@oxyhq/core 12.11.1 → 13.2.0

package/src/utils/__tests__/officialOrigins.test.ts

@@ -1,19 +1,10 @@
 import {
-  buildHubSyncUrl,
-  buildIdpHubOrigin,
   isAllowedDeviceJoinOrigin,
-  isIdpHubOrigin,
   isLoopbackOrigin,
   isOfficialWebOrigin,
-  normalizeOfficialReturnOrigin,
-  parseHubSyncReturnUrl,
 } from '../officialOrigins';
 
 describe('officialOrigins', () => {
-  it('builds the IdP hub origin', () => {
-    expect(buildIdpHubOrigin()).toBe('https://auth.oxy.so');
-  });
-
   it('allows official first-party origins', () => {
     expect(isOfficialWebOrigin('https://inbox.oxy.so')).toBe(true);
     expect(isOfficialWebOrigin('https://mention.earth')).toBe(true);
@@ -37,52 +28,4 @@ describe('officialOrigins', () => {
     expect(isAllowedDeviceJoinOrigin('https://accounts.oxy.so')).toBe(true);
     expect(isAllowedDeviceJoinOrigin('https://evil.example')).toBe(false);
   });
-
-  it('normalizes return origins to origin only', () => {
-    expect(normalizeOfficialReturnOrigin('https://accounts.oxy.so/settings')).toBe(
-      'https://accounts.oxy.so',
-    );
-    expect(normalizeOfficialReturnOrigin('https://evil.example/')).toBeNull();
-  });
-
-  it('parses hub-sync return URLs', () => {
-    expect(parseHubSyncReturnUrl('https://inbox.oxy.so/messages')).toBe(
-      'https://inbox.oxy.so/messages',
-    );
-    expect(parseHubSyncReturnUrl('https://evil.example/')).toBeNull();
-  });
-
-  it('builds hub sync URLs with ticket and optional return', () => {
-    const url = new URL(buildHubSyncUrl('tk-abc', 'https://accounts.oxy.so/'));
-    expect(url.pathname).toBe('/sync');
-    expect(url.searchParams.get('ticket')).toBe('tk-abc');
-    expect(url.searchParams.get('return')).toBe('https://accounts.oxy.so/');
-  });
-
-  describe('isIdpHubOrigin', () => {
-    const originalLocation = globalThis.location;
-
-    afterEach(() => {
-      Object.defineProperty(globalThis, 'location', {
-        configurable: true,
-        value: originalLocation,
-      });
-    });
-
-    it('returns true on auth.oxy.so', () => {
-      Object.defineProperty(globalThis, 'location', {
-        configurable: true,
-        value: { href: 'https://auth.oxy.so/sync' },
-      });
-      expect(isIdpHubOrigin()).toBe(true);
-    });
-
-    it('returns false on satellite origins', () => {
-      Object.defineProperty(globalThis, 'location', {
-        configurable: true,
-        value: { href: 'https://inbox.oxy.so/' },
-      });
-      expect(isIdpHubOrigin()).toBe(false);
-    });
-  });
 });

package/src/utils/apiUtils.ts

@@ -3,20 +3,46 @@
  */
 
 /**
- * Build URL search parameters from an object
- * @param params Object with parameter key-value pairs
- * @returns URLSearchParams instance
+ * Build a plain query-parameter record from an object, stringifying values and
+ * dropping `undefined`/`null` entries.
+ *
+ * This is the shape `OxyServices.makeRequest` expects for a GET's `params`:
+ * `HttpService` inspects it with `Object.keys(...)` (both to decide whether to
+ * append a query string and to build the request's cache key), and
+ * `Object.keys(new URLSearchParams({ limit: '20' }))` is `[]` — a
+ * `URLSearchParams` exposes its entries through iterator methods, never as own
+ * enumerable properties. Passing one to `makeRequest` therefore silently drops
+ * the whole query string. Always hand `makeRequest` a plain record.
+ *
+ * Generic over the input object rather than taking `Record<string, unknown>`,
+ * because a TypeScript `interface` (`PaginationParams`, `FollowGraphParams`, …)
+ * has no implicit index signature and so is not assignable to that type.
  */
-export function buildSearchParams(params: Record<string, any>): URLSearchParams {
-  const searchParams = new URLSearchParams();
-  
-  for (const [key, value] of Object.entries(params)) {
+export function buildQueryParams<T extends object>(params: T): Record<string, string> {
+  const query: Record<string, string> = {};
+
+  // Widening the value to `unknown` is always sound; the default overload of
+  // `Object.entries` would otherwise infer `any` here.
+  for (const [key, value] of Object.entries(params) as [string, unknown][]) {
     if (value !== undefined && value !== null) {
-      searchParams.append(key, value.toString());
+      query[key] = String(value);
     }
   }
-  
-  return searchParams;
+
+  return query;
+}
+
+/**
+ * Build URL search parameters from an object.
+ *
+ * For building a URL string only — see {@link buildQueryParams} for the shape
+ * `makeRequest` needs.
+ *
+ * @param params Object with parameter key-value pairs
+ * @returns URLSearchParams instance
+ */
+export function buildSearchParams<T extends object>(params: T): URLSearchParams {
+  return new URLSearchParams(buildQueryParams(params));
 }
 
 /**
@@ -25,7 +51,7 @@ export function buildSearchParams(params: Record<string, any>): URLSearchParams
  * @param params Object with parameter key-value pairs
  * @returns Complete URL with search parameters
  */
-export function buildUrl(baseUrl: string, params?: Record<string, any>): string {
+export function buildUrl<T extends object>(baseUrl: string, params?: T): string {
   if (!params) return baseUrl;
   
   const searchParams = buildSearchParams(params);
@@ -43,12 +69,35 @@ export interface PaginationParams {
 }
 
 /**
- * Build pagination search parameters
+ * Ordering for the follow-graph list endpoints (`/users/:id/followers`,
+ * `/users/:id/following`, `/users/:id/mutuals`).
+ *
+ * - `recent` — newest follow edge first (the server default).
+ * - `oldest` — oldest follow edge first.
+ */
+export type FollowGraphSort = 'recent' | 'oldest';
+
+/**
+ * Pagination plus the follow-graph ordering.
+ *
+ * Kept separate from {@link PaginationParams}, which is shared by endpoints
+ * that have no `sort` at all.
+ */
+export interface FollowGraphParams extends PaginationParams {
+  sort?: FollowGraphSort;
+}
+
+/**
+ * Build pagination query parameters.
+ *
+ * Returns a plain record — NOT a `URLSearchParams` — because that is the only
+ * shape `makeRequest`/`HttpService` can read. See {@link buildQueryParams}.
+ *
  * @param params Pagination parameters
- * @returns URLSearchParams with pagination
+ * @returns Query record with pagination
  */
-export function buildPaginationParams(params: PaginationParams): URLSearchParams {
-  return buildSearchParams(params);
+export function buildPaginationParams(params: PaginationParams): Record<string, string> {
+  return buildQueryParams(params);
 }
 
 /**

package/src/utils/oauthPkce.ts

@@ -62,10 +62,18 @@ export interface BuildOAuthAuthorizeUrlParams {
   /** The PKCE `codeChallenge` from {@link generatePkcePair}. */
   codeChallenge: string;
   /**
-   * OAuth `prompt` parameter. Use `none` for silent cross-origin session restore
-   * (no UI when the IdP hub already has a session + grant).
+   * OAuth `prompt` parameter — `login` forces a fresh authentication even when
+   * the IdP already has a session, `consent` forces the consent screen even for
+   * an already-granted scope. Both are ordinary OAuth/OIDC and are here for
+   * third-party relying parties building their own authorize link.
+   *
+   * `'none'` is deliberately NOT in this union. It is the silent-SSO value, and
+   * it was the only value this SDK ever sent — from the cold-boot cross-origin
+   * restore deleted in #691 phase 7b. Accepting it again would hand consumers a
+   * one-line rebuild of the automatic, gesture-less full-page bounce to the IdP
+   * that the popup transport exists to eliminate.
    */
-  prompt?: 'none' | 'login' | 'consent';
+  prompt?: 'login' | 'consent';
   /**
    * How the IdP should deliver the authorization response. Omitted (the
    * default) means the ordinary top-level redirect back to `redirectUri`.
@@ -220,12 +228,6 @@ export const OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = 'oxy_oauth_code_verifier';
 /** `sessionStorage` key — the exact `redirect_uri` sent on the authorize request. */
 export const OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = 'oxy.oauth_redirect_uri';
 
-/** `sessionStorage` key — at most one silent OAuth attempt per navigation. */
-export const OXY_SILENT_OAUTH_ATTEMPTED_KEY = 'oxy.silent_oauth_attempted';
-
-/** `sessionStorage` key — blocks further cross-origin auto-restore in this tab. */
-export const OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = 'oxy.cross_origin_restore_attempted';
-
 /**
  * `sessionStorage` key for the in-app path to return to after an authorize
  * round trip. See {@link persistOAuthReturnPath}.

package/src/utils/officialOrigins.ts

@@ -1,6 +1,6 @@
 /**
- * Official first-party web origin allowlist — shared by hub-ticket issuance,
- * OAuth redirect validation, and cross-origin session restore.
+ * Official first-party web origin allowlist — shared by OAuth redirect
+ * validation and the server-side trusted-origin checks.
  */
 
 import { CENTRAL_IDP_APEX } from './authWebUrl';
@@ -20,31 +20,9 @@ const OFFICIAL_APEXES = new Set([
   'mercaria.co',
 ]);
 
-export function buildIdpHubOrigin(): string {
-  return `https://auth.${CENTRAL_IDP_APEX}`;
-}
-
-/** Whether the current web origin is the central IdP hub (`auth.oxy.so`). */
-export function isIdpHubOrigin(): boolean {
-  if (typeof globalThis === 'undefined') {
-    return false;
-  }
-  const location = (globalThis as { location?: Location }).location;
-  if (!location) {
-    return false;
-  }
-  try {
-    const { hostname } = new URL(location.href);
-    return hostname === `auth.${CENTRAL_IDP_APEX}`;
-  } catch {
-    return false;
-  }
-}
-
 /**
  * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
- * or `[::1]` on any port, http or https). Local dev must never be bounced to a
- * hosted IdP for cross-origin session restore.
+ * or `[::1]` on any port, http or https).
  */
 export function isLoopbackOrigin(origin: string): boolean {
   try {
@@ -80,50 +58,5 @@ export function isOfficialWebOrigin(origin: string): boolean {
   }
 }
 
-/** Normalize and validate a return URL against official origins. Returns origin only. */
-export function normalizeOfficialReturnOrigin(raw: string): string | null {
-  try {
-    const parsed = new URL(raw);
-    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-      return null;
-    }
-    if (!isOfficialWebOrigin(parsed.origin)) {
-      return null;
-    }
-    return parsed.origin;
-  } catch {
-    return null;
-  }
-}
-
-/** Validate a hub-sync return URL; returns the full normalized URL string. */
-export function parseHubSyncReturnUrl(raw: string | null): string | null {
-  if (!raw) {
-    return null;
-  }
-  try {
-    const parsed = new URL(raw);
-    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-      return null;
-    }
-    if (!isOfficialWebOrigin(parsed.origin)) {
-      return null;
-    }
-    return parsed.toString();
-  } catch {
-    return null;
-  }
-}
-
-/** Build auth.oxy.so/sync redirect URL with a one-time hub ticket. */
-export function buildHubSyncUrl(ticket: string, returnUrl?: string): string {
-  const url = new URL('/sync', buildIdpHubOrigin());
-  url.searchParams.set('ticket', ticket);
-  if (returnUrl) {
-    url.searchParams.set('return', returnUrl);
-  }
-  return url.toString();
-}
-
 /** @deprecated Use {@link isOfficialWebOrigin}. */
 export const isAllowedDeviceJoinOrigin = isOfficialWebOrigin;

package/dist/cjs/session/hubSync.js

@@ -1,55 +0,0 @@
-"use strict";
-/**
- * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
- * one-time server ticket (no secrets in URL fragments).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.syncHubAfterSignIn = syncHubAfterSignIn;
-exports.redeemHubTicketOnHub = redeemHubTicketOnHub;
-const officialOrigins_1 = require("../utils/officialOrigins");
-/**
- * After a successful sign-in on an official web app, mint a hub ticket and
- * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
- * shared device credential for silent OAuth restore on other origins.
- *
- * No-op on native, non-official origins, and when already on the IdP hub.
- */
-async function syncHubAfterSignIn(oxy, opts) {
-    if (opts?.enabled === false) {
-        return false;
-    }
-    if (typeof globalThis === 'undefined') {
-        return false;
-    }
-    const location = globalThis.location;
-    if (!location) {
-        return false;
-    }
-    if ((0, officialOrigins_1.isIdpHubOrigin)()) {
-        return false;
-    }
-    if (!(0, officialOrigins_1.isOfficialWebOrigin)(location.origin)) {
-        return false;
-    }
-    const hubOrigin = (0, officialOrigins_1.buildIdpHubOrigin)();
-    const issued = await oxy.issueHubTicket(hubOrigin);
-    const returnUrl = `${location.origin}${location.pathname}${location.search}${location.hash}`;
-    const syncUrl = (0, officialOrigins_1.buildHubSyncUrl)(issued.ticket, returnUrl);
-    window.location.assign(syncUrl);
-    return true;
-}
-/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
-async function redeemHubTicketOnHub(oxy, store, ticket) {
-    const hubOrigin = (0, officialOrigins_1.buildIdpHubOrigin)();
-    const creds = await oxy.redeemHubTicket(ticket, hubOrigin);
-    const prior = await store.load();
-    await store.save({
-        sessionId: prior?.sessionId ?? '',
-        userId: prior?.userId ?? '',
-        deviceId: creds.deviceId,
-        deviceSecret: creds.deviceSecret,
-        ...(prior?.accessToken ? { accessToken: prior.accessToken } : {}),
-        ...(prior?.expiresAt ? { expiresAt: prior.expiresAt } : {}),
-    });
-    return true;
-}

package/dist/esm/session/hubSync.js

@@ -1,51 +0,0 @@
-/**
- * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
- * one-time server ticket (no secrets in URL fragments).
- */
-import { buildHubSyncUrl, buildIdpHubOrigin, isIdpHubOrigin, isOfficialWebOrigin, } from '../utils/officialOrigins.js';
-/**
- * After a successful sign-in on an official web app, mint a hub ticket and
- * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
- * shared device credential for silent OAuth restore on other origins.
- *
- * No-op on native, non-official origins, and when already on the IdP hub.
- */
-export async function syncHubAfterSignIn(oxy, opts) {
-    if (opts?.enabled === false) {
-        return false;
-    }
-    if (typeof globalThis === 'undefined') {
-        return false;
-    }
-    const location = globalThis.location;
-    if (!location) {
-        return false;
-    }
-    if (isIdpHubOrigin()) {
-        return false;
-    }
-    if (!isOfficialWebOrigin(location.origin)) {
-        return false;
-    }
-    const hubOrigin = buildIdpHubOrigin();
-    const issued = await oxy.issueHubTicket(hubOrigin);
-    const returnUrl = `${location.origin}${location.pathname}${location.search}${location.hash}`;
-    const syncUrl = buildHubSyncUrl(issued.ticket, returnUrl);
-    window.location.assign(syncUrl);
-    return true;
-}
-/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
-export async function redeemHubTicketOnHub(oxy, store, ticket) {
-    const hubOrigin = buildIdpHubOrigin();
-    const creds = await oxy.redeemHubTicket(ticket, hubOrigin);
-    const prior = await store.load();
-    await store.save({
-        sessionId: prior?.sessionId ?? '',
-        userId: prior?.userId ?? '',
-        deviceId: creds.deviceId,
-        deviceSecret: creds.deviceSecret,
-        ...(prior?.accessToken ? { accessToken: prior.accessToken } : {}),
-        ...(prior?.expiresAt ? { expiresAt: prior.expiresAt } : {}),
-    });
-    return true;
-}

package/dist/types/session/hubSync.d.ts

@@ -1,20 +0,0 @@
-/**
- * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
- * one-time server ticket (no secrets in URL fragments).
- */
-import type { OxyServices } from '../OxyServices';
-import type { AuthStateStore } from './authStateStore';
-export interface SyncHubAfterSignInOptions {
-    /** Skip sync when false (OxyProvider hubSync prop). @default true */
-    enabled?: boolean;
-}
-/**
- * After a successful sign-in on an official web app, mint a hub ticket and
- * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
- * shared device credential for silent OAuth restore on other origins.
- *
- * No-op on native, non-official origins, and when already on the IdP hub.
- */
-export declare function syncHubAfterSignIn(oxy: Pick<OxyServices, 'issueHubTicket'>, opts?: SyncHubAfterSignInOptions): Promise<boolean>;
-/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
-export declare function redeemHubTicketOnHub(oxy: Pick<OxyServices, 'redeemHubTicket'>, store: AuthStateStore, ticket: string): Promise<boolean>;

package/src/session/__tests__/hubSync.test.ts

@@ -1,51 +0,0 @@
-import { syncHubAfterSignIn } from '../hubSync';
-
-jest.mock('../../utils/officialOrigins', () => {
-  const actual = jest.requireActual('../../utils/officialOrigins');
-  return {
-    ...actual,
-    isIdpHubOrigin: jest.fn(() => false),
-    isOfficialWebOrigin: jest.fn(() => true),
-    buildIdpHubOrigin: jest.fn(() => 'https://auth.oxy.so'),
-  };
-});
-
-describe('syncHubAfterSignIn', () => {
-  const originalLocation = globalThis.location;
-  const originalAssign = (globalThis as { location?: Location }).location?.assign;
-
-  afterEach(() => {
-    Object.defineProperty(globalThis, 'location', {
-      configurable: true,
-      value: originalLocation,
-    });
-    jest.restoreAllMocks();
-  });
-
-  it('includes the hash fragment in the hub-sync return URL', async () => {
-    const assign = jest.fn();
-    Object.defineProperty(globalThis, 'location', {
-      configurable: true,
-      value: {
-        origin: 'https://oxy.so',
-        pathname: '/pricing',
-        search: '?plan=pro',
-        hash: '#compare',
-        assign,
-      },
-    });
-    Object.defineProperty(globalThis, 'window', {
-      configurable: true,
-      value: { location: globalThis.location },
-    });
-
-    const issueHubTicket = jest.fn().mockResolvedValue({ ticket: 'tk-1' });
-
-    const redirected = await syncHubAfterSignIn({ issueHubTicket });
-
-    expect(redirected).toBe(true);
-    expect(issueHubTicket).toHaveBeenCalledWith('https://auth.oxy.so');
-    const syncUrl = new URL(String(assign.mock.calls[0]?.[0] ?? ''));
-    expect(syncUrl.searchParams.get('return')).toBe('https://oxy.so/pricing?plan=pro#compare');
-  });
-});

package/src/session/hubSync.ts

@@ -1,79 +0,0 @@
-/**
- * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
- * one-time server ticket (no secrets in URL fragments).
- */
-
-import type { OxyServices } from '../OxyServices';
-import type { AuthStateStore } from './authStateStore';
-import {
-  buildHubSyncUrl,
-  buildIdpHubOrigin,
-  isIdpHubOrigin,
-  isOfficialWebOrigin,
-} from '../utils/officialOrigins';
-
-export interface SyncHubAfterSignInOptions {
-  /** Skip sync when false (OxyProvider hubSync prop). @default true */
-  enabled?: boolean;
-}
-
-/**
- * After a successful sign-in on an official web app, mint a hub ticket and
- * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
- * shared device credential for silent OAuth restore on other origins.
- *
- * No-op on native, non-official origins, and when already on the IdP hub.
- */
-export async function syncHubAfterSignIn(
-  oxy: Pick<OxyServices, 'issueHubTicket'>,
-  opts?: SyncHubAfterSignInOptions,
-): Promise<boolean> {
-  if (opts?.enabled === false) {
-    return false;
-  }
-
-  if (typeof globalThis === 'undefined') {
-    return false;
-  }
-
-  const location = (globalThis as { location?: Location }).location;
-  if (!location) {
-    return false;
-  }
-
-  if (isIdpHubOrigin()) {
-    return false;
-  }
-
-  if (!isOfficialWebOrigin(location.origin)) {
-    return false;
-  }
-
-  const hubOrigin = buildIdpHubOrigin();
-  const issued = await oxy.issueHubTicket(hubOrigin);
-  const returnUrl = `${location.origin}${location.pathname}${location.search}${location.hash}`;
-  const syncUrl = buildHubSyncUrl(issued.ticket, returnUrl);
-
-  window.location.assign(syncUrl);
-  return true;
-}
-
-/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
-export async function redeemHubTicketOnHub(
-  oxy: Pick<OxyServices, 'redeemHubTicket'>,
-  store: AuthStateStore,
-  ticket: string,
-): Promise<boolean> {
-  const hubOrigin = buildIdpHubOrigin();
-  const creds = await oxy.redeemHubTicket(ticket, hubOrigin);
-  const prior = await store.load();
-  await store.save({
-    sessionId: prior?.sessionId ?? '',
-    userId: prior?.userId ?? '',
-    deviceId: creds.deviceId,
-    deviceSecret: creds.deviceSecret,
-    ...(prior?.accessToken ? { accessToken: prior.accessToken } : {}),
-    ...(prior?.expiresAt ? { expiresAt: prior.expiresAt } : {}),
-  });
-  return true;
-}