@oxyhq/core 3.10.0 → 3.11.0

package/src/mixins/__tests__/OxyServices.identity.test.ts

@@ -0,0 +1,364 @@
+/**
+ * Identity Mixin tests.
+ *
+ * Stubs `makeRequest` so the tests run with no network. We assert request shape
+ * (method, URL, body, cache options), response unwrapping, the DID derivation,
+ * the EXACT signed payload `linkIdentityKey` produces (it must match the
+ * server's `JSON.stringify({ action, userId, timestamp })` reconstruction
+ * byte-for-byte), and the cache sweep on every mutation.
+ */
+
+import type { AuthMethodsResponse, DidDocument, SignedRecordEnvelope, VerifiedDomain } from '@oxyhq/contracts';
+import { OxyServices } from '../../OxyServices';
+import { KeyManager } from '../../crypto/keyManager';
+import { SignatureService } from '../../crypto/signatureService';
+
+const didDocFixture: DidDocument = {
+  '@context': ['https://www.w3.org/ns/did/v1'],
+  id: 'did:web:oxy.so:u:user-123',
+  controller: ['did:web:oxy.so:u:user-123', 'did:web:oxy.so'],
+  verificationMethod: [],
+  authentication: [],
+  assertionMethod: [],
+  alsoKnownAs: ['acct:nate@oxy.so'],
+  service: [],
+};
+
+const authMethodsFixture: AuthMethodsResponse = {
+  did: 'did:web:oxy.so:u:user-123',
+  methods: [{ type: 'identity', linkedAt: '2026-06-26T00:00:00.000Z', verificationMethodId: '#key-1' }],
+};
+
+const recordFixture: SignedRecordEnvelope = {
+  version: 1,
+  type: 'profile',
+  subject: 'did:web:oxy.so:u:user-123',
+  issuer: 'did:web:oxy.so:u:user-123',
+  record: { displayName: 'Nate' },
+  issuedAt: 1700000000000,
+  publicKey: 'pub-hex',
+  alg: 'ES256K-DER-SHA256',
+  signature: 'sig-hex',
+};
+
+const domainFixture: VerifiedDomain = {
+  domain: 'nate.com',
+  verifiedAt: '2026-06-26T00:00:00.000Z',
+  method: 'dns-txt',
+};
+
+describe('OxyServices.identity', () => {
+  let oxy: OxyServices;
+  let makeRequestSpy: jest.SpyInstance;
+  let clearPrefixSpy: jest.SpyInstance;
+  let clearEntrySpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    makeRequestSpy = jest.spyOn(oxy, 'makeRequest');
+    clearPrefixSpy = jest.spyOn(oxy, 'clearCacheByPrefix').mockReturnValue(0);
+    clearEntrySpy = jest.spyOn(oxy, 'clearCacheEntry').mockReturnValue(undefined);
+    jest.spyOn(oxy, 'getCurrentUserId').mockReturnValue('user-123');
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe('resolveDid', () => {
+    it('GETs the DID document and caches the read', async () => {
+      makeRequestSpy.mockResolvedValue(didDocFixture);
+
+      const result = await oxy.resolveDid('user-123');
+
+      expect(result).toEqual(didDocFixture);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/u/user-123/did.json',
+        undefined,
+        expect.objectContaining({ cache: true }),
+      );
+    });
+
+    it('URL-encodes the userId path segment', async () => {
+      makeRequestSpy.mockResolvedValue(didDocFixture);
+      await oxy.resolveDid('a/b');
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/u/a%2Fb/did.json',
+        undefined,
+        expect.anything(),
+      );
+    });
+  });
+
+  describe('getMyDid / getMyDidDocument', () => {
+    it('derives the current user DID', () => {
+      expect(oxy.getMyDid()).toBe('did:web:oxy.so:u:user-123');
+    });
+
+    it('throws when no user is authenticated', () => {
+      jest.spyOn(oxy, 'getCurrentUserId').mockReturnValue(null);
+      expect(() => oxy.getMyDid()).toThrow(/No authenticated user/);
+    });
+
+    it('resolves the current user DID document', async () => {
+      makeRequestSpy.mockResolvedValue(didDocFixture);
+      const result = await oxy.getMyDidDocument();
+      expect(result).toEqual(didDocFixture);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/u/user-123/did.json',
+        undefined,
+        expect.objectContaining({ cache: true }),
+      );
+    });
+  });
+
+  describe('listAuthMethods', () => {
+    it('GETs /auth/methods', async () => {
+      makeRequestSpy.mockResolvedValue(authMethodsFixture);
+      const result = await oxy.listAuthMethods();
+      expect(result).toEqual(authMethodsFixture);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/auth/methods',
+        undefined,
+        expect.objectContaining({ cache: true }),
+      );
+    });
+  });
+
+  describe('linkIdentityKey', () => {
+    it('signs the exact server-expected payload and POSTs /auth/link', async () => {
+      jest.spyOn(Date, 'now').mockReturnValue(1700000000000);
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue('pub-hex');
+      const signSpy = jest.spyOn(SignatureService, 'sign').mockResolvedValue('sig-hex');
+      makeRequestSpy.mockResolvedValue({ success: true, message: 'Identity linked successfully' });
+
+      const result = await oxy.linkIdentityKey();
+
+      // The signed message MUST match the server's reconstruction byte-for-byte:
+      // JSON.stringify({ action, userId, timestamp }) in that key order.
+      const expectedMessage = JSON.stringify({
+        action: 'link_identity',
+        userId: 'user-123',
+        timestamp: 1700000000000,
+      });
+      expect(signSpy).toHaveBeenCalledWith(expectedMessage);
+      expect(expectedMessage).toBe(
+        '{"action":"link_identity","userId":"user-123","timestamp":1700000000000}',
+      );
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/link',
+        { type: 'identity', publicKey: 'pub-hex', signature: 'sig-hex', timestamp: 1700000000000 },
+        expect.objectContaining({ cache: false }),
+      );
+      expect(result).toEqual({ success: true, message: 'Identity linked successfully' });
+    });
+
+    it('sweeps /users/me, auth methods, domains and the DID cache after linking', async () => {
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue('pub-hex');
+      jest.spyOn(SignatureService, 'sign').mockResolvedValue('sig-hex');
+      makeRequestSpy.mockResolvedValue({ success: true, message: 'ok' });
+
+      await oxy.linkIdentityKey();
+
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/auth/methods');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/identity/domains');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
+    });
+
+    it('throws (no network) when the device has no identity', async () => {
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue(null);
+      await expect(oxy.linkIdentityKey()).rejects.toThrow(/No identity found/);
+      expect(makeRequestSpy).not.toHaveBeenCalled();
+    });
+
+    it('throws when no user is authenticated', async () => {
+      jest.spyOn(oxy, 'getCurrentUserId').mockReturnValue(null);
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue('pub-hex');
+      await expect(oxy.linkIdentityKey()).rejects.toThrow(/No authenticated user/);
+      expect(makeRequestSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('linkPassword', () => {
+    it('POSTs /auth/link with the password method and sweeps cache', async () => {
+      makeRequestSpy.mockResolvedValue({ success: true, message: 'Password auth linked successfully' });
+
+      await oxy.linkPassword('nate@oxy.so', 'sup3r-secret');
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/link',
+        { type: 'password', email: 'nate@oxy.so', password: 'sup3r-secret' },
+        expect.objectContaining({ cache: false }),
+      );
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/auth/methods');
+    });
+  });
+
+  describe('unlinkAuthMethod', () => {
+    it('DELETEs /auth/link/:type and sweeps cache', async () => {
+      makeRequestSpy.mockResolvedValue({ success: true, message: 'identity auth unlinked successfully' });
+
+      await oxy.unlinkAuthMethod('identity');
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'DELETE',
+        '/auth/link/identity',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
+    });
+  });
+
+  describe('signRecord (client-only)', () => {
+    it('signs with the current user DID as subject and does not hit the network', async () => {
+      const signRecordSpy = jest
+        .spyOn(SignatureService, 'signRecord')
+        .mockResolvedValue(recordFixture);
+
+      const result = await oxy.signRecord('profile', { displayName: 'Nate' });
+
+      expect(signRecordSpy).toHaveBeenCalledWith('profile', 'did:web:oxy.so:u:user-123', {
+        displayName: 'Nate',
+      });
+      expect(result).toEqual(recordFixture);
+      expect(makeRequestSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('publishRecord', () => {
+    it('signs then POSTs the envelope to /identity/records', async () => {
+      jest.spyOn(SignatureService, 'signRecord').mockResolvedValue(recordFixture);
+      makeRequestSpy.mockResolvedValue({ envelope: recordFixture, verified: true });
+
+      const result = await oxy.publishRecord('profile', { displayName: 'Nate' });
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/identity/records',
+        recordFixture,
+        expect.objectContaining({ cache: false }),
+      );
+      expect(result).toEqual({ envelope: recordFixture, verified: true });
+    });
+  });
+
+  describe('getRecord / verifyRecord', () => {
+    it('GETs and unwraps the record', async () => {
+      makeRequestSpy.mockResolvedValue({ record: recordFixture });
+      const result = await oxy.getRecord('user-123', 'profile');
+      expect(result).toEqual(recordFixture);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/identity/records/user-123/profile',
+        undefined,
+        expect.objectContaining({ cache: true }),
+      );
+    });
+
+    it('GETs the verify verdict', async () => {
+      makeRequestSpy.mockResolvedValue({ verified: true });
+      const result = await oxy.verifyRecord('user-123', 'identity');
+      expect(result).toEqual({ verified: true });
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/identity/records/user-123/identity/verify',
+        undefined,
+        expect.objectContaining({ cache: true }),
+      );
+    });
+  });
+
+  describe('exportMyData', () => {
+    it('GETs /users/me/export without caching', async () => {
+      const bundle = { $schema: 'x', did: 'did:web:oxy.so:u:user-123' };
+      makeRequestSpy.mockResolvedValue(bundle);
+      const result = await oxy.exportMyData();
+      expect(result).toEqual(bundle);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/users/me/export',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+    });
+  });
+
+  describe('domains', () => {
+    it('requestDomainVerification POSTs the domain', async () => {
+      const instructions = {
+        domain: 'nate.com',
+        token: 'tok',
+        dns: { name: '_oxy-identity.nate.com', value: 'oxy-domain-verification=tok' },
+        wellKnown: { url: 'https://nate.com/.well-known/oxy-domain', body: 'tok' },
+      };
+      makeRequestSpy.mockResolvedValue(instructions);
+
+      const result = await oxy.requestDomainVerification('nate.com');
+
+      expect(result).toEqual(instructions);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/identity/domains',
+        { domain: 'nate.com' },
+        expect.objectContaining({ cache: false }),
+      );
+    });
+
+    it('verifyDomain POSTs to the verify path and sweeps cache', async () => {
+      makeRequestSpy.mockResolvedValue({ verified: true, domain: domainFixture });
+
+      await oxy.verifyDomain('nate.com');
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/identity/domains/nate.com/verify',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
+    });
+
+    it('listDomains GETs and unwraps domains', async () => {
+      makeRequestSpy.mockResolvedValue({ domains: [domainFixture] });
+      const result = await oxy.listDomains();
+      expect(result).toEqual([domainFixture]);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/identity/domains',
+        undefined,
+        expect.objectContaining({ cache: true }),
+      );
+    });
+
+    it('listDomains defaults to an empty array when domains is absent', async () => {
+      makeRequestSpy.mockResolvedValue({});
+      await expect(oxy.listDomains()).resolves.toEqual([]);
+    });
+
+    it('removeDomain DELETEs and sweeps cache', async () => {
+      makeRequestSpy.mockResolvedValue({ success: true });
+
+      await oxy.removeDomain('nate.com');
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'DELETE',
+        '/identity/domains/nate.com',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
+    });
+  });
+});

package/src/mixins/__tests__/assetCredentials.test.ts

@@ -0,0 +1,47 @@
+import { OxyServices } from '../../OxyServices';
+
+interface FetchCall {
+  url: string;
+  init: RequestInit | undefined;
+}
+
+describe('asset fetch credentials', () => {
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    jest.restoreAllMocks();
+  });
+
+  it('omits credentials for arbitrary asset content URLs', async () => {
+    const calls: FetchCall[] = [];
+    globalThis.fetch = async (input, init) => {
+      calls.push({ url: String(input), init });
+      return new Response('asset-body', { status: 200 });
+    };
+
+    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+
+    await oxy.fetchAssetContent('https://attacker.oxy.so/cdn/object.txt', 'text');
+
+    expect(calls).toHaveLength(1);
+    expect(calls[0].url).toBe('https://attacker.oxy.so/cdn/object.txt');
+    expect(calls[0].init?.credentials).toBe('omit');
+  });
+
+  it('includes credentials for asset content fetched from the configured API origin', async () => {
+    const calls: FetchCall[] = [];
+    globalThis.fetch = async (input, init) => {
+      calls.push({ url: String(input), init });
+      return new Response('asset-body', { status: 200 });
+    };
+
+    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+
+    await oxy.fetchAssetContent('https://api.oxy.so/assets/private-file/stream', 'text');
+
+    expect(calls).toHaveLength(1);
+    expect(calls[0].url).toBe('https://api.oxy.so/assets/private-file/stream');
+    expect(calls[0].init?.credentials).toBe('include');
+  });
+});

package/src/mixins/__tests__/assetUpload.test.ts

@@ -0,0 +1,191 @@
+/**
+ * `OxyServices.assetUpload()` multipart-body tests.
+ *
+ * `assetUpload` accepts three input shapes: a web `File`, a web `Blob`, or a
+ * React Native `{ uri, type?, name?, size? }` descriptor. The descriptor path
+ * is platform-sensitive:
+ *
+ *   - React Native — RN's FormData reads the file from disk via the uri during
+ *     the multipart request, so the descriptor is appended as-is.
+ *   - Web (browser/Node) — the browser's FormData CANNOT read bytes from a plain
+ *     `{ uri }` object (it would serialize `[object Object]` → the server stores
+ *     a 0-byte asset). The uri must be materialized into a real `Blob` via
+ *     `fetch` before appending. An empty fetched blob must throw instead of
+ *     silently uploading an empty asset.
+ *
+ * These tests assert exactly which value lands in the FormData `file` part for
+ * each platform, and that an empty web source is rejected.
+ */
+
+import { OxyServices } from '../../OxyServices';
+
+/**
+ * Captures every `FormData.append` call so a test can inspect the multipart body
+ * that `assetUpload` built without sending a real network request.
+ */
+function captureUpload(oxy: OxyServices) {
+  const appended: Array<{ name: string; value: unknown; fileName?: string }> = [];
+  // Capture-only: do NOT delegate to the real (undici) FormData.append. Node's
+  // undici rejects a plain { uri } object as not-a-Blob, but real React Native
+  // FormData accepts it — the test asserts on captured args, not a built body.
+  const appendSpy = jest
+    .spyOn(FormData.prototype, 'append')
+    .mockImplementation(function (this: FormData, name: string, value: unknown, fileName?: string) {
+      appended.push({ name, value, fileName });
+    });
+
+  const requestSpy = jest
+    .spyOn(oxy.getClient(), 'request')
+    .mockResolvedValue({ file: { id: 'asset123' } } as never);
+
+  return {
+    appended,
+    requestSpy,
+    restore: () => {
+      appendSpy.mockRestore();
+      requestSpy.mockRestore();
+    },
+  };
+}
+
+describe('OxyServices.assetUpload — uri descriptor', () => {
+  const originalNavigator = (globalThis as { navigator?: unknown }).navigator;
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    if (originalNavigator === undefined) {
+      delete (globalThis as { navigator?: unknown }).navigator;
+    } else {
+      (globalThis as { navigator?: unknown }).navigator = originalNavigator;
+    }
+    globalThis.fetch = originalFetch;
+  });
+
+  describe('web (NOT React Native)', () => {
+    beforeEach(() => {
+      // Node/jsdom-like: no React Native navigator → isReactNative() === false.
+      delete (globalThis as { navigator?: unknown }).navigator;
+    });
+
+    it('materializes a blob: uri into a real, non-empty Blob before appending', async () => {
+      const bytes = new Blob([new Uint8Array([1, 2, 3, 4, 5])], { type: 'image/png' });
+      const fetchMock = jest
+        .fn()
+        .mockResolvedValue({ ok: true, status: 200, blob: async () => bytes });
+      globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+      const capture = captureUpload(oxy);
+
+      try {
+        await oxy.assetUpload({ uri: 'blob:https://app.test/abc', type: 'image/png', name: 'avatar.png' });
+
+        expect(fetchMock).toHaveBeenCalledWith('blob:https://app.test/abc');
+
+        const filePart = capture.appended.find((p) => p.name === 'file');
+        expect(filePart).toBeDefined();
+        // The appended value is the fetched Blob with real bytes — NOT the { uri } object.
+        expect(filePart?.value).toBeInstanceOf(Blob);
+        expect((filePart?.value as Blob).size).toBe(5);
+        expect((filePart?.value as { uri?: string }).uri).toBeUndefined();
+        expect(filePart?.fileName).toBe('avatar.png');
+      } finally {
+        capture.restore();
+      }
+    });
+
+    it('wraps a typeless fetched blob with the descriptor MIME type', async () => {
+      const typeless = new Blob([new Uint8Array([9, 9, 9])]); // type === ''
+      const fetchMock = jest
+        .fn()
+        .mockResolvedValue({ ok: true, status: 200, blob: async () => typeless });
+      globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+      const capture = captureUpload(oxy);
+
+      try {
+        await oxy.assetUpload({ uri: 'data:application/octet-stream;base64,CQkJ', type: 'image/jpeg', name: 'x.jpg' });
+
+        const filePart = capture.appended.find((p) => p.name === 'file');
+        expect(filePart?.value).toBeInstanceOf(Blob);
+        expect((filePart?.value as Blob).size).toBe(3);
+        expect((filePart?.value as Blob).type).toBe('image/jpeg');
+      } finally {
+        capture.restore();
+      }
+    });
+
+    it('throws "Cannot upload an empty file" when the fetched blob is empty', async () => {
+      const empty = new Blob([], { type: 'image/png' });
+      const fetchMock = jest
+        .fn()
+        .mockResolvedValue({ ok: true, status: 200, blob: async () => empty });
+      globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+      const capture = captureUpload(oxy);
+
+      try {
+        await expect(
+          oxy.assetUpload({ uri: 'blob:https://app.test/empty', type: 'image/png', name: 'empty.png' }),
+        ).rejects.toThrow('Cannot upload an empty file');
+
+        // Nothing was sent — the empty source surfaces instead of creating a 0-byte asset.
+        expect(capture.requestSpy).not.toHaveBeenCalled();
+      } finally {
+        capture.restore();
+      }
+    });
+
+    it('throws when the uri cannot be fetched (non-ok response)', async () => {
+      const fetchMock = jest
+        .fn()
+        .mockResolvedValue({ ok: false, status: 404, blob: async () => new Blob([]) });
+      globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+      const capture = captureUpload(oxy);
+
+      try {
+        await expect(
+          oxy.assetUpload({ uri: 'https://cdn.test/missing.png', type: 'image/png', name: 'missing.png' }),
+        ).rejects.toThrow('Failed to read file from uri (status 404)');
+        expect(capture.requestSpy).not.toHaveBeenCalled();
+      } finally {
+        capture.restore();
+      }
+    });
+  });
+
+  describe('React Native', () => {
+    beforeEach(() => {
+      // Make isReactNative() === true: navigator.product === 'ReactNative'.
+      (globalThis as { navigator?: unknown }).navigator = { product: 'ReactNative' };
+    });
+
+    it('appends the descriptor as-is and never calls fetch', async () => {
+      const fetchMock = jest.fn();
+      globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+      const capture = captureUpload(oxy);
+
+      const descriptor = { uri: 'file:///tmp/avatar.png', type: 'image/png', name: 'avatar.png', size: 1024 };
+
+      try {
+        await oxy.assetUpload(descriptor);
+
+        // RN path: the raw descriptor object lands in the multipart body unchanged.
+        const filePart = capture.appended.find((p) => p.name === 'file');
+        expect(filePart?.value).toBe(descriptor);
+        expect(filePart?.fileName).toBe('avatar.png');
+        // No in-JS materialization on RN — FormData reads the file from the uri.
+        expect(fetchMock).not.toHaveBeenCalled();
+      } finally {
+        capture.restore();
+      }
+    });
+  });
+});