@oxyhq/core 12.5.4 → 12.6.0

package/src/session/SessionClient.ts

@@ -7,6 +7,7 @@ import {
   type DeviceSessionState,
 } from '@oxyhq/contracts';
 import { logger } from '../logger';
+import { computeIdentityTag } from '../utils/cacheKey';
 import { getSocketIO } from './socketLoader';
 import type { MinimalSocket, SocketIOFactory } from './socketLoader';
 
@@ -172,8 +173,25 @@ export class SessionClient {
     }
   }
 
-  /** Validate + last-writer-wins by revision. Returns true if applied. */
-  protected applyState(raw: unknown, origin: SessionStateOrigin = 'push'): boolean {
+  /**
+   * Validate + last-writer-wins by revision. Returns true if applied.
+   *
+   * `activeToken` (sync path only) is the server-issued access token for
+   * `raw.activeAccountId`. When present and the state is applied, it is planted
+   * BEFORE any subscriber is notified so the bearer already belongs to the new
+   * active account — the local switch/bootstrap path then needs no redundant
+   * device-secret mint. Push-origin applies carry no token and rely on the
+   * mint-before-notify gate below.
+   *
+   * ORDERING INVARIANT: a subscriber must NEVER observe a newly-active account
+   * while the planted bearer still identifies the PREVIOUS one — otherwise a
+   * `useCurrentUser`-style refetch fires under the wrong account's token (the
+   * account-switch 404 race). So when a transport is available and the planted
+   * bearer does not already belong to `next.activeAccountId`, minting is awaited
+   * BEFORE `notify()`. This covers EVERY notify source (a switch push, a
+   * cross-device push, a cold mint), not just the initial "no bearer yet" case.
+   */
+  protected applyState(raw: unknown, origin: SessionStateOrigin = 'push', activeToken?: string): boolean {
     const next = safeParseContract(deviceSessionStateSchema, raw);
     if (!next) {
       logger.warn('[SessionClient] discarded invalid session state');
@@ -192,10 +210,27 @@ export class SessionClient {
     ) {
       return false;
     }
+    const previousState = this.state;
     this.state = next;
+    // Plant the sync-supplied active token (it is for `next.activeAccountId`)
+    // now — before the notify below — so the bearer matches the new active
+    // account when subscribers observe it. Guarded on difference to avoid a
+    // redundant token-change notification on an unchanged token (bootstrap
+    // restate).
+    if (activeToken && next.activeAccountId !== null && activeToken !== this.host.getAccessToken()) {
+      this.host.setTokens(activeToken);
+    }
     const transport = this.options.transport;
+    const activeAccountId = next.activeAccountId;
+    // Mint before notifying when the bearer does not already belong to the new
+    // active account: no bearer at all, an opaque bearer, OR a bearer for a
+    // DIFFERENT account. `computeIdentityTag` yields the token's `userId`/`id`
+    // for a real JWT (comparable to the account id) and a non-account sentinel
+    // otherwise, so a mismatch always resolves to "mint".
     const needsMintBeforeNotify =
-      transport != null && next.accounts.length > 0 && !this.host.getAccessToken();
+      transport != null &&
+      next.accounts.length > 0 &&
+      (activeAccountId === null || computeIdentityTag(this.host.getAccessToken()) !== activeAccountId);
 
     const finishApply = (): void => {
       this.notify();
@@ -210,8 +245,10 @@ export class SessionClient {
 
     if (needsMintBeforeNotify) {
       void transport.ensureActiveToken(next).then(finishApply).catch((error) => {
-        logger.warn('[SessionClient] ensureActiveToken failed', { component: 'SessionClient' }, error);
-        finishApply();
+        logger.warn('[SessionClient] ensureActiveToken failed — reverting session state', { component: 'SessionClient' }, error);
+        // Do NOT notify under a mismatched bearer. Revert to the last applied
+        // state so subscribers keep observing the account whose token is planted.
+        this.state = previousState ?? null;
       });
     } else {
       if (transport) {
@@ -251,9 +288,23 @@ export class SessionClient {
     }
     // A `sync` is always the response to a direct REST call this client made
     // (bootstrap / switch / signOut / add) → a `request`-origin, authoritative
-    // verdict.
-    this.applyState(sync.state, 'request');
-    if (sync.activeToken && this.state && sync.state.activeAccountId === this.state.activeAccountId) {
+    // verdict. Hand the active token to `applyState`: in the applied path it is
+    // planted BEFORE notify (bearer matches the new active account when
+    // subscribers observe it, and no redundant device-secret mint is triggered).
+    const applied = this.applyState(sync.state, 'request', sync.activeToken?.accessToken);
+    // Equal-revision restate (this revision was already applied by a preceding
+    // socket push): `applyState` no-ops without planting, but the token still
+    // needs planting. Guard on the sync's active account STILL being the current
+    // active account so a stale response cannot adopt a token for an account a
+    // newer state already switched away from.
+    if (
+      !applied &&
+      sync.activeToken &&
+      this.state &&
+      sync.state.activeAccountId !== null &&
+      sync.state.activeAccountId === this.state.activeAccountId &&
+      sync.activeToken.accessToken !== this.host.getAccessToken()
+    ) {
       this.host.setTokens(sync.activeToken.accessToken);
     }
   }

package/src/session/__tests__/SessionClient.switchTokenOrder.test.ts

@@ -0,0 +1,170 @@
+import type { DeviceSessionState } from '@oxyhq/contracts';
+import { SessionClient, type SessionClientHost, type TokenTransport } from '../SessionClient';
+import { computeIdentityTag } from '../../utils/cacheKey';
+
+/**
+ * The account-switch 404 race (regression guard).
+ *
+ * When a `session_state` push re-elects the active account from A to B, the
+ * push carries NO token — the app still holds A's bearer. If a subscriber were
+ * notified before B's bearer is planted, a `useCurrentUser`-style refetch would
+ * fire under A's token against B's session and 404.
+ *
+ * INVARIANT: no subscriber is ever notified while the planted bearer identifies
+ * an account OTHER than the observed active account. This test records, at every
+ * notify, the observed active account alongside the account the CURRENT bearer
+ * belongs to (via the same `computeIdentityTag` derivation `applyState` uses)
+ * and asserts they always match — and that the switch notify is DEFERRED until
+ * the mint lands B's token.
+ */
+
+/** A minimal jwt-decode-able token whose `userId` claim is `accountId`. */
+function jwtFor(accountId: string): string {
+  const payload = Buffer.from(JSON.stringify({ userId: accountId })).toString('base64url');
+  return `h.${payload}.s`;
+}
+
+const stateWith = (rev: number, active: string): DeviceSessionState => ({
+  deviceId: 'd1',
+  accounts: [
+    { accountId: 'a1', sessionId: 's-a1', authuser: 0 },
+    { accountId: 'b1', sessionId: 's-b1', authuser: 1 },
+  ],
+  activeAccountId: active,
+  revision: rev,
+  updatedAt: 1720000000000,
+});
+
+class TestClient extends SessionClient {
+  public apply(raw: unknown): boolean {
+    return this.applyState(raw);
+  }
+}
+
+describe('SessionClient — no notify under a mismatched bearer on an account switch', () => {
+  it('defers the switch notify until the mint lands the new active account bearer', async () => {
+    // Mutable planted bearer, starting on account A.
+    let planted: string | null = jwtFor('a1');
+    const host: SessionClientHost = {
+      makeRequest: jest.fn(),
+      getBaseURL: () => 'http://test.invalid',
+      getAccessToken: () => planted,
+      getDeviceCredential: () => null,
+      onTokensChanged: () => () => undefined,
+      setTokens: (token) => {
+        planted = token;
+      },
+      getCurrentAccountId: () => null,
+    };
+
+    // The mint lands the ACTIVE account's bearer, asynchronously (models the
+    // real device-secret mint round trip).
+    const transport: TokenTransport = {
+      ensureActiveToken: jest.fn(async (state: DeviceSessionState) => {
+        await Promise.resolve();
+        if (state.activeAccountId) {
+          planted = jwtFor(state.activeAccountId);
+        }
+      }),
+    };
+
+    const c = new TestClient(host, { transport });
+
+    const observations: Array<{ active: string | null; bearer: string }> = [];
+    c.subscribe((s) => {
+      observations.push({
+        active: s?.activeAccountId ?? null,
+        bearer: computeIdentityTag(host.getAccessToken()),
+      });
+    });
+
+    // Apply A (bearer already A's) → matches → synchronous notify.
+    c.apply(stateWith(1, 'a1'));
+    expect(observations).toEqual([{ active: 'a1', bearer: 'a1' }]);
+
+    // A `session_state` push re-elects B while the bearer is still A's.
+    c.apply(stateWith(2, 'b1'));
+    // The switch notify MUST NOT have fired yet — the bearer is still A's, so a
+    // synchronous notify would let a subscriber observe B under A's token.
+    expect(observations).toEqual([{ active: 'a1', bearer: 'a1' }]);
+
+    // Flush the mint + deferred notify.
+    for (let i = 0; i < 5; i++) {
+      await Promise.resolve();
+    }
+
+    // The mint ran, and the switch notify fired only AFTER B's bearer was planted.
+    expect(transport.ensureActiveToken).toHaveBeenCalledWith(
+      expect.objectContaining({ activeAccountId: 'b1' }),
+    );
+    expect(observations).toContainEqual({ active: 'b1', bearer: 'b1' });
+
+    // At NO notify did the observed active account differ from the bearer's account.
+    for (const o of observations) {
+      expect(o.bearer).toBe(o.active);
+    }
+  });
+
+  it('does not defer when the bearer already belongs to the new active account', () => {
+    let planted: string | null = jwtFor('b1');
+    const host: SessionClientHost = {
+      makeRequest: jest.fn(),
+      getBaseURL: () => 'http://test.invalid',
+      getAccessToken: () => planted,
+      getDeviceCredential: () => null,
+      onTokensChanged: () => () => undefined,
+      setTokens: (token) => {
+        planted = token;
+      },
+      getCurrentAccountId: () => null,
+    };
+    const transport: TokenTransport = { ensureActiveToken: jest.fn().mockResolvedValue(undefined) };
+    const c = new TestClient(host, { transport });
+
+    const seen: Array<string | null> = [];
+    c.subscribe((s) => seen.push(s?.activeAccountId ?? null));
+
+    // Bearer is already B's → the notify is synchronous (no mint-before-notify).
+    c.apply(stateWith(3, 'b1'));
+    expect(seen).toEqual(['b1']);
+  });
+
+  it('reverts state and does not notify when minting fails on an account switch', async () => {
+    let planted: string | null = jwtFor('a1');
+    const host: SessionClientHost = {
+      makeRequest: jest.fn(),
+      getBaseURL: () => 'http://test.invalid',
+      getAccessToken: () => planted,
+      getDeviceCredential: () => null,
+      onTokensChanged: () => () => undefined,
+      setTokens: (token) => {
+        planted = token;
+      },
+      getCurrentAccountId: () => null,
+    };
+
+    const transport: TokenTransport = {
+      ensureActiveToken: jest.fn(async () => {
+        await Promise.resolve();
+        throw new Error('mint failed');
+      }),
+    };
+
+    const c = new TestClient(host, { transport });
+    const seen: Array<string | null> = [];
+    c.subscribe((s) => seen.push(s?.activeAccountId ?? null));
+
+    c.apply(stateWith(1, 'a1'));
+    expect(seen).toEqual(['a1']);
+
+    c.apply(stateWith(2, 'b1'));
+    for (let i = 0; i < 5; i++) {
+      await Promise.resolve();
+    }
+
+    // Still on A — no notify under A's bearer for B's active account.
+    expect(seen).toEqual(['a1']);
+    expect(c.getState()?.activeAccountId).toBe('a1');
+    expect(computeIdentityTag(host.getAccessToken())).toBe('a1');
+  });
+});

package/src/utils/__tests__/redactUrl.test.ts

@@ -0,0 +1,33 @@
+/**
+ * `redactUrlQuery` tests — the query-string scrubber used before any asset URL
+ * reaches a log sink. Asset stream URLs carry a scoped `mt=` media token that
+ * is a bearer credential; it must never be logged.
+ */
+
+import { redactUrlQuery } from '../redactUrl';
+
+describe('redactUrlQuery', () => {
+  it('strips the query string (including a media token) from an absolute URL', () => {
+    const redacted = redactUrlQuery(
+      'https://api.oxy.so/assets/priv1/stream?variant=thumb&mt=SECRET-TOKEN',
+    );
+    expect(redacted).toBe('https://api.oxy.so/assets/priv1/stream?<redacted>');
+    expect(redacted).not.toContain('mt=');
+    expect(redacted).not.toContain('SECRET-TOKEN');
+  });
+
+  it('strips the query string from a relative path too', () => {
+    expect(redactUrlQuery('/assets/priv1/url?expiresIn=600&mt=SECRET')).toBe(
+      '/assets/priv1/url?<redacted>',
+    );
+  });
+
+  it('returns a URL without a query string unchanged', () => {
+    expect(redactUrlQuery('https://cloud.oxy.so/pub1')).toBe('https://cloud.oxy.so/pub1');
+    expect(redactUrlQuery('/assets')).toBe('/assets');
+  });
+
+  it('passes through empty input', () => {
+    expect(redactUrlQuery('')).toBe('');
+  });
+});

package/src/utils/redactUrl.ts

@@ -0,0 +1,28 @@
+/**
+ * URL redaction for logging.
+ *
+ * Asset URLs the API hands back for private assets carry a scoped, short-lived
+ * media token (`mt=…`) in their query string. That token is a bearer credential
+ * for the underlying object, so it must never land in a log line, breadcrumb,
+ * or metric — a captured log would otherwise grant read access until the token
+ * expires. Query strings on API URLs can also carry other sensitive params, so
+ * we redact the whole query rather than allow-listing one key.
+ *
+ * `redactUrlQuery` returns the URL's path portion with a `?<redacted>` marker
+ * when a query string is present, and the input unchanged otherwise. It is
+ * defensive: any input that does not parse as a URL is passed through as-is,
+ * except that a bare `?query` tail is still stripped so a relative path with a
+ * query never leaks.
+ */
+export function redactUrlQuery(url: string): string {
+  if (typeof url !== 'string' || url.length === 0) {
+    return url;
+  }
+
+  const queryIndex = url.indexOf('?');
+  if (queryIndex === -1) {
+    return url;
+  }
+
+  return `${url.slice(0, queryIndex)}?<redacted>`;
+}