@oxyhq/core 12.11.1 → 13.2.0

package/dist/cjs/utils/apiUtils.js

@@ -3,23 +3,49 @@
  * Utility functions for common API patterns
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildQueryParams = buildQueryParams;
 exports.buildSearchParams = buildSearchParams;
 exports.buildUrl = buildUrl;
 exports.buildPaginationParams = buildPaginationParams;
 exports.safeJsonParse = safeJsonParse;
 /**
- * Build URL search parameters from an object
- * @param params Object with parameter key-value pairs
- * @returns URLSearchParams instance
+ * Build a plain query-parameter record from an object, stringifying values and
+ * dropping `undefined`/`null` entries.
+ *
+ * This is the shape `OxyServices.makeRequest` expects for a GET's `params`:
+ * `HttpService` inspects it with `Object.keys(...)` (both to decide whether to
+ * append a query string and to build the request's cache key), and
+ * `Object.keys(new URLSearchParams({ limit: '20' }))` is `[]` — a
+ * `URLSearchParams` exposes its entries through iterator methods, never as own
+ * enumerable properties. Passing one to `makeRequest` therefore silently drops
+ * the whole query string. Always hand `makeRequest` a plain record.
+ *
+ * Generic over the input object rather than taking `Record<string, unknown>`,
+ * because a TypeScript `interface` (`PaginationParams`, `FollowGraphParams`, …)
+ * has no implicit index signature and so is not assignable to that type.
  */
-function buildSearchParams(params) {
-    const searchParams = new URLSearchParams();
+function buildQueryParams(params) {
+    const query = {};
+    // Widening the value to `unknown` is always sound; the default overload of
+    // `Object.entries` would otherwise infer `any` here.
     for (const [key, value] of Object.entries(params)) {
         if (value !== undefined && value !== null) {
-            searchParams.append(key, value.toString());
+            query[key] = String(value);
         }
     }
-    return searchParams;
+    return query;
+}
+/**
+ * Build URL search parameters from an object.
+ *
+ * For building a URL string only — see {@link buildQueryParams} for the shape
+ * `makeRequest` needs.
+ *
+ * @param params Object with parameter key-value pairs
+ * @returns URLSearchParams instance
+ */
+function buildSearchParams(params) {
+    return new URLSearchParams(buildQueryParams(params));
 }
 /**
  * Build URL with search parameters
@@ -35,12 +61,16 @@ function buildUrl(baseUrl, params) {
     return queryString ? `${baseUrl}?${queryString}` : baseUrl;
 }
 /**
- * Build pagination search parameters
+ * Build pagination query parameters.
+ *
+ * Returns a plain record — NOT a `URLSearchParams` — because that is the only
+ * shape `makeRequest`/`HttpService` can read. See {@link buildQueryParams}.
+ *
  * @param params Pagination parameters
- * @returns URLSearchParams with pagination
+ * @returns Query record with pagination
  */
 function buildPaginationParams(params) {
-    return buildSearchParams(params);
+    return buildQueryParams(params);
 }
 /**
  * Safe JSON parsing with error handling

package/dist/cjs/utils/oauthPkce.js

@@ -17,7 +17,7 @@
  * React Native. No `require()`, so the ESM build stays bundler-clean.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.DEFAULT_OAUTH_SCOPE = exports.OXY_AUTHORIZE_URL = void 0;
+exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.DEFAULT_OAUTH_SCOPE = exports.OXY_AUTHORIZE_URL = void 0;
 exports.computeCodeChallenge = computeCodeChallenge;
 exports.generatePkcePair = generatePkcePair;
 exports.generateOAuthState = generateOAuthState;
@@ -159,10 +159,6 @@ exports.OXY_OAUTH_STATE_STORAGE_KEY = 'oxy_oauth_state';
 exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = 'oxy_oauth_code_verifier';
 /** `sessionStorage` key — the exact `redirect_uri` sent on the authorize request. */
 exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = 'oxy.oauth_redirect_uri';
-/** `sessionStorage` key — at most one silent OAuth attempt per navigation. */
-exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = 'oxy.silent_oauth_attempted';
-/** `sessionStorage` key — blocks further cross-origin auto-restore in this tab. */
-exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = 'oxy.cross_origin_restore_attempted';
 /**
  * `sessionStorage` key for the in-app path to return to after an authorize
  * round trip. See {@link persistOAuthReturnPath}.

package/dist/cjs/utils/officialOrigins.js

@@ -1,17 +1,12 @@
 "use strict";
 /**
- * Official first-party web origin allowlist — shared by hub-ticket issuance,
- * OAuth redirect validation, and cross-origin session restore.
+ * Official first-party web origin allowlist — shared by OAuth redirect
+ * validation and the server-side trusted-origin checks.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isAllowedDeviceJoinOrigin = void 0;
-exports.buildIdpHubOrigin = buildIdpHubOrigin;
-exports.isIdpHubOrigin = isIdpHubOrigin;
 exports.isLoopbackOrigin = isLoopbackOrigin;
 exports.isOfficialWebOrigin = isOfficialWebOrigin;
-exports.normalizeOfficialReturnOrigin = normalizeOfficialReturnOrigin;
-exports.parseHubSyncReturnUrl = parseHubSyncReturnUrl;
-exports.buildHubSyncUrl = buildHubSyncUrl;
 const authWebUrl_1 = require("./authWebUrl");
 const registrableApex_1 = require("./registrableApex");
 /** Official first-party registrable apexes (mirrors API trusted origins). */
@@ -27,30 +22,9 @@ const OFFICIAL_APEXES = new Set([
     'moovo.now',
     'mercaria.co',
 ]);
-function buildIdpHubOrigin() {
-    return `https://auth.${authWebUrl_1.CENTRAL_IDP_APEX}`;
-}
-/** Whether the current web origin is the central IdP hub (`auth.oxy.so`). */
-function isIdpHubOrigin() {
-    if (typeof globalThis === 'undefined') {
-        return false;
-    }
-    const location = globalThis.location;
-    if (!location) {
-        return false;
-    }
-    try {
-        const { hostname } = new URL(location.href);
-        return hostname === `auth.${authWebUrl_1.CENTRAL_IDP_APEX}`;
-    }
-    catch {
-        return false;
-    }
-}
 /**
  * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
- * or `[::1]` on any port, http or https). Local dev must never be bounced to a
- * hosted IdP for cross-origin session restore.
+ * or `[::1]` on any port, http or https).
  */
 function isLoopbackOrigin(origin) {
     try {
@@ -86,49 +60,5 @@ function isOfficialWebOrigin(origin) {
         return false;
     }
 }
-/** Normalize and validate a return URL against official origins. Returns origin only. */
-function normalizeOfficialReturnOrigin(raw) {
-    try {
-        const parsed = new URL(raw);
-        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-            return null;
-        }
-        if (!isOfficialWebOrigin(parsed.origin)) {
-            return null;
-        }
-        return parsed.origin;
-    }
-    catch {
-        return null;
-    }
-}
-/** Validate a hub-sync return URL; returns the full normalized URL string. */
-function parseHubSyncReturnUrl(raw) {
-    if (!raw) {
-        return null;
-    }
-    try {
-        const parsed = new URL(raw);
-        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-            return null;
-        }
-        if (!isOfficialWebOrigin(parsed.origin)) {
-            return null;
-        }
-        return parsed.toString();
-    }
-    catch {
-        return null;
-    }
-}
-/** Build auth.oxy.so/sync redirect URL with a one-time hub ticket. */
-function buildHubSyncUrl(ticket, returnUrl) {
-    const url = new URL('/sync', buildIdpHubOrigin());
-    url.searchParams.set('ticket', ticket);
-    if (returnUrl) {
-        url.searchParams.set('return', returnUrl);
-    }
-    return url.toString();
-}
 /** @deprecated Use {@link isOfficialWebOrigin}. */
 exports.isAllowedDeviceJoinOrigin = isOfficialWebOrigin;