResponse> {
       try {
-        const params = { query, ...pagination };
-        const searchParams = buildSearchParams(params);
-        const paramsObj = Object.fromEntries(searchParams.entries());
-
         const response = await this.makeRequest<SearchProfilesResponse>(
           'GET',
           '/profiles/search',
-          paramsObj,
+          buildQueryParams({ query, ...pagination }),
           {
             cache: true,
             cacheTTL: 2 * 60 * 1000, // 2 minutes cache
@@ -727,6 +728,42 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
     }
 
 
+    /**
+     * Invalidate every cached read a follow/unfollow write invalidates.
+     *
+     * Shared by the four mutation entry points (`followUser`, `unfollowUser`,
+     * `followUsers`, `unfollowUsers`) so they can never drift on which caches a
+     * write busts.
+     *
+     * The follower/following/mutuals LISTS are cleared by PREFIX rather than by
+     * exact key. Those reads are paginated and ordered, so one logical list is
+     * spread across many content-addressed keys
+     * (`GET:/users/<id>/followers:{"limit":"20","offset":"40","sort":"oldest"}`);
+     * an exact-key clear would only bust whichever page/sort variant happened to
+     * be read last and would leave every other page stale. `clearCacheByPrefix`
+     * deletes all of them, and all identity-scoped variants of each.
+     */
+    invalidateFollowGraphCaches(targetUserIds: string[]): void {
+      for (const id of targetUserIds) {
+        this.clearCacheEntry(`GET:/users/${id}/follow-status`);
+        // Profile fetches embed viewer-relative `relationship` — bust so a
+        // remount doesn't serve a stale isFollowing for up to 5 minutes.
+        this.clearCacheEntry(`GET:/users/${id}`);
+        // The target gained/lost a follower, and the viewer's presence in the
+        // target's "followers you know" set changed with it.
+        this.clearCacheByPrefix(`GET:/users/${id}/followers`);
+        this.clearCacheByPrefix(`GET:/users/${id}/mutuals`);
+      }
+      this.clearCacheByPrefix('GET:/profiles/username/');
+      this.clearCacheByPrefix('GET:/profiles/resolve');
+      // The write changed the viewer's OWN following list and graph.
+      const viewerId = this.getCurrentUserId();
+      if (viewerId) {
+        this.clearCacheByPrefix(`GET:/users/${viewerId}/following`);
+      }
+      this.clearCacheEntry('GET:/users/me/graph');
+    }
+
     /**
      * Follow a user.
      *
@@ -740,16 +777,7 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
     async followUser(userId: string): Promise<FollowMutationResult> {
       try {
         const result = await this.makeRequest<FollowMutationResult>('POST', `/users/${userId}/follow`, undefined, { cache: false });
-        this.clearCacheEntry(`GET:/users/${userId}/follow-status`);
-        // Profile fetches embed viewer-relative `relationship` — bust so a
-        // remount doesn't serve a stale isFollowing for up to 5 minutes.
-        this.clearCacheEntry(`GET:/users/${userId}`);
-        this.clearCacheByPrefix('GET:/profiles/username/');
-        this.clearCacheByPrefix('GET:/profiles/resolve');
-        // The follow changed the viewer's graph — bust the cached consolidated
-        // `GET /users/me/graph` so the next read reflects the new following/
-        // mutual set instead of the stale pre-write snapshot.
-        this.clearCacheEntry('GET:/users/me/graph');
+        this.invalidateFollowGraphCaches([userId]);
         return result;
       } catch (error) {
         throw this.handleError(error);
@@ -770,15 +798,7 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
       }
       try {
         const result = await this.makeRequest<BulkFollowResult>('POST', '/users/follow/bulk', { userIds }, { cache: false });
-        // Bust each affected user's cached follow-status (see `followUser`).
-        for (const id of userIds) {
-          this.clearCacheEntry(`GET:/users/${id}/follow-status`);
-          this.clearCacheEntry(`GET:/users/${id}`);
-        }
-        this.clearCacheByPrefix('GET:/profiles/username/');
-        this.clearCacheByPrefix('GET:/profiles/resolve');
-        // The batch changed the viewer's graph — bust the consolidated cache.
-        this.clearCacheEntry('GET:/users/me/graph');
+        this.invalidateFollowGraphCaches(userIds);
         return result;
       } catch (error) {
         throw this.handleError(error);
@@ -799,15 +819,7 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
       }
       try {
         const result = await this.makeRequest<BulkUnfollowResult>('POST', '/users/unfollow/bulk', { userIds }, { cache: false });
-        // Bust each affected user's cached follow-status (see `followUser`).
-        for (const id of userIds) {
-          this.clearCacheEntry(`GET:/users/${id}/follow-status`);
-          this.clearCacheEntry(`GET:/users/${id}`);
-        }
-        this.clearCacheByPrefix('GET:/profiles/username/');
-        this.clearCacheByPrefix('GET:/profiles/resolve');
-        // The batch changed the viewer's graph — bust the consolidated cache.
-        this.clearCacheEntry('GET:/users/me/graph');
+        this.invalidateFollowGraphCaches(userIds);
         return result;
       } catch (error) {
         throw this.handleError(error);
@@ -820,13 +832,7 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
     async unfollowUser(userId: string): Promise<FollowMutationResult> {
       try {
         const result = await this.makeRequest<FollowMutationResult>('DELETE', `/users/${userId}/follow`, undefined, { cache: false });
-        // Bust the cached follow-status so a remount reads fresh truth (see `followUser`).
-        this.clearCacheEntry(`GET:/users/${userId}/follow-status`);
-        this.clearCacheEntry(`GET:/users/${userId}`);
-        this.clearCacheByPrefix('GET:/profiles/username/');
-        this.clearCacheByPrefix('GET:/profiles/resolve');
-        // The unfollow changed the viewer's graph — bust the consolidated cache.
-        this.clearCacheEntry('GET:/users/me/graph');
+        this.invalidateFollowGraphCaches([userId]);
         return result;
       } catch (error) {
         throw this.handleError(error);
@@ -899,14 +905,19 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
     }
 
     /**
-     * Get user followers
+     * Get user followers.
+     *
+     * `sort` orders the underlying follow edges — `recent` (newest first, the
+     * server default) or `oldest`. Because the response is cached and the cache
+     * key is content-addressed on the query params, each `limit`/`offset`/`sort`
+     * combination is its own entry.
      */
     async getUserFollowers(
       userId: string,
-      pagination?: PaginationParams
+      pagination?: FollowGraphParams
     ): Promise<{ followers: User[]; total: number; hasMore: boolean }> {
       try {
-        const params = buildPaginationParams(pagination || {});
+        const params = buildQueryParams(pagination || {});
         const response = await this.makeRequest<{ data: User[]; pagination: { total: number; hasMore: boolean } }>('GET', `/users/${userId}/followers`, params, {
           cache: true,
           cacheTTL: 2 * 60 * 1000, // 2 minutes cache
@@ -922,14 +933,14 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
     }
 
     /**
-     * Get user following
+     * Get user following. `sort` behaves as in {@link getUserFollowers}.
      */
     async getUserFollowing(
       userId: string,
-      pagination?: PaginationParams
+      pagination?: FollowGraphParams
     ): Promise<{ following: User[]; total: number; hasMore: boolean }> {
       try {
-        const params = buildPaginationParams(pagination || {});
+        const params = buildQueryParams(pagination || {});
         const response = await this.makeRequest<{ data: User[]; pagination: { total: number; hasMore: boolean } }>('GET', `/users/${userId}/following`, params, {
           cache: true,
           cacheTTL: 2 * 60 * 1000, // 2 minutes cache
@@ -950,10 +961,10 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
      */
     async getUserMutuals(
       userId: string,
-      pagination?: PaginationParams
+      pagination?: FollowGraphParams
     ): Promise<{ mutuals: User[]; total: number; hasMore: boolean }> {
       try {
-        const params = buildPaginationParams(pagination || {});
+        const params = buildQueryParams(pagination || {});
         const response = await this.makeRequest<{ data: User[]; pagination: { total: number; hasMore: boolean } }>('GET', `/users/${userId}/mutuals`, params, {
           cache: true,
           cacheTTL: 2 * 60 * 1000, // 2 minutes cache

package/src/mixins/__tests__/commonsSignIn.test.ts

@@ -12,6 +12,8 @@
  * degrade-to-QR behaviour every ambiguous input must produce.
  */
 
+import type { CommonsDenyReason } from '@oxyhq/contracts';
+import { COMMONS_DENY_REASONS } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../../models/session';
 import type { ChallengeResponse } from '../OxyServices.auth';
 import type { CommonsDeliveryPlatform } from '../../utils/commonsDelivery';
@@ -769,12 +771,17 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
       );
     });
 
-    it.each([['declined'], ['not_me']] as const)(
+    // Iterating the CONTRACT set (rather than a local literal) is the point: the
+    // SDK, the API request schema and the persisted `AuthSession.deniedReason`
+    // enum all read this one declaration, so a value added on the server side
+    // without an SDK release — or the reverse — cannot go unnoticed here.
+    it.each([...COMMONS_DENY_REASONS])(
       'sends the closed-set reason %s in the body',
       async (reason) => {
         makeRequestSpy.mockResolvedValue({ success: true });
 
-        await oxy.denyCommonsSignIn('code-1', reason);
+        const typedReason: CommonsDenyReason = reason;
+        await oxy.denyCommonsSignIn('code-1', typedReason);
 
         expect(makeRequestSpy).toHaveBeenCalledWith(
           'POST',

package/src/mixins/__tests__/followGraphPagination.test.ts

@@ -0,0 +1,250 @@
+/**
+ * Follow-graph pagination + ordering tests.
+ *
+ * Regression coverage for the silent "every page is page one" bug.
+ * `buildPaginationParams` used to return a `URLSearchParams`, which it then
+ * handed to `makeRequest` as a GET's `params`. `HttpService` reads that object
+ * with `Object.keys(...)` in TWO places — `buildURL` (decide whether to append
+ * a query string) and `generateBaseCacheKey` (build the cache key) — and
+ * `Object.keys(new URLSearchParams({ limit: '20' }))` is `[]`, because a
+ * `URLSearchParams` exposes its entries through iterator methods rather than
+ * own enumerable properties. The consequences were both invisible from the
+ * call site:
+ *
+ *  - no query string was ever sent, so every caller silently got the server's
+ *    DEFAULT page no matter which `limit`/`offset` it asked for, and
+ *  - every page collapsed onto ONE cache key, so page 2 was served page 1's
+ *    cached body without a network call.
+ *
+ * These tests assert on the URL `fetch` actually received (not on the helper's
+ * return value), so they fail against the old `URLSearchParams` implementation
+ * and cannot pass vacuously.
+ */
+
+import { OxyServices } from '../../OxyServices';
+
+/**
+ * Build a non-verified JWT whose payload decodes to the given claims.
+ * `jwtDecode` only base64url-decodes the middle segment (no signature check).
+ */
+function makeJwt(payload: Record<string, unknown>): string {
+  const b64url = (obj: Record<string, unknown>): string =>
+    Buffer.from(JSON.stringify(obj)).toString('base64url');
+  const fullPayload = { exp: Math.floor(Date.now() / 1000) + 3600, ...payload };
+  return `${b64url({ alg: 'none', typ: 'JWT' })}.${b64url(fullPayload)}.sig`;
+}
+
+/** A paginated `{ data, pagination }` body — passed through by `unwrapResponse`. */
+function pageResponse(data: unknown[], total = 100, hasMore = true): Response {
+  return new Response(JSON.stringify({ data, pagination: { total, hasMore } }), {
+    status: 200,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+/** A JSON `{ data: ... }` success envelope. */
+function jsonResponse(data: unknown): Response {
+  return new Response(JSON.stringify({ data }), {
+    status: 200,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+describe('follow-graph pagination and ordering', () => {
+  let originalFetch: typeof globalThis.fetch;
+  let fetchMock: jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
+  let oxy: OxyServices;
+
+  /** The URL string passed to `fetch` on call `n` (0-based). */
+  const requestedUrl = (n: number): string => String(fetchMock.mock.calls[n][0]);
+
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+    fetchMock = jest.fn();
+    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    oxy.httpService.setTokens(makeJwt({ userId: 'me' }));
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    jest.clearAllMocks();
+  });
+
+  describe('the request actually carries the pagination the caller asked for', () => {
+    it('sends limit and offset on getUserFollowers', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserFollowers('target-1', { limit: 20, offset: 40 });
+
+      const url = new URL(requestedUrl(0));
+      expect(url.pathname).toBe('/users/target-1/followers');
+      expect(url.searchParams.get('limit')).toBe('20');
+      expect(url.searchParams.get('offset')).toBe('40');
+    });
+
+    it('sends limit and offset on getUserFollowing', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserFollowing('target-1', { limit: 5, offset: 10 });
+
+      const url = new URL(requestedUrl(0));
+      expect(url.pathname).toBe('/users/target-1/following');
+      expect(url.searchParams.get('limit')).toBe('5');
+      expect(url.searchParams.get('offset')).toBe('10');
+    });
+
+    it('sends limit and offset on getUserMutuals', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserMutuals('target-1', { limit: 7, offset: 14 });
+
+      const url = new URL(requestedUrl(0));
+      expect(url.pathname).toBe('/users/target-1/mutuals');
+      expect(url.searchParams.get('limit')).toBe('7');
+      expect(url.searchParams.get('offset')).toBe('14');
+    });
+
+    it('sends limit on the id-only graph seeds', async () => {
+      fetchMock.mockResolvedValueOnce(jsonResponse([]));
+      await oxy.getMutualUserIds({ limit: 33 });
+      expect(new URL(requestedUrl(0)).searchParams.get('limit')).toBe('33');
+
+      fetchMock.mockResolvedValueOnce(jsonResponse([]));
+      await oxy.getFollowsOfFollowsIds({ limit: 44 });
+      expect(new URL(requestedUrl(1)).searchParams.get('limit')).toBe('44');
+    });
+
+    it('omits the query string entirely when no pagination is given', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserFollowers('target-1');
+
+      expect(requestedUrl(0)).toBe('http://test.invalid/users/target-1/followers');
+    });
+  });
+
+  describe('each page is its own cache entry', () => {
+    it('does NOT serve page 1 cached body to a page 2 request', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'a' }]));
+      const first = await oxy.getUserFollowers('target-1', { limit: 1, offset: 0 });
+      expect(first.followers).toEqual([{ id: 'a' }]);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+
+      // Different offset ⇒ different cache key ⇒ a real second network call.
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'b' }]));
+      const second = await oxy.getUserFollowers('target-1', { limit: 1, offset: 1 });
+
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      expect(second.followers).toEqual([{ id: 'b' }]);
+      expect(new URL(requestedUrl(1)).searchParams.get('offset')).toBe('1');
+    });
+
+    it('still serves a warm cache hit for the SAME page', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'a' }]));
+      await oxy.getUserFollowers('target-1', { limit: 1, offset: 0 });
+      await oxy.getUserFollowers('target-1', { limit: 1, offset: 0 });
+
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe('sort', () => {
+    it('sends sort=oldest and keeps it out of the request when unset', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserFollowers('target-1', { limit: 10, sort: 'oldest' });
+      expect(new URL(requestedUrl(0)).searchParams.get('sort')).toBe('oldest');
+
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserFollowers('target-1', { limit: 10 });
+      expect(new URL(requestedUrl(1)).searchParams.has('sort')).toBe(false);
+    });
+
+    it('discriminates the cache key, so flipping sort re-fetches', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'newest' }]));
+      const recent = await oxy.getUserFollowers('target-1', { limit: 2, offset: 0, sort: 'recent' });
+      expect(recent.followers).toEqual([{ id: 'newest' }]);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'oldest' }]));
+      const oldest = await oxy.getUserFollowers('target-1', { limit: 2, offset: 0, sort: 'oldest' });
+
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      expect(oldest.followers).toEqual([{ id: 'oldest' }]);
+    });
+
+    it('threads sort through getUserFollowing and getUserMutuals', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserFollowing('target-1', { sort: 'oldest' });
+      expect(new URL(requestedUrl(0)).searchParams.get('sort')).toBe('oldest');
+
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserMutuals('target-1', { sort: 'oldest' });
+      expect(new URL(requestedUrl(1)).searchParams.get('sort')).toBe('oldest');
+    });
+  });
+
+  describe('follow writes invalidate the cached follower/following lists', () => {
+    it('re-fetches the followers list after followUser', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'a' }], 1, false));
+      await oxy.getUserFollowers('target-1', { limit: 10, offset: 0 });
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+
+      fetchMock.mockResolvedValueOnce(jsonResponse({ success: true, message: 'ok' }));
+      await oxy.followUser('target-1');
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+
+      // The viewer is now a follower — the list must not come from cache.
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'a' }, { id: 'me' }], 2, false));
+      const after = await oxy.getUserFollowers('target-1', { limit: 10, offset: 0 });
+
+      expect(fetchMock).toHaveBeenCalledTimes(3);
+      expect(after.followers).toHaveLength(2);
+    });
+
+    it('re-fetches the viewer own following list after followUser', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([], 0, false));
+      await oxy.getUserFollowing('me', { limit: 10, offset: 0 });
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+
+      fetchMock.mockResolvedValueOnce(jsonResponse({ success: true, message: 'ok' }));
+      await oxy.followUser('target-1');
+
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'target-1' }], 1, false));
+      const after = await oxy.getUserFollowing('me', { limit: 10, offset: 0 });
+
+      expect(fetchMock).toHaveBeenCalledTimes(3);
+      expect(after.following).toEqual([{ id: 'target-1' }]);
+    });
+
+    it('invalidates every page and sort variant, not just the one that was read', async () => {
+      const clearPrefixSpy = jest.spyOn(oxy, 'clearCacheByPrefix');
+      fetchMock.mockResolvedValueOnce(jsonResponse({ success: true, message: 'ok' }));
+
+      await oxy.followUser('target-1');
+
+      // Prefix invalidation is what makes this page/sort agnostic — an exact-key
+      // clear would only bust the single variant the caller happened to read.
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/target-1/followers');
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/target-1/mutuals');
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me/following');
+      clearPrefixSpy.mockRestore();
+    });
+
+    it('invalidates the follower lists of every id in a bulk follow', async () => {
+      const clearPrefixSpy = jest.spyOn(oxy, 'clearCacheByPrefix');
+      fetchMock.mockResolvedValueOnce(
+        jsonResponse({
+          results: [
+            { userId: 'a', success: true, alreadyFollowing: false },
+            { userId: 'b', success: true, alreadyFollowing: false },
+          ],
+          followedCount: 2,
+        }),
+      );
+
+      await oxy.followUsers(['a', 'b']);
+
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/a/followers');
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/b/followers');
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me/following');
+      clearPrefixSpy.mockRestore();
+    });
+  });
+});