@oxyhq/core 20.0.0 → 20.1.0

package/dist/esm/mixins/OxyServices.utility.js

@@ -133,18 +133,41 @@ export function OxyServicesUtilityMixin(Base) {
          * Uses server-side session validation for security (not just JWT decode).
          *
          * **Design note — jwtDecode vs jwt.verify:**
-         * This middleware intentionally uses `jwtDecode()` (decode-only, no signature
-         * verification) for user tokens. This is by design, NOT a security gap:
-         * - Third-party apps using `oxy.auth()` don't have the Oxy JWT secret
-         * - Security comes from API-based session validation (`validateSession()`)
-         *   which checks the session server-side on every request
-         * - Service tokens (type: 'service') DO use cryptographic HMAC verification
-         *   via the `jwtSecret` option, since they are stateless. Service tokens
-         *   are additionally checked for `aud`, `iss`, and `type` claims to prevent
+         * This middleware uses `jwtDecode()` (decode-only, NO signature check) for
+         * user tokens, because third-party apps mounting `oxy.auth()` do not hold
+         * the Oxy signing secret. **Every claim in a user token is therefore
+         * attacker-controlled and proves nothing on its own.** The identity comes
+         * from somewhere else entirely:
+         * - A user token MUST carry a `sessionId`. That session is validated
+         *   server-side on every request via `validateSession()`, and the user id
+         *   is read off the VALIDATED SESSION — never off the token. A token whose
+         *   `userId` claim disagrees with the session is refused
+         *   (`SESSION_USER_MISMATCH`); a token with no `sessionId` at all is
+         *   refused outright (`SESSION_REQUIRED`). There is no local-claims path.
+         * - Service tokens (type: 'service') ARE stateless, so they use
+         *   cryptographic HMAC verification via the `jwtSecret` option, and are
+         *   additionally checked for `aud`, `iss`, and `type` claims to prevent
          *   cross-token-type confusion attacks.
          * - The backend's own `authMiddleware` uses `jwt.verify()` because it has
          *   direct access to `SERVICE_TOKEN_SECRET` / `ACCESS_TOKEN_SECRET`.
          *
+         * **Why session-less user tokens are refused rather than trusted:**
+         * every user access token the Oxy API issues carries a `sessionId` (see
+         * `packages/api/src/utils/sessionUtils.ts`, `generateSessionTokens` — the
+         * only mint site for user tokens, including the OAuth code exchange). So
+         * refusing session-less user tokens costs nothing legitimate, while
+         * accepting them let anyone authenticate as anyone by hand-rolling a JWT
+         * with a `userId` claim and a garbage signature.
+         *
+         * **Why the claimed user id is cross-checked against the session:**
+         * `GET /session/validate/:sessionId` is UNAUTHENTICATED and does not bind
+         * the bearer token — it returns whoever owns the session id it was handed.
+         * Trusting the token's `userId` claim after a successful validation would
+         * therefore let a caller holding ANY live session id (their own, for
+         * instance) pair it with a forged `userId` and be trusted as that user.
+         * `authSocket()` has always cross-checked this; the HTTP middleware now
+         * does too.
+         *
          * **Service-token delegation (X-Oxy-User-Id):**
          * When a service token is accompanied by `X-Oxy-User-Id`, the SDK calls
          * `verifyServiceActingAs(appId, userId)` to confirm an explicit delegation
@@ -407,8 +430,10 @@ export function OxyServicesUtilityMixin(Base) {
                         }
                         return next();
                     }
-                    const userId = decoded.userId || decoded.id;
-                    if (!userId) {
+                    // The CLAIMED user id. Never trusted as an identity — it is only ever
+                    // compared against the id the validated session resolves to.
+                    const claimedUserId = readStringClaim(decoded.userId) ?? readStringClaim(decoded.id);
+                    if (!claimedUserId) {
                         if (optional) {
                             req.userId = null;
                             req.user = null;
@@ -442,111 +467,129 @@ export function OxyServicesUtilityMixin(Base) {
                             return onError(error);
                         return res.status(401).json(error);
                     }
-                    // Validate token against the Oxy API for session-based verification
-                    // This ensures the session hasn't been revoked server-side
-                    if (decoded.sessionId) {
-                        try {
-                            const validationResult = await oxyInstance.validateSession(decoded.sessionId, {
-                                useHeaderValidation: true,
-                            });
-                            if (!validationResult || !validationResult.valid) {
-                                if (optional) {
-                                    req.userId = null;
-                                    req.user = null;
-                                    return next();
-                                }
-                                const error = {
-                                    error: 'INVALID_SESSION',
-                                    message: 'Session invalid or expired',
-                                    code: 'INVALID_SESSION',
-                                    status: 401
-                                };
-                                if (onError)
-                                    return onError(error);
-                                return res.status(401).json(error);
-                            }
-                            // Use validated user data from session validation (already has full user)
-                            req.userId = userId;
-                            req.accessToken = token;
-                            req.sessionId = decoded.sessionId;
-                            if (loadUser && validationResult.user) {
-                                // Session validation already returns full user data
-                                req.user = validationResult.user;
-                            }
-                            else {
-                                req.user = { id: userId };
-                            }
-                            if (debug) {
-                                logger.debug(`[oxy.auth] OK user=${userId} session=${decoded.sessionId}`, {
-                                    component: 'auth',
-                                    method: 'auth',
-                                });
-                            }
+                    // A server-validated session is MANDATORY for a user token. The JWT
+                    // signature is not verified on this path, so a bare decoded token
+                    // proves nothing: without the session round-trip a forged token could
+                    // claim any user id. Mirrors `authSocket()`, which has always
+                    // required this.
+                    const sessionId = readStringClaim(decoded.sessionId);
+                    if (!sessionId) {
+                        if (optional) {
+                            req.userId = null;
+                            req.user = null;
                             return next();
                         }
-                        catch (validationError) {
-                            if (debug) {
-                                logger.debug('[oxy.auth] Session validation failed', {
-                                    component: 'auth',
-                                    method: 'auth',
-                                }, validationError);
-                            }
+                        const error = {
+                            error: 'SESSION_REQUIRED',
+                            message: 'Access token is not bound to a session',
+                            code: 'SESSION_REQUIRED',
+                            status: 401
+                        };
+                        if (onError)
+                            return onError(error);
+                        return res.status(401).json(error);
+                    }
+                    // Validate the token against the Oxy API. This proves the session is
+                    // real and unrevoked, AND yields the identity it belongs to.
+                    try {
+                        const validationResult = await oxyInstance.validateSession(sessionId, {
+                            useHeaderValidation: true,
+                        });
+                        if (!validationResult || !validationResult.valid || !validationResult.user) {
                             if (optional) {
                                 req.userId = null;
                                 req.user = null;
                                 return next();
                             }
                             const error = {
-                                error: 'SESSION_VALIDATION_ERROR',
-                                message: 'Session validation failed',
-                                code: 'SESSION_VALIDATION_ERROR',
+                                error: 'INVALID_SESSION',
+                                message: 'Session invalid or expired',
+                                code: 'INVALID_SESSION',
                                 status: 401
                             };
                             if (onError)
                                 return onError(error);
                             return res.status(401).json(error);
                         }
-                    }
-                    // Non-session token: use local validation only (userId from JWT)
-                    req.userId = userId;
-                    req.accessToken = token;
-                    req.user = { id: userId };
-                    // If loadUser requested with non-session token, fetch from API
-                    if (loadUser) {
-                        try {
-                            // Temporarily set token to make the API call
-                            const prevToken = oxyInstance.getAccessToken();
-                            oxyInstance.setTokens(token);
-                            const fullUser = await oxyInstance.getCurrentUser();
-                            // Restore previous token
-                            if (prevToken) {
-                                oxyInstance.setTokens(prevToken);
-                            }
-                            else {
-                                oxyInstance.clearTokens();
+                        // The session — not the token — is the source of truth for identity.
+                        const validatedUserId = getUserIdentityId(validationResult.user);
+                        if (!validatedUserId) {
+                            if (optional) {
+                                req.userId = null;
+                                req.user = null;
+                                return next();
                             }
-                            if (fullUser) {
-                                req.user = fullUser;
+                            const error = {
+                                error: 'INVALID_SESSION',
+                                message: 'Session did not resolve to a usable identity',
+                                code: 'INVALID_SESSION',
+                                status: 401
+                            };
+                            if (onError)
+                                return onError(error);
+                            return res.status(401).json(error);
+                        }
+                        if (validatedUserId !== claimedUserId) {
+                            // Session-id/claim confusion: the caller presented a live session
+                            // that belongs to somebody else. Worth a warning — it has no
+                            // benign cause. Ids only; never the token or the payload.
+                            logger.warn('[oxy.auth] Token rejected — claimed user does not own the session', {
+                                component: 'auth',
+                                method: 'auth',
+                                claimedUserId,
+                                validatedUserId,
+                            });
+                            if (optional) {
+                                req.userId = null;
+                                req.user = null;
+                                return next();
                             }
+                            const error = {
+                                error: 'SESSION_USER_MISMATCH',
+                                message: 'Token user does not match the session',
+                                code: 'SESSION_USER_MISMATCH',
+                                status: 401
+                            };
+                            if (onError)
+                                return onError(error);
+                            return res.status(401).json(error);
                         }
-                        catch (loadUserError) {
-                            // Loading the full user is best-effort here; the basic { id }
-                            // object is already attached. Log so misconfigured deployments
-                            // can be diagnosed instead of silently failing.
-                            logger.warn('[oxy.auth] loadUser fallback — could not fetch full profile', {
+                        req.userId = validatedUserId;
+                        req.accessToken = token;
+                        req.sessionId = sessionId;
+                        // Session validation already returned the full user, so `loadUser`
+                        // costs no extra round-trip.
+                        req.user = loadUser ? validationResult.user : { id: validatedUserId };
+                        if (debug) {
+                            logger.debug(`[oxy.auth] OK user=${validatedUserId} session=${sessionId}`, {
                                 component: 'auth',
-                                method: 'auth.loadUser',
-                                userId,
-                            }, loadUserError);
+                                method: 'auth',
+                            });
                         }
+                        return next();
                     }
-                    if (debug) {
-                        logger.debug(`[oxy.auth] OK user=${userId} (no session)`, {
-                            component: 'auth',
-                            method: 'auth',
-                        });
+                    catch (validationError) {
+                        if (debug) {
+                            logger.debug('[oxy.auth] Session validation failed', {
+                                component: 'auth',
+                                method: 'auth',
+                            }, validationError);
+                        }
+                        if (optional) {
+                            req.userId = null;
+                            req.user = null;
+                            return next();
+                        }
+                        const error = {
+                            error: 'SESSION_VALIDATION_ERROR',
+                            message: 'Session validation failed',
+                            code: 'SESSION_VALIDATION_ERROR',
+                            status: 401
+                        };
+                        if (onError)
+                            return onError(error);
+                        return res.status(401).json(error);
                     }
-                    next();
                 }
                 catch (error) {
                     const handled = oxyInstance.handleError(error);
@@ -615,7 +658,7 @@ export function OxyServicesUtilityMixin(Base) {
                         }
                         return next(new Error('Invalid token'));
                     }
-                    const claimedUserId = decoded.userId || decoded.id;
+                    const claimedUserId = readStringClaim(decoded.userId) ?? readStringClaim(decoded.id);
                     if (!claimedUserId) {
                         return next(new Error('Invalid token payload'));
                     }
@@ -626,12 +669,13 @@ export function OxyServicesUtilityMixin(Base) {
                     // A server-validated session is mandatory. A bare decoded JWT proves
                     // nothing — the signature is not verified here, so without a session
                     // round-trip a forged token could claim any user id.
-                    if (!decoded.sessionId) {
+                    const sessionId = readStringClaim(decoded.sessionId);
+                    if (!sessionId) {
                         return next(new Error('Session required'));
                     }
                     let userId = claimedUserId;
                     try {
-                        const result = await oxyInstance.validateSession(decoded.sessionId, {
+                        const result = await oxyInstance.validateSession(sessionId, {
                             useHeaderValidation: true,
                         });
                         if (!result || !result.valid || !result.user) {
@@ -661,9 +705,9 @@ export function OxyServicesUtilityMixin(Base) {
                     // reads from `socket.user.id`.
                     socket.data = socket.data || {};
                     socket.data.userId = userId;
-                    socket.data.sessionId = decoded.sessionId || null;
+                    socket.data.sessionId = sessionId;
                     socket.data.token = token;
-                    socket.user = { id: userId, userId, sessionId: decoded.sessionId };
+                    socket.user = { id: userId, userId, sessionId };
                     if (debug) {
                         logger.debug(`[oxy.authSocket] OK user=${userId}`, {
                             component: 'auth',
@@ -807,12 +851,16 @@ async function verifyServiceTokenSignature(token, secret) {
     }
 }
 /**
- * Verify that a decoded service-token payload carries the expected `aud`,
- * `iss`, and `type` claims. Throws `ServiceTokenClaimError` on mismatch.
- * This is the defence against the H4 vulnerability where a recovery / 2FA /
- * access token signed by the same shared secret could be replayed as a
- * service token because no claim binding existed.
+ * Read a JWT claim that is only usable as a non-empty string.
+ *
+ * A decoded payload is attacker-controlled JSON: a claim the type declares as
+ * `string` can arrive as a number, an object, or `null`. Narrowing here keeps
+ * those values out of URL construction and identity comparison, so an
+ * unexpected shape becomes a 401 rather than a stringified surprise.
  */
+function readStringClaim(value) {
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
 /**
  * Resolve the canonical user id from a validated session's user object.
  *
@@ -825,6 +873,13 @@ function getUserIdentityId(user) {
         ?? user._id;
     return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
 }
+/**
+ * Verify that a decoded service-token payload carries the expected `aud`,
+ * `iss`, and `type` claims. Throws `ServiceTokenClaimError` on mismatch.
+ * This is the defence against the H4 vulnerability where a recovery / 2FA /
+ * access token signed by the same shared secret could be replayed as a
+ * service token because no claim binding existed.
+ */
 function verifyServiceTokenClaims(decoded, expected) {
     if (decoded.type !== 'service') {
         throw new ServiceTokenClaimError(`Service token has unexpected type '${String(decoded.type)}'`);

package/dist/esm/mixins/index.js

@@ -16,6 +16,7 @@ import { OxyServicesReputationMixin } from './OxyServices.reputation.js';
 import { OxyServicesAssetsMixin } from './OxyServices.assets.js';
 import { OxyServicesAccountsMixin } from './OxyServices.accounts.js';
 import { OxyServicesConnectedAppsMixin } from './OxyServices.connectedApps.js';
+import { OxyServicesStoreMixin } from './OxyServices.store.js';
 import { OxyServicesLocationMixin } from './OxyServices.location.js';
 import { OxyServicesAnalyticsMixin } from './OxyServices.analytics.js';
 import { OxyServicesDevicesMixin } from './OxyServices.devices.js';
@@ -27,6 +28,7 @@ import { OxyServicesContactsMixin } from './OxyServices.contacts.js';
 import { OxyServicesNotificationsMixin } from './OxyServices.notifications.js';
 import { OxyServicesAppDataMixin } from './OxyServices.appData.js';
 import { OxyServicesCivicMixin } from './OxyServices.civic.js';
+import { OxyServicesChainsMixin } from './OxyServices.chains.js';
 import { OxyServicesNodesMixin } from './OxyServices.nodes.js';
 import { OxyServicesLinksMixin } from './OxyServices.links.js';
 import { OxyServicesFollowGraphMixin } from './OxyServices.followGraph.js';
@@ -66,6 +68,10 @@ const MIXIN_PIPELINE = [
     // OAuth-consent surface (public app identity + connected-app grants). Kept
     // separate from account ownership.
     OxyServicesConnectedAppsMixin,
+    // The app store: the public storefront, the reviews on it, and the listing a
+    // publisher edits. A module OVER the platform — turn it off and OAuth still
+    // works — so it is its own surface rather than more of `accounts`.
+    OxyServicesStoreMixin,
     OxyServicesLocationMixin,
     OxyServicesAnalyticsMixin,
     OxyServicesDevicesMixin,
@@ -80,6 +86,7 @@ const MIXIN_PIPELINE = [
     OxyServicesAppDataMixin,
     // Civic / Commons "Oxy ID" (public signed cards, Oxy ID QR payload)
     OxyServicesCivicMixin,
+    OxyServicesChainsMixin,
     // User nodes / decentralization (Fase 5): register/read/revoke/manage the
     // caller's personal data node + ingest hint.
     OxyServicesNodesMixin,

package/dist/esm/server/rateLimit.js

@@ -1,6 +1,7 @@
 import { createHmac } from 'node:crypto';
 import { isIPv4, isIPv6 } from 'node:net';
 import rateLimit from 'express-rate-limit';
+import { createOptionalOxyAuth } from './auth.js';
 /**
  * Built-in exemptions. A media app's cover-art/avatar fan-out and HLS
  * sub-requests must not consume the coarse global budget; health probes from
@@ -113,11 +114,12 @@ function hashAnonymousIp(ip) {
 /**
  * Resolve the trusted authenticated rate-limit key.
  *
- * `oxy.auth({ optional: true })` preserves legacy non-session user tokens by
- * decoding their JWT claims locally. Those claims are not cryptographically
- * verified and therefore MUST NOT influence abuse-control buckets. Only use
- * identities that came from a server-validated session or a verified service
- * token/delegation.
+ * Only identities that came from a server-validated session or a verified
+ * service token/delegation may pick a bucket. `req.sessionId` is the marker
+ * for the former: `oxy.auth()` sets it only after `validateSession()` came
+ * back valid, so requiring it here means an identity written by some OTHER
+ * middleware — which this package cannot vouch for — shares the anonymous
+ * per-IP bucket rather than getting the authenticated quota.
  */
 function resolveTrustedAuthenticatedKey(req) {
     const userId = req.userId ?? req.user?.id ?? req.user?._id;
@@ -153,7 +155,14 @@ export function createOxyRateLimit(oxy, options = {}) {
     const { authenticatedMax = 5000, anonymousMax = 600, windowMs = 15 * 60 * 1000, store, exempt, message = 'Too many requests, please try again later.', auth, } = options;
     // Idempotent optional-auth resolver. Reuses the SAME session resolution as
     // every protected route, so the limiter keys by the real user identity.
-    const resolveSession = oxy.auth({ ...auth, optional: true });
+    //
+    // `createOptionalOxyAuth` — NOT the raw `oxy.auth({ optional: true })` —
+    // because only the former skips resolution when a preceding middleware has
+    // already resolved a user. The raw middleware writes `req.userId = null` on
+    // every request it cannot authenticate, and because it mutates the shared
+    // `req` that erasure is visible to every handler downstream of the limiter,
+    // not just to the bucket calculation.
+    const resolveSession = createOptionalOxyAuth(oxy, { auth });
     const skip = (req) => isBuiltInExempt(req) || (exempt ? exempt(req) : false);
     const limiter = rateLimit({
         windowMs,