@oxyhq/core 12.9.0 → 12.10.1

package/src/session/__tests__/accountDialogController.test.ts

@@ -163,7 +163,7 @@ describe('AccountDialogController — initial + views', () => {
     expect(snap.commonsAvailability).toBe('unknown');
   });
 
-  it('setView / add / close move between views and notify subscribers', () => {
+  it('setView / add move between views and notify subscribers', () => {
     const { controller } = makeHarness();
     const seen: string[] = [];
     controller.subscribe((s) => seen.push(s.view));
@@ -172,7 +172,7 @@ describe('AccountDialogController — initial + views', () => {
     expect(controller.getSnapshot().view).toBe('add');
     controller.setView('signin');
     expect(controller.getSnapshot().view).toBe('signin');
-    controller.close();
+    controller.setView('accounts');
     expect(controller.getSnapshot().view).toBe('accounts');
 
     expect(seen).toEqual(['add', 'signin', 'accounts']);
@@ -185,7 +185,7 @@ describe('AccountDialogController — initial + views', () => {
 
     controller.startSignup();
     expect(controller.getSnapshot().view).toBe('signup');
-    controller.close();
+    controller.setView('accounts');
     expect(controller.getSnapshot().view).toBe('accounts');
 
     expect(seen).toEqual(['signup', 'accounts']);

package/src/session/accountDialogController.ts

@@ -35,6 +35,13 @@
  * password, social login, and 2FA were removed ecosystem-wide. Account
  * creation (`signup` view) is the same two identity backends: a passkey
  * ceremony on web, or a Commons-created identity.
+ *
+ * The controller owns NO surface PRESENTATION: whether the account dialog is
+ * mounted, visible, or dismissed is the job of the shared surface stack
+ * (`@oxyhq/services` presents the `AccountDialog` surface into `@oxyhq/bloom`'s
+ * stack). This is a headless state machine only — it exposes `setView` /
+ * `add` / `startSignup` (the view axis) and `cancelSignIn` (device-flow
+ * teardown), never an `open` / `close` / `visible`.
  */
 
 import type { OxyServices } from '../OxyServices';
@@ -462,12 +469,6 @@ export class AccountDialogController {
     this.emit();
   }
 
-  /** Return to the account list and cancel any in-flight sign-in flow. */
-  close(): void {
-    this.cancelSignIn();
-    this.setView('accounts');
-  }
-
   /** Switch to the "add account" view (the sign-in entry chooser). */
   add(): void {
     this.setView('add');

package/src/utils/__tests__/commonsApproval.test.ts

@@ -0,0 +1,60 @@
+import {
+  getCommonsApprovalBlockingReason,
+  parseCommonsApprovalExpiresAt,
+} from '../commonsApproval';
+
+describe('commonsApproval validation', () => {
+  const application = {
+    id: 'app1',
+    name: 'Mention',
+    type: 'first_party' as const,
+    isOfficial: true,
+    isInternal: false,
+    scopes: ['profile'],
+  };
+
+  it('blocks when the application is missing', () => {
+    expect(
+      getCommonsApprovalBlockingReason({
+        application: null,
+        status: 'pending',
+        expiresAt: Date.now() + 60_000,
+      }),
+    ).toMatch(/could not be resolved/i);
+  });
+
+  it('blocks non-pending sessions', () => {
+    expect(
+      getCommonsApprovalBlockingReason({
+        application,
+        status: 'expired',
+        expiresAt: Date.now() + 60_000,
+      }),
+    ).toMatch(/invalid, already used, or expired/i);
+  });
+
+  it('blocks expired pending sessions (ISO expiresAt)', () => {
+    expect(
+      getCommonsApprovalBlockingReason({
+        application,
+        status: 'pending',
+        expiresAt: new Date(Date.now() - 60_000).toISOString(),
+      }),
+    ).toMatch(/expired/i);
+  });
+
+  it('allows a pending, unexpired session', () => {
+    expect(
+      getCommonsApprovalBlockingReason({
+        application,
+        status: 'pending',
+        expiresAt: Date.now() + 60_000,
+      }),
+    ).toBeNull();
+  });
+
+  it('parses ISO expiresAt strings', () => {
+    const iso = '2026-07-19T12:00:00.000Z';
+    expect(parseCommonsApprovalExpiresAt(iso)).toBe(Date.parse(iso));
+  });
+});

package/src/utils/commonsApproval.ts

@@ -0,0 +1,39 @@
+import type { PublicApplication } from '../mixins/OxyServices.connectedApps';
+
+export interface CommonsApprovalValidationInput {
+  application: PublicApplication | null;
+  status: string;
+  expiresAt: number | string;
+}
+
+/**
+ * Returns a user-facing blocking reason when an approval payload must not be
+ * shown as actionable, or `null` when the request is still pending and valid.
+ */
+export function getCommonsApprovalBlockingReason(
+  info: CommonsApprovalValidationInput,
+): string | null {
+  if (!info.application?.id) {
+    return 'The requesting application could not be resolved.';
+  }
+  if (info.status !== 'pending') {
+    return 'This sign-in request is invalid, already used, or expired.';
+  }
+  const expiresAtMs = parseCommonsApprovalExpiresAt(info.expiresAt);
+  if (expiresAtMs !== null && expiresAtMs < Date.now()) {
+    return 'This sign-in request has expired. Ask for a new QR code.';
+  }
+  return null;
+}
+
+/** Normalize API `expiresAt` (number or ISO string) to epoch ms. */
+export function parseCommonsApprovalExpiresAt(
+  expiresAt: CommonsApprovalValidationInput['expiresAt'],
+): number | null {
+  if (typeof expiresAt === 'number' && Number.isFinite(expiresAt)) return expiresAt;
+  if (typeof expiresAt === 'string') {
+    const ms = Date.parse(expiresAt);
+    return Number.isFinite(ms) ? ms : null;
+  }
+  return null;
+}