@oxyhq/core 12.9.0 → 12.10.1

package/src/mixins/OxyServices.auth.ts

@@ -9,6 +9,10 @@ import { loginResultSchema, safeParseContract } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 import type { PublicApplication } from './OxyServices.connectedApps';
+export {
+  getCommonsApprovalBlockingReason,
+  parseCommonsApprovalExpiresAt,
+} from '../utils/commonsApproval';
 import { OxyAuthenticationError } from '../OxyServices.errors';
 import { KeyManager } from '../crypto/keyManager';
 import { SignatureService } from '../crypto/signatureService';
@@ -96,7 +100,7 @@ export interface CommonsSignInStatus {
  */
 export interface CommonsApprovalInfo {
   /** Sanitized, display-safe identity of the requesting application. */
-  application: PublicApplication;
+  application: PublicApplication | null;
   /** OAuth scopes the application is requesting. */
   scopes: string[];
   /** The origin the session is bound to (the RP web origin), when applicable. */
@@ -109,8 +113,8 @@ export interface CommonsApprovalInfo {
    * "not verified") by {@link OxyServicesAuthMixin.getCommonsApprovalInfo}.
    */
   originVerified: boolean;
-  /** Server-authoritative expiry (epoch milliseconds). */
-  expiresAt: number;
+  /** Server-authoritative expiry (epoch ms or ISO-8601 string from the API). */
+  expiresAt: number | string;
   /** Session lifecycle status. */
   status: string;
 }
@@ -122,11 +126,11 @@ export interface CommonsApprovalInfo {
  * into {@link CommonsApprovalInfo}.
  */
 interface CommonsApprovalInfoResponse {
-  application: PublicApplication;
+  application: PublicApplication | null;
   scopes: string[];
   boundOrigin?: string;
   originVerified?: unknown;
-  expiresAt: number;
+  expiresAt: number | string;
   status: string;
 }
 
@@ -367,7 +371,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
         'POST',
         '/auth/service-token',
         { apiKey: key, apiSecret: secret },
-        { cache: false, retry: false }
+        { cache: false, retry: false, skipAuth: true }
       );
 
       const expiresAt = Date.now() + response.expiresIn * 1000;
@@ -482,7 +486,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           publicKey,
           signature,
           timestamp,
-        }, { cache: false });
+        }, { cache: false, skipAuth: true });
 
         if (!res || (typeof res === 'object' && Object.keys(res).length === 0)) {
           throw new OxyAuthenticationError('Registration failed', 'REGISTER_FAILED', 400);
@@ -511,7 +515,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
       try {
         return await this.makeRequest<ChallengeResponse>('POST', '/auth/challenge', {
           publicKey,
-        }, { cache: false, ...requestOptions });
+        }, { cache: false, skipAuth: true, ...requestOptions });
       } catch (error) {
         throw this.handleError(error);
       }
@@ -548,7 +552,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           timestamp,
           deviceName,
           deviceFingerprint,
-        }, { cache: false, ...requestOptions });
+        }, { cache: false, skipAuth: true, ...requestOptions });
 
         // Plant the freshly-minted tokens, mirroring `claimSessionByToken`.
         // `/auth/verify` returns the first access token (and refresh token) in
@@ -577,7 +581,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'GET',
           `/auth/check-publickey/${encodeURIComponent(publicKey)}`,
           undefined,
-          { cache: false }
+          { cache: false, skipAuth: true }
         );
       } catch (error) {
         throw this.handleError(error);
@@ -593,7 +597,12 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'GET',
           `/auth/user/${encodeURIComponent(publicKey)}`,
           undefined,
-          { cache: true, cacheTTL: 2 * 60 * 1000 }
+          {
+            cache: true,
+            cacheTTL: 2 * 60 * 1000,
+            // Public lookup by public key (pre-session) — skip the bearer preflight.
+            skipAuth: true,
+          },
         );
         return normalizeUserIdentity(user);
       } catch (error) {
@@ -693,7 +702,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
             sessionToken,
             ...(options.deviceFingerprint ? { deviceFingerprint: options.deviceFingerprint } : {}),
           },
-          { cache: false, retry: false }
+          // Body-authenticated device-flow claim (no bearer) — skip the preflight.
+          { cache: false, retry: false, skipAuth: true }
         );
 
         this.setTokens(res.accessToken);
@@ -802,7 +812,10 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           '/auth/session/create',
           { sessionToken, expiresAt, clientId: params.clientId },
-          { cache: false }
+          // Public/pre-session (no bearer): skip the preflight so a stale
+          // near-expiry token cannot re-enter refreshAccessToken while the
+          // refresh handler is already in flight (self-await hang).
+          { cache: false, skipAuth: true },
         );
 
         return {
@@ -832,7 +845,10 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'GET',
           `/auth/session/status/${encodeURIComponent(sessionToken)}`,
           undefined,
-          { cache: false, retry: false }
+          // Public/pre-session (no bearer): a preflight here is wrong per se and,
+          // if ever reached while a refresh is pending, would re-enter
+          // refreshAccessToken and await the very promise it runs inside.
+          { cache: false, retry: false, skipAuth: true }
         );
       } catch (error) {
         throw this.handleError(error);
@@ -855,7 +871,9 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'GET',
           `/auth/session/approve-info/${encodeURIComponent(authorizeCode)}`,
           undefined,
-          { cache: false }
+          // Public (no auth required) — skip the bearer preflight (avoids the
+          // pre-session self-await class).
+          { cache: false, skipAuth: true }
         );
         return {
           application: raw.application,
@@ -913,7 +931,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
             ...(params.deviceName ? { deviceName: params.deviceName } : {}),
             ...(params.deviceFingerprint ? { deviceFingerprint: params.deviceFingerprint } : {}),
           },
-          { cache: false }
+          // Key-signed, cookieless (no bearer) — skip the preflight.
+          { cache: false, skipAuth: true }
         );
       } catch (error) {
         throw this.handleError(error);
@@ -932,7 +951,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           `/auth/session/deny/${encodeURIComponent(authorizeCode)}`,
           undefined,
-          { cache: false }
+          // Public (no auth required) — skip the bearer preflight.
+          { cache: false, skipAuth: true }
         );
       } catch (error) {
         throw this.handleError(error);
@@ -1065,7 +1085,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
      */
     async checkUsernameAvailability(username: string): Promise<{ available: boolean; message: string }> {
       try {
-        return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false });
+        // Public availability lookup (pre-session) — skip the bearer preflight.
+        return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false, skipAuth: true });
       } catch (error) {
         throw this.handleError(error);
       }
@@ -1076,7 +1097,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
      */
     async checkEmailAvailability(email: string): Promise<{ available: boolean; message: string }> {
       try {
-        return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false });
+        // Public availability lookup (pre-session) — skip the bearer preflight.
+        return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false, skipAuth: true });
       } catch (error) {
         throw this.handleError(error);
       }
@@ -1099,7 +1121,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           '/auth/webauthn/register/options',
           { ...(username !== undefined ? { username } : {}) },
-          { cache: false },
+          { cache: false, ...(username !== undefined ? { skipAuth: true } : {}) },
         );
       } catch (error) {
         throw this.handleError(error);
@@ -1133,7 +1155,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           '/auth/webauthn/register/verify',
           { response, ...envelope },
-          { cache: false },
+          { cache: false, ...(envelope.username !== undefined ? { skipAuth: true } : {}) },
         );
         if (res && typeof res === 'object') {
           const record = res as Record<string, unknown>;
@@ -1176,7 +1198,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           '/auth/webauthn/login/options',
           { ...(username !== undefined ? { username } : {}) },
-          { cache: false },
+          // Pre-session login ceremony — skip the bearer preflight.
+          { cache: false, skipAuth: true },
         );
       } catch (error) {
         throw this.handleError(error);
@@ -1200,7 +1223,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           '/auth/webauthn/login/verify',
           { response, ...envelope },
-          { cache: false },
+          // Pre-session login ceremony — skip the bearer preflight.
+          { cache: false, skipAuth: true },
         );
         const parsed = safeParseContract(loginResultSchema, res);
         if (!parsed) {
@@ -1233,7 +1257,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           clientId: params.clientId,
           redirectUri: params.redirectUri,
           codeVerifier: params.codeVerifier,
-        }, { cache: false });
+        }, { cache: false, skipAuth: true });
         const payload =
           (res as { data?: Record<string, unknown> }).data ??
           (res as Record<string, unknown>);

package/src/mixins/OxyServices.connectedApps.ts

@@ -105,7 +105,12 @@ export function OxyServicesConnectedAppsMixin<T extends typeof OxyServicesBase>(
           'GET',
           `/auth/oauth/client/${encodeURIComponent(clientId)}`,
           undefined,
-          { cache: true, cacheTTL: CACHE_TIMES.MEDIUM },
+          {
+            cache: true,
+            cacheTTL: CACHE_TIMES.MEDIUM,
+            // Public client metadata (pre-session consent UI) — skip the bearer preflight.
+            skipAuth: true,
+          },
         );
         return res.application;
       } catch (error) {

package/src/mixins/OxyServices.deviceBoot.ts

@@ -58,7 +58,10 @@ export function OxyServicesDeviceBootMixin<T extends typeof OxyServicesBase>(Bas
           'POST',
           '/session/device/token',
           { deviceId, deviceSecret },
-          { cache: false, skipAuth: true, retry: false },
+          // `bypassQueue`: this mint is the control-plane call the auth lane
+          // depends on — it must run even when every RequestQueue slot is parked
+          // awaiting it, or the whole client deadlocks. See RequestOptions.bypassQueue.
+          { cache: false, skipAuth: true, retry: false, bypassQueue: true },
         );
         const parsed = safeParseContract(deviceTokenMintResponseSchema, res);
         if (!parsed) {
@@ -99,7 +102,9 @@ export function OxyServicesDeviceBootMixin<T extends typeof OxyServicesBase>(Bas
           'POST',
           '/session/device/redeem-ticket',
           { ticket, returnOrigin },
-          { cache: false, skipAuth: true },
+          // Public device-hub sync mint (bearer-less). Same control-plane class as
+          // the device-secret mint — bypassQueue so it never waits for a slot.
+          { cache: false, skipAuth: true, bypassQueue: true },
         );
         const parsed = safeParseContract(deviceHubTicketRedeemResponseSchema, res);
         if (!parsed) {

package/src/mixins/OxyServices.identityBackup.ts

@@ -218,6 +218,19 @@ export function OxyServicesIdentityBackupMixin<T extends typeof OxyServicesBase>
         );
         const payload = JSON.parse(new TextDecoder().decode(plaintext)) as BackupPayload;
 
+        if (!payload.privateKey || !payload.publicKey) {
+          throw new Error('Backup payload is missing key material');
+        }
+
+        const derivedFromPhrase = await RecoveryPhraseService.derivePublicKeyFromPhrase(phrase);
+        const derivedFromPrivate = KeyManager.derivePublicKey(payload.privateKey);
+        const phrasePk = derivedFromPhrase.toLowerCase();
+        const payloadPk = payload.publicKey.toLowerCase();
+        const privatePk = derivedFromPrivate.toLowerCase();
+        if (phrasePk !== payloadPk || privatePk !== payloadPk) {
+          throw new Error('Backup payload does not match the recovery phrase');
+        }
+
         // Persist the recovered key. Native-only; refuses to clobber a different
         // identity unless overwrite — the IdentityAlreadyExistsError propagates.
         return await KeyManager.importKeyPair(payload.privateKey, {

package/src/mixins/OxyServices.user.ts

@@ -186,6 +186,8 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
       return await this.makeRequest('GET', `/auth/lookup/${encodeURIComponent(username)}`, undefined, {
         cache: true,
         cacheTTL: 60 * 1000, // 1 minute cache
+        // Public login-flow lookup (pre-session) — skip the bearer preflight.
+        skipAuth: true,
       });
     }
 
@@ -606,6 +608,10 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
         const result = await this.makeRequest<PrivacySettings>('PATCH', `/privacy/${id}/privacy`, settings, {
           cache: false,
         });
+        this.clearCacheByPrefix('GET:/session/user/');
+        this.clearCacheByPrefix('GET:/users/me');
+        this.clearCacheByPrefix('GET:/profiles/username/');
+        this.clearCacheEntry(`GET:/users/${id}`);
         this.clearCacheEntry(`GET:/privacy/${id}/privacy`);
         return result;
       } catch (error) {

package/src/mixins/__tests__/OxyServices.deviceBoot.test.ts

@@ -31,17 +31,19 @@ describe('OxyServices.deviceBoot', () => {
       },
     };
 
-    it('POSTs deviceId + deviceSecret with skipAuth + retry:false (no bearer, no cache, single attempt) and returns the validated mint', async () => {
+    it('POSTs deviceId + deviceSecret with skipAuth + retry:false + bypassQueue (no bearer, no cache, single attempt, never queued) and returns the validated mint', async () => {
       makeRequest.mockResolvedValueOnce(MINT);
       const result = await oxy.mintFromDeviceSecret('dev-1', 'ds-current-secret');
       expect(result).toEqual(MINT);
       // `retry: false` — the scheduler/401 lane own backoff; HttpService's inner
       // retry here would only multiply cold-boot latency on a slow network.
+      // `bypassQueue: true` — the mint is the control-plane call the auth lane
+      // depends on; it must never wait for a RequestQueue slot (deadlock).
       expect(makeRequest).toHaveBeenCalledWith(
         'POST',
         '/session/device/token',
         { deviceId: 'dev-1', deviceSecret: 'ds-current-secret' },
-        { cache: false, skipAuth: true, retry: false },
+        { cache: false, skipAuth: true, retry: false, bypassQueue: true },
       );
     });
 

package/src/mixins/__tests__/commonsSignIn.test.ts

@@ -57,7 +57,7 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
         'POST',
         '/auth/session/create',
         { sessionToken: 'secret-session-token', expiresAt: 1700000300000, clientId: 'oxy_dk_test' },
-        expect.objectContaining({ cache: false }),
+        expect.objectContaining({ cache: false, skipAuth: true }),
       );
       // ...and the handle carries the SECRET token + the server's public code/payload.
       expect(handle).toEqual({
@@ -251,7 +251,7 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
         'POST',
         '/auth/challenge',
         { publicKey: 'pub-x' },
-        { cache: false },
+        { cache: false, skipAuth: true },
       );
 
       await oxy.requestChallenge('pub-x', { retry: false });
@@ -259,7 +259,7 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
         'POST',
         '/auth/challenge',
         { publicKey: 'pub-x' },
-        { cache: false, retry: false },
+        { cache: false, skipAuth: true, retry: false },
       );
     });
 
@@ -282,7 +282,7 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
           deviceName: 'dev',
           deviceFingerprint: 'fp',
         },
-        { cache: false, retry: false, timeout: 9000 },
+        { cache: false, skipAuth: true, retry: false, timeout: 9000 },
       );
     });
   });

package/src/mixins/__tests__/identityBackup.test.ts

@@ -15,6 +15,7 @@
 import { OxyServices } from '../../OxyServices';
 import { KeyManager, IdentityAlreadyExistsError } from '../../crypto/keyManager';
 import { RecoveryPhraseService } from '../../crypto/recoveryPhrase';
+import { encryptAead, decryptAead } from '../../crypto/aead';
 import type { EncryptedBackupEnvelope, BackupUploadRequest } from '@oxyhq/contracts';
 
 const FIXED_PHRASE =
@@ -192,6 +193,62 @@ describe('encrypted identity backup mixin', () => {
     await expect(oxy.restoreFromEncryptedBackup(FIXED_PHRASE)).rejects.toThrow();
   });
 
+  it('rejects when decrypted payload publicKey does not match the recovery phrase', async () => {
+    fetchMock.mockResolvedValueOnce(plainResponse({ exists: true }));
+    await oxy.createEncryptedBackup(FIXED_PHRASE);
+    const uploaded = uploadBodyFromCall(0);
+
+    const { backupKey } = await RecoveryPhraseService.deriveBackupMaterial(FIXED_PHRASE);
+    const aad = new TextEncoder().encode(
+      JSON.stringify({ version: uploaded.version, publicKeyHint: uploaded.publicKeyHint }),
+    );
+    const fromHex = (hex: string): Uint8Array => {
+      const out = new Uint8Array(hex.length / 2);
+      for (let i = 0; i < out.length; i += 1) {
+        out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+      }
+      return out;
+    };
+    const toHex = (bytes: Uint8Array): string =>
+      Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+
+    const plaintext = decryptAead(
+      backupKey,
+      fromHex(uploaded.nonce),
+      fromHex(uploaded.ciphertext),
+      aad,
+    );
+    const payload = JSON.parse(new TextDecoder().decode(plaintext)) as {
+      privateKey: string;
+      publicKey: string;
+      createdAt: string;
+    };
+    payload.publicKey = `${payload.publicKey.slice(0, -1)}0`;
+
+    const { nonce, ciphertext } = encryptAead(
+      backupKey,
+      new TextEncoder().encode(JSON.stringify(payload)),
+      aad,
+    );
+    const tampered: EncryptedBackupEnvelope = {
+      version: uploaded.version,
+      algorithm: uploaded.algorithm,
+      kdfInfo: uploaded.kdfInfo,
+      nonce: toHex(nonce),
+      ciphertext: toHex(ciphertext),
+      publicKeyHint: uploaded.publicKeyHint,
+      createdAt: uploaded.createdAt,
+    };
+
+    const importSpy = jest.spyOn(KeyManager, 'importKeyPair').mockResolvedValue('x');
+    fetchMock.mockResolvedValueOnce(plainResponse(tampered));
+
+    await expect(oxy.restoreFromEncryptedBackup(FIXED_PHRASE)).rejects.toThrow(
+      /does not match the recovery phrase/,
+    );
+    expect(importSpy).not.toHaveBeenCalled();
+  });
+
   it('propagates IdentityAlreadyExistsError UNCHANGED (so the caller can offer overwrite)', async () => {
     fetchMock.mockResolvedValueOnce(plainResponse({ exists: true }));
     await oxy.createEncryptedBackup(FIXED_PHRASE);

package/src/mixins/__tests__/preSessionSkipAuth.test.ts

@@ -0,0 +1,152 @@
+/**
+ * Regression: every purely pre-session public SDK endpoint must pass `skipAuth`
+ * so a pending refresh handler cannot self-await (see httpServiceAuthSelfAwait).
+ */
+import { OxyServices } from '../../OxyServices';
+import { SignatureService } from '../../crypto/signatureService';
+
+describe('pre-session public endpoints use skipAuth', () => {
+  let oxy: OxyServices;
+  let makeRequest: jest.SpyInstance;
+
+  beforeEach(() => {
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    makeRequest = jest.spyOn(oxy, 'makeRequest').mockResolvedValue({} as never);
+  });
+
+  afterEach(() => jest.restoreAllMocks());
+
+  it('lookupUsername skips auth preflight', async () => {
+    await oxy.lookupUsername('alice');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'GET',
+      '/auth/lookup/alice',
+      undefined,
+      expect.objectContaining({ skipAuth: true }),
+    );
+  });
+
+  it('getPublicApplication skips auth preflight', async () => {
+    makeRequest.mockResolvedValueOnce({ application: { id: 'app-1', name: 'App' } });
+    await oxy.getPublicApplication('oxy_dk_test');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'GET',
+      '/auth/oauth/client/oxy_dk_test',
+      undefined,
+      expect.objectContaining({ skipAuth: true }),
+    );
+  });
+
+  it('claimSessionByToken skips auth preflight', async () => {
+    makeRequest.mockResolvedValueOnce({
+      accessToken: 'tok',
+      sessionId: 's1',
+      deviceId: 'd1',
+      expiresAt: '2030-01-01T00:00:00.000Z',
+      user: { id: 'u1', username: 'u' },
+    });
+    await oxy.claimSessionByToken('secret-session-token');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/session/claim',
+      { sessionToken: 'secret-session-token' },
+      expect.objectContaining({ skipAuth: true, retry: false }),
+    );
+  });
+
+  it('startCommonsSignIn skips auth preflight', async () => {
+    jest.spyOn(Date, 'now').mockReturnValue(1700000000000);
+    const generateChallenge = jest
+      .spyOn(SignatureService, 'generateChallenge')
+      .mockResolvedValue('secret-session-token');
+    makeRequest.mockResolvedValueOnce({
+      authorizeCode: 'code-1',
+      qrPayload: 'oxycommons://approve?v=1&code=code-1',
+      status: 'pending',
+    });
+    await oxy.startCommonsSignIn({ clientId: 'oxy_dk_test' });
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/session/create',
+      expect.objectContaining({ sessionToken: 'secret-session-token', clientId: 'oxy_dk_test' }),
+      expect.objectContaining({ cache: false, skipAuth: true }),
+    );
+    generateChallenge.mockRestore();
+  });
+
+  it('getUserByPublicKey skips auth preflight', async () => {
+    makeRequest.mockResolvedValueOnce({ id: 'u1', username: 'alice' });
+    await oxy.getUserByPublicKey('abc123');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'GET',
+      '/auth/user/abc123',
+      undefined,
+      expect.objectContaining({ skipAuth: true }),
+    );
+  });
+
+  it('webauthnRegisterOptions skips auth preflight on signup (username provided)', async () => {
+    await oxy.webauthnRegisterOptions('alice');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/webauthn/register/options',
+      { username: 'alice' },
+      expect.objectContaining({ skipAuth: true }),
+    );
+  });
+
+  it('webauthnRegisterVerify skips auth preflight on signup (username in envelope)', async () => {
+    makeRequest.mockResolvedValueOnce({
+      sessionId: 's1',
+      deviceId: 'd1',
+      accessToken: 'tok',
+      expiresAt: '2030-01-01T00:00:00.000Z',
+      deviceSecret: 'ds',
+      user: { id: 'u1', username: 'alice' },
+    });
+    await oxy.webauthnRegisterVerify({ id: 'cred' }, { username: 'alice' });
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/webauthn/register/verify',
+      expect.objectContaining({ username: 'alice' }),
+      expect.objectContaining({ skipAuth: true }),
+    );
+  });
+
+  it('getServiceToken skips auth preflight', async () => {
+    makeRequest.mockResolvedValueOnce({ token: 'svc-tok', expiresIn: 3600 });
+    await oxy.getServiceToken('oxy_dk_svc', 'secret-value');
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/service-token',
+      { apiKey: 'oxy_dk_svc', apiSecret: 'secret-value' },
+      expect.objectContaining({ skipAuth: true, cache: false, retry: false }),
+    );
+  });
+
+  it('exchangeOAuthCode skips auth preflight', async () => {
+    makeRequest.mockResolvedValueOnce({
+      sessionId: 's1',
+      deviceId: 'd1',
+      accessToken: 'tok',
+      user: { id: 'u1' },
+    });
+    await oxy.exchangeOAuthCode({
+      code: 'code-1',
+      clientId: 'oxy_dk_test',
+      redirectUri: 'https://app.example/callback',
+      codeVerifier: 'verifier',
+    });
+    expect(makeRequest).toHaveBeenCalledWith(
+      'POST',
+      '/auth/oauth/token',
+      {
+        code: 'code-1',
+        clientId: 'oxy_dk_test',
+        redirectUri: 'https://app.example/callback',
+        codeVerifier: 'verifier',
+      },
+      expect.objectContaining({ skipAuth: true }),
+    );
+  });
+});

package/src/mixins/__tests__/privacyCacheInvalidation.test.ts

@@ -129,6 +129,7 @@ describe('privacy cache invalidation', () => {
 
   it('invalidates the exact logical keys on block/restrict/settings writes', async () => {
     const clearSpy = jest.spyOn(oxy, 'clearCacheEntry');
+    const clearPrefixSpy = jest.spyOn(oxy, 'clearCacheByPrefix');
 
     fetchMock.mockResolvedValueOnce(jsonResponse({ message: 'ok' }));
     await oxy.blockUser('u1');
@@ -141,7 +142,12 @@ describe('privacy cache invalidation', () => {
     fetchMock.mockResolvedValueOnce(jsonResponse({ isPrivateAccount: true }));
     await oxy.updatePrivacySettings({ isPrivateAccount: true }, 'me');
     expect(clearSpy).toHaveBeenCalledWith('GET:/privacy/me/privacy');
+    expect(clearSpy).toHaveBeenCalledWith('GET:/users/me');
+    expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/session/user/');
+    expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
+    expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/profiles/username/');
 
     clearSpy.mockRestore();
+    clearPrefixSpy.mockRestore();
   });
 });

package/src/mixins/__tests__/webauthnAuth.test.ts

@@ -48,7 +48,7 @@ describe('webauthnRegisterOptions', () => {
       'POST',
       '/auth/webauthn/register/options',
       { username: 'alice' },
-      { cache: false },
+      { cache: false, skipAuth: true },
     );
   });
 
@@ -83,7 +83,7 @@ describe('webauthnLoginOptions', () => {
       'POST',
       '/auth/webauthn/login/options',
       { username: 'alice' },
-      { cache: false },
+      { cache: false, skipAuth: true },
     );
   });
 
@@ -94,7 +94,7 @@ describe('webauthnLoginOptions', () => {
       'POST',
       '/auth/webauthn/login/options',
       {},
-      { cache: false },
+      { cache: false, skipAuth: true },
     );
   });
 });
@@ -129,7 +129,7 @@ describe('webauthnRegisterVerify', () => {
       'POST',
       '/auth/webauthn/register/verify',
       { response: CREATE_RESPONSE, username: 'alice', deviceName: 'Phone', deviceFingerprint: 'fp-1' },
-      { cache: false },
+      { cache: false, skipAuth: true },
     );
   });
 
@@ -183,7 +183,7 @@ describe('webauthnLoginVerify', () => {
       'POST',
       '/auth/webauthn/login/verify',
       { response: GET_RESPONSE, deviceName: 'Phone', deviceFingerprint: 'fp-1', deviceId: 'dev-persisted' },
-      { cache: false },
+      { cache: false, skipAuth: true },
     );
   });
 
@@ -194,7 +194,7 @@ describe('webauthnLoginVerify', () => {
       'POST',
       '/auth/webauthn/login/verify',
       { response: GET_RESPONSE },
-      { cache: false },
+      { cache: false, skipAuth: true },
     );
   });