@oxyhq/core 3.10.0 → 3.11.0

package/src/mixins/__tests__/commonsSignIn.test.ts

@@ -0,0 +1,277 @@
+/**
+ * "Sign in with Oxy" handoff tests (Workstream C).
+ *
+ * Stubs `makeRequest` (and the shared challenge/sign primitives) so the tests
+ * run with no network. We assert the exact request bodies the RP and the
+ * approver send — these are the load-bearing coordination points with the C2
+ * server endpoints — plus the native-vs-web behaviour of the shared-key SSO.
+ */
+
+import type { SessionLoginResponse } from '../../models/session';
+import type { ChallengeResponse } from '../OxyServices.auth';
+import { OxyServices } from '../../OxyServices';
+import { KeyManager } from '../../crypto/keyManager';
+import { SignatureService } from '../../crypto/signatureService';
+
+const challengeFixture: ChallengeResponse = {
+  challenge: 'chal-xyz',
+  expiresAt: '2026-06-26T00:05:00.000Z',
+};
+
+const sessionFixture: SessionLoginResponse = {
+  sessionId: 's1',
+  deviceId: 'd1',
+  expiresAt: '2026-06-26T00:05:00.000Z',
+  accessToken: 'at-1',
+  user: { id: 'u1', username: 'nate', name: { displayName: 'Nate' } },
+};
+
+describe('OxyServices — "Sign in with Oxy" handoff', () => {
+  let oxy: OxyServices;
+  let makeRequestSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    makeRequestSpy = jest.spyOn(oxy, 'makeRequest');
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe('startCommonsSignIn (relying party)', () => {
+    it('generates a client-side sessionToken and POSTs /auth/session/create', async () => {
+      jest.spyOn(Date, 'now').mockReturnValue(1700000000000);
+      jest.spyOn(SignatureService, 'generateChallenge').mockResolvedValue('secret-session-token');
+      makeRequestSpy.mockResolvedValue({
+        authorizeCode: 'code-1',
+        qrPayload: 'oxycommons://approve?v=1&code=code-1',
+        status: 'pending',
+        expiresAt: 1700000300000,
+      });
+
+      const handle = await oxy.startCommonsSignIn({ clientId: 'oxy_dk_test' });
+
+      // expiry is client-proposed (now + 5 min) on the request...
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/session/create',
+        { sessionToken: 'secret-session-token', expiresAt: 1700000300000, clientId: 'oxy_dk_test' },
+        expect.objectContaining({ cache: false }),
+      );
+      // ...and the handle carries the SECRET token + the server's public code/payload.
+      expect(handle).toEqual({
+        sessionToken: 'secret-session-token',
+        authorizeCode: 'code-1',
+        qrPayload: 'oxycommons://approve?v=1&code=code-1',
+        expiresAt: 1700000300000,
+        status: 'pending',
+      });
+      // The secret token must never leak into the QR payload.
+      expect(handle.qrPayload).not.toContain('secret-session-token');
+    });
+
+    it('falls back to the client-proposed expiry when the server omits it', async () => {
+      jest.spyOn(Date, 'now').mockReturnValue(1700000000000);
+      jest.spyOn(SignatureService, 'generateChallenge').mockResolvedValue('tok');
+      makeRequestSpy.mockResolvedValue({
+        authorizeCode: 'code-2',
+        qrPayload: 'oxycommons://approve?v=1&code=code-2',
+        status: 'pending',
+      });
+
+      const handle = await oxy.startCommonsSignIn({ clientId: 'oxy_dk_test' });
+      expect(handle.expiresAt).toBe(1700000000000 + 5 * 60 * 1000);
+    });
+  });
+
+  describe('pollCommonsSignIn (relying party)', () => {
+    it('GETs the session status without cache/retry', async () => {
+      makeRequestSpy.mockResolvedValue({ authorized: true, sessionId: 's1' });
+
+      const result = await oxy.pollCommonsSignIn('secret-session-token');
+
+      expect(result).toEqual({ authorized: true, sessionId: 's1' });
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/auth/session/status/secret-session-token',
+        undefined,
+        expect.objectContaining({ cache: false, retry: false }),
+      );
+    });
+  });
+
+  describe('getCommonsApprovalInfo (approver)', () => {
+    it('GETs the server-resolved approval info by authorizeCode', async () => {
+      const info = {
+        application: {
+          id: 'app1',
+          name: 'Mention',
+          type: 'first_party' as const,
+          isOfficial: true,
+          isInternal: false,
+          scopes: ['profile'],
+        },
+        scopes: ['profile'],
+        boundOrigin: 'https://mention.earth',
+        expiresAt: 1700000300000,
+        status: 'pending',
+      };
+      makeRequestSpy.mockResolvedValue(info);
+
+      const result = await oxy.getCommonsApprovalInfo('code-1');
+
+      expect(result).toEqual(info);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/auth/session/approve-info/code-1',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+    });
+  });
+
+  describe('approveCommonsSignIn (approver)', () => {
+    it('requests a challenge, signs with the PRIMARY key, and POSTs authorize-signed', async () => {
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue('pub-primary');
+      const requestChallengeSpy = jest
+        .spyOn(oxy, 'requestChallenge')
+        .mockResolvedValue(challengeFixture);
+      const signChallengeSpy = jest.spyOn(SignatureService, 'signChallenge').mockResolvedValue({
+        challenge: 'sig-primary',
+        publicKey: 'pub-primary',
+        timestamp: 1700000000123,
+      });
+      // authorize-signed is the only network call (challenge is mocked above).
+      makeRequestSpy.mockResolvedValue({ success: true });
+
+      const result = await oxy.approveCommonsSignIn({
+        authorizeCode: 'code-1',
+        deviceName: 'iPhone',
+      });
+
+      expect(requestChallengeSpy).toHaveBeenCalledWith('pub-primary');
+      expect(signChallengeSpy).toHaveBeenCalledWith('chal-xyz');
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/session/authorize-signed/code-1',
+        {
+          publicKey: 'pub-primary',
+          challenge: 'chal-xyz',
+          signature: 'sig-primary',
+          timestamp: 1700000000123,
+          deviceName: 'iPhone',
+        },
+        expect.objectContaining({ cache: false }),
+      );
+      expect(result).toEqual({ success: true });
+    });
+
+    it('omits deviceName/deviceFingerprint when not provided', async () => {
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue('pub-primary');
+      jest.spyOn(oxy, 'requestChallenge').mockResolvedValue(challengeFixture);
+      jest.spyOn(SignatureService, 'signChallenge').mockResolvedValue({
+        challenge: 'sig-primary',
+        publicKey: 'pub-primary',
+        timestamp: 1700000000123,
+      });
+      makeRequestSpy.mockResolvedValue({ success: true });
+
+      await oxy.approveCommonsSignIn({ authorizeCode: 'code-1' });
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/session/authorize-signed/code-1',
+        {
+          publicKey: 'pub-primary',
+          challenge: 'chal-xyz',
+          signature: 'sig-primary',
+          timestamp: 1700000000123,
+        },
+        expect.objectContaining({ cache: false }),
+      );
+    });
+
+    it('throws (no network) when the device has no primary identity', async () => {
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue(null);
+      await expect(oxy.approveCommonsSignIn({ authorizeCode: 'code-1' })).rejects.toThrow(
+        /No identity found/,
+      );
+      expect(makeRequestSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('denyCommonsSignIn (approver)', () => {
+    it('POSTs /auth/session/deny/:authorizeCode', async () => {
+      makeRequestSpy.mockResolvedValue({ success: true });
+
+      const result = await oxy.denyCommonsSignIn('code-1');
+
+      expect(result).toEqual({ success: true });
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/session/deny/code-1',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+    });
+  });
+
+  describe('signInWithSharedIdentity (Mechanism A — same-device SSO)', () => {
+    it('mints a session from the shared key when one exists (native)', async () => {
+      jest.spyOn(KeyManager, 'hasSharedIdentity').mockResolvedValue(true);
+      jest.spyOn(KeyManager, 'getSharedPublicKey').mockResolvedValue('shared-pub');
+      const requestChallengeSpy = jest
+        .spyOn(oxy, 'requestChallenge')
+        .mockResolvedValue({ challenge: 'chal-shared', expiresAt: '2026-06-26T00:05:00.000Z' });
+      jest.spyOn(SignatureService, 'signChallengeWithSharedKey').mockResolvedValue({
+        challenge: 'sig-shared',
+        publicKey: 'shared-pub',
+        timestamp: 1700000000456,
+      });
+      const verifyChallengeSpy = jest
+        .spyOn(oxy, 'verifyChallenge')
+        .mockResolvedValue(sessionFixture);
+
+      const result = await oxy.signInWithSharedIdentity({
+        deviceName: 'iPad',
+        deviceFingerprint: 'fp-1',
+      });
+
+      expect(requestChallengeSpy).toHaveBeenCalledWith('shared-pub');
+      expect(verifyChallengeSpy).toHaveBeenCalledWith(
+        'shared-pub',
+        'chal-shared',
+        'sig-shared',
+        1700000000456,
+        'iPad',
+        'fp-1',
+      );
+      expect(result).toEqual(sessionFixture);
+    });
+
+    it('returns null (no network) when no shared identity exists — the web case', async () => {
+      // hasSharedIdentity() is already false on web; emulate that verdict.
+      jest.spyOn(KeyManager, 'hasSharedIdentity').mockResolvedValue(false);
+      const requestChallengeSpy = jest.spyOn(oxy, 'requestChallenge');
+      const verifyChallengeSpy = jest.spyOn(oxy, 'verifyChallenge');
+
+      const result = await oxy.signInWithSharedIdentity();
+
+      expect(result).toBeNull();
+      expect(requestChallengeSpy).not.toHaveBeenCalled();
+      expect(verifyChallengeSpy).not.toHaveBeenCalled();
+    });
+
+    it('returns null when the shared public key is unexpectedly absent', async () => {
+      jest.spyOn(KeyManager, 'hasSharedIdentity').mockResolvedValue(true);
+      jest.spyOn(KeyManager, 'getSharedPublicKey').mockResolvedValue(null);
+      const verifyChallengeSpy = jest.spyOn(oxy, 'verifyChallenge');
+
+      const result = await oxy.signInWithSharedIdentity();
+
+      expect(result).toBeNull();
+      expect(verifyChallengeSpy).not.toHaveBeenCalled();
+    });
+  });
+});

package/src/mixins/__tests__/getFileDownloadUrl.test.ts

@@ -49,6 +49,19 @@ describe('OxyServices.getFileDownloadUrl', () => {
         'https://cloud.oxy.so/a%2Fb%20c?variant=large%20size',
       );
     });
+
+    it('can omit the token for persisted public image URLs while authenticated', () => {
+      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+      oxy.setTokens('access-token-abc');
+
+      const url = oxy.getFileDownloadUrl('file123', 'thumb', undefined, {
+        omitToken: true,
+      });
+
+      expect(url).toBe('https://cloud.oxy.so/file123?variant=thumb');
+      expect(url).not.toContain('access-token-abc');
+      expect(url).not.toContain('token=');
+    });
   });
 
   describe('signed / private assets → authenticated API origin', () => {

package/src/mixins/__tests__/serviceAuth.test.ts

@@ -312,6 +312,25 @@ describe('H1: getServiceToken per-credential cache + secret verification', () =>
     );
   });
 
+  it('does not poison the cache when initial token fetch fails for an apiKey', async () => {
+    makeRequestSpy
+      .mockRejectedValueOnce(new Error('invalid service credentials'))
+      .mockResolvedValueOnce({
+        token: 'token-A',
+        expiresIn: 3600,
+        appName: 'tenant-A',
+      });
+
+    await expect(oxy.getServiceToken('key-A', 'attacker-secret')).rejects.toThrow(
+      'invalid service credentials',
+    );
+
+    const token = await oxy.getServiceToken('key-A', 'secret-A');
+
+    expect(token).toBe('token-A');
+    expect(makeRequestSpy).toHaveBeenCalledTimes(2);
+  });
+
   it('refreshes the cached token when it expires (using the correct stored secret)', async () => {
     // First token already past its buffer window.
     makeRequestSpy.mockResolvedValueOnce({
@@ -672,9 +691,9 @@ describe('requireScope() middleware', () => {
     expect(res.headersSent).toBe(false);
   });
 
-  it('allows requests where the delegation grant carries the required scope', () => {
+  it('allows delegated requests only when both app and delegation carry the required scope', () => {
     const req = makeReq();
-    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: [] };
+    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['user:read'] };
     req.serviceActingAs = { userId: 'u-1', scopes: ['user:read'] };
     const res = makeRes();
     const next = jest.fn();
@@ -684,6 +703,34 @@ describe('requireScope() middleware', () => {
     expect(next).toHaveBeenCalledTimes(1);
   });
 
+  it('rejects delegated requests when only the app carries the required scope', () => {
+    const req = makeReq();
+    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['files:write'] };
+    req.serviceActingAs = { userId: 'u-1', scopes: ['profile:read'] };
+    const res = makeRes();
+    const next = jest.fn();
+
+    oxy.requireScope('files:write')(req as unknown as never, res as unknown as never, next as unknown as never);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(403);
+    expect(res.body).toMatchObject({ code: 'INSUFFICIENT_SCOPE' });
+  });
+
+  it('rejects delegated requests when only the delegation carries the required scope', () => {
+    const req = makeReq();
+    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['profile:read'] };
+    req.serviceActingAs = { userId: 'u-1', scopes: ['files:write'] };
+    const res = makeRes();
+    const next = jest.fn();
+
+    oxy.requireScope('files:write')(req as unknown as never, res as unknown as never, next as unknown as never);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(403);
+    expect(res.body).toMatchObject({ code: 'INSUFFICIENT_SCOPE' });
+  });
+
   it('rejects requests missing the required scope with 403', () => {
     const req = makeReq();
     req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['user:read'] };

package/src/mixins/__tests__/sso.test.ts

@@ -11,6 +11,7 @@
 
 import { OxyServices } from '../../OxyServices';
 import { generateSsoState } from '../OxyServices.sso';
+import { ssoStateKey } from '../../utils/ssoBounce';
 
 interface FetchCall {
   url: string;
@@ -118,6 +119,36 @@ describe('OxyServices.exchangeSsoCode', () => {
     expect(calls).toHaveLength(0);
   });
 
+  it('rejects a browser SSO exchange when stored state is not echoed', async () => {
+    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+    const { calls } = mockFetchOnce(VALID_BODY);
+    const storage = new Map([[ssoStateKey('https://rp.example'), 'expected-state']]);
+    const previousWindow = (globalThis as unknown as { window?: unknown }).window;
+
+    Object.defineProperty(globalThis, 'window', {
+      configurable: true,
+      value: {
+        location: { origin: 'https://rp.example' },
+        sessionStorage: {
+          getItem: (key: string) => storage.get(key) ?? null,
+        },
+      },
+    });
+
+    try {
+      await expect(oxy.exchangeSsoCode('opaque-code-123', 'attacker-state')).rejects.toThrow(
+        'SSO exchange state mismatch',
+      );
+      expect(calls).toHaveLength(0);
+      expect(oxy.hasValidToken()).toBe(false);
+    } finally {
+      Object.defineProperty(globalThis, 'window', {
+        configurable: true,
+        value: previousWindow,
+      });
+    }
+  });
+
   it('throws and does not plant a token on a non-2xx response', async () => {
     const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
     mockFetchOnce({ error: 'invalid_code' }, false, 400);

package/src/mixins/index.ts

@@ -12,6 +12,7 @@ import { OxyServicesSilentAuthMixin } from './OxyServices.silent';
 import { OxyServicesRedirectAuthMixin } from './OxyServices.redirect';
 import { OxyServicesSsoMixin } from './OxyServices.sso';
 import { OxyServicesUserMixin } from './OxyServices.user';
+import { OxyServicesIdentityMixin } from './OxyServices.identity';
 import { OxyServicesPrivacyMixin } from './OxyServices.privacy';
 import { OxyServicesLanguageMixin } from './OxyServices.language';
 import { OxyServicesPaymentMixin } from './OxyServices.payment';
@@ -46,6 +47,7 @@ type AllMixinInstances =
   & InstanceType<ReturnType<typeof OxyServicesRedirectAuthMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesSsoMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesUserMixin<typeof OxyServicesBase>>>
+  & InstanceType<ReturnType<typeof OxyServicesIdentityMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesPrivacyMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesLanguageMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesPaymentMixin<typeof OxyServicesBase>>>
@@ -108,6 +110,8 @@ const MIXIN_PIPELINE: MixinFunction[] = [
 
     // User management (requires auth)
     OxyServicesUserMixin,
+    // Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping)
+    OxyServicesIdentityMixin,
     OxyServicesPrivacyMixin,
 
     // Feature mixins

package/src/models/interfaces.ts

@@ -113,6 +113,9 @@ export interface User {
    */
   name: UserNameResponse;
   bio?: string;
+  phone?: string;
+  address?: string;
+  birthday?: string;
   location?: string;
   website?: string;
   createdAt?: string;

package/src/server/__tests__/cors.test.ts

@@ -34,7 +34,7 @@ function makeNext(): NextFunction & jest.Mock {
 }
 
 describe('@oxyhq/core/server createOxyCors', () => {
-  it('allows the Oxy apex family (apex + any subdomain) and echoes the exact origin', () => {
+  it('allows the HTTPS Oxy apex family (apex + one-level subdomains) and echoes the exact origin', () => {
     const mw = createOxyCors();
     for (const origin of [
       'https://oxy.so',
@@ -74,6 +74,10 @@ describe('@oxyhq/core/server createOxyCors', () => {
       'https://oxy.so.evil.com', // suffix attack
       'https://notoxy.so', // different apex
       'https://example.com',
+      'http://oxy.so',
+      'http://auth.oxy.so',
+      'https://deep.attacker-controlled.oxy.so',
+      'https://api.oxy.so:8443',
     ]) {
       const req = makeRequest('GET', origin);
       const res = makeResponse();

package/src/server/__tests__/rateLimit.test.ts

@@ -0,0 +1,116 @@
+import type { NextFunction, Request, RequestHandler, Response } from 'express';
+import type { OxyServices } from '../../OxyServices';
+
+const rateLimitMock = jest.fn();
+
+jest.mock('express-rate-limit', () => ({
+  __esModule: true,
+  default: (...args: unknown[]) => rateLimitMock(...args),
+}));
+
+import { createOxyRateLimit } from '../rateLimit';
+
+interface CapturedRateLimitOptions {
+  max: (req: Request) => number;
+  keyGenerator: (req: Request) => string;
+  skip: (req: Request) => boolean;
+}
+
+interface RateLimitTestRequest extends Request {
+  userId?: string | null;
+  user?: { id?: string; _id?: string } | null;
+  sessionId?: string | null;
+  serviceApp?: { appId?: string } | null;
+  serviceActingAs?: { userId?: string } | null;
+  observedMax?: number;
+  observedKey?: string;
+}
+
+function makeOxy(authHandler: RequestHandler): OxyServices {
+  return {
+    auth: jest.fn(() => authHandler),
+  } as unknown as OxyServices;
+}
+
+function makeRequest(overrides: Partial<RateLimitTestRequest> = {}): RateLimitTestRequest {
+  return {
+    method: 'GET',
+    path: '/api/test',
+    ip: '203.0.113.9',
+    socket: { remoteAddress: '203.0.113.9' },
+    ...overrides,
+  } as RateLimitTestRequest;
+}
+
+describe('@oxyhq/core/server rate limiter', () => {
+  beforeEach(() => {
+    rateLimitMock.mockImplementation((options: CapturedRateLimitOptions) => {
+      return (req: RateLimitTestRequest, _res: Response, next: NextFunction) => {
+        req.observedMax = options.max(req);
+        req.observedKey = options.keyGenerator(req);
+        next();
+      };
+    });
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('does not trust locally decoded non-session JWT identities for quota or bucket keys', () => {
+    const oxy = makeOxy((req: RateLimitTestRequest, _res: Response, next: NextFunction) => {
+      req.userId = 'attacker-controlled-user';
+      req.user = { id: 'attacker-controlled-user' };
+      next();
+    });
+    const req = makeRequest();
+    const next = jest.fn();
+
+    createOxyRateLimit(oxy, { authenticatedMax: 5000, anonymousMax: 600 })(
+      req,
+      {} as Response,
+      next,
+    );
+
+    expect(req.observedMax).toBe(600);
+    expect(req.observedKey).toBe('203.0.113.9');
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it('uses authenticated quota and per-user keys for server-validated sessions', () => {
+    const oxy = makeOxy((req: RateLimitTestRequest, _res: Response, next: NextFunction) => {
+      req.userId = 'validated-user';
+      req.user = { id: 'validated-user' };
+      req.sessionId = 'validated-session';
+      next();
+    });
+    const req = makeRequest();
+
+    createOxyRateLimit(oxy, { authenticatedMax: 5000, anonymousMax: 600 })(
+      req,
+      {} as Response,
+      jest.fn(),
+    );
+
+    expect(req.observedMax).toBe(5000);
+    expect(req.observedKey).toBe('user:validated-user');
+  });
+
+  it('continues through the anonymous limiter if optional auth returns an error', () => {
+    const oxy = makeOxy((_req: Request, _res: Response, next: NextFunction) => {
+      next(new Error('token rejected'));
+    });
+    const req = makeRequest();
+    const next = jest.fn();
+
+    createOxyRateLimit(oxy, { authenticatedMax: 5000, anonymousMax: 600 })(
+      req,
+      {} as Response,
+      next,
+    );
+
+    expect(req.observedMax).toBe(600);
+    expect(req.observedKey).toBe('203.0.113.9');
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+});

package/src/server/cors.ts

@@ -11,10 +11,9 @@
  *
  * `createOxyCors` returns a self-contained Express middleware (no `cors`
  * package dependency) that:
- *   - allows the Oxy apex origin family (anything under `*.${CENTRAL_IDP_APEX}`,
- *     i.e. `oxy.so` — covering `auth.oxy.so`, `api.oxy.so`, `accounts.oxy.so`,
- *     `console.oxy.so`, `inbox.oxy.so`, the marketing site, …) reusing the
- *     central-origin constants already in core, NOT a fresh hardcoded list,
+ *   - allows the Oxy apex origin family over HTTPS only: the apex plus
+ *     one-label subdomains such as `auth.oxy.so`, `api.oxy.so`,
+ *     `accounts.oxy.so`, `console.oxy.so`, and `inbox.oxy.so`,
  *   - allows the caller's explicit `appOrigins`,
  *   - DENIES everything else (no reflection, never a wildcard with credentials),
  *   - echoes back the EXACT matched origin (so credentialed requests work) and
@@ -26,7 +25,6 @@
 
 import type { NextFunction, Request, RequestHandler, Response } from 'express';
 import { CENTRAL_IDP_APEX } from '../utils/authWebUrl';
-import { registrableApex } from '../utils/fapiAutoDetect';
 
 /** Default HTTP methods allowed across origins. */
 const DEFAULT_ALLOWED_METHODS = ['GET', 'HEAD', 'PUT', 'PATCH', 'POST', 'DELETE', 'OPTIONS'];
@@ -44,11 +42,16 @@ const DEFAULT_ALLOWED_HEADERS = [
 /** How long (seconds) a browser may cache a successful preflight. */
 const DEFAULT_MAX_AGE_SECONDS = 86_400;
 
+const OXY_ONE_LABEL_SUBDOMAIN_PATTERN = new RegExp(
+  `^[a-z0-9-]+\\.${CENTRAL_IDP_APEX.replace('.', '\\.')}$`,
+);
+
 export interface OxyCorsOptions {
   /**
    * Explicit additional allowed origins (exact-origin match, e.g.
    * `https://app.example.com`, `http://localhost:3000`). These are allowed IN
-   * ADDITION TO the Oxy apex origin family. Each is normalized via `new URL().origin`.
+   * ADDITION TO the built-in HTTPS Oxy apex origin family. Each is normalized
+   * via `new URL().origin`.
    */
   appOrigins?: string[];
   /**
@@ -68,25 +71,27 @@ export interface OxyCorsOptions {
 }
 
 /**
- * Whether `candidate` belongs to the Oxy apex origin family — i.e. its
- * registrable apex equals {@link CENTRAL_IDP_APEX} (`oxy.so`). This matches the
- * apex itself (`https://oxy.so`) and any subdomain (`https://auth.oxy.so`,
- * `https://api.oxy.so`, …) over http or https, ports allowed. Returns false on
- * any parse failure (fail closed).
+ * Whether `candidate` belongs to the built-in Oxy apex origin family. This
+ * intentionally mirrors the API allowlist shape: HTTPS only, no custom port,
+ * the apex itself (`https://oxy.so`), or exactly one lowercase subdomain label
+ * (`https://auth.oxy.so`, `https://api.oxy.so`, …).
+ *
+ * Arbitrary/multi-level subdomains and `http://*.oxy.so` are not implicitly
+ * trusted for credentialed CORS. If a service needs a non-standard development
+ * or tenant origin, it must opt in explicitly via `appOrigins`.
  */
 function isOxyFamilyOrigin(candidate: string): boolean {
-  let hostname: string;
-  let protocol: string;
   try {
     const url = new URL(candidate);
-    hostname = url.hostname.toLowerCase();
-    protocol = url.protocol;
+    if (url.protocol !== 'https:' || url.port !== '') return false;
+
+    const hostname = url.hostname;
+    if (hostname === CENTRAL_IDP_APEX) return true;
+
+    return OXY_ONE_LABEL_SUBDOMAIN_PATTERN.test(hostname);
   } catch {
     return false;
   }
-  if (protocol !== 'https:' && protocol !== 'http:') return false;
-  if (hostname === CENTRAL_IDP_APEX) return true;
-  return registrableApex(hostname) === CENTRAL_IDP_APEX;
 }
 
 /** Normalize a raw origin string to its canonical `scheme://host[:port]` form. */
@@ -99,8 +104,8 @@ function normalizeOrigin(raw: string): string | null {
 }
 
 /**
- * Build the origin-matching predicate: true iff `origin` is in the Oxy apex
- * family OR exactly matches one of the configured app origins.
+ * Build the origin-matching predicate: true iff `origin` is in the built-in
+ * HTTPS Oxy apex family OR exactly matches one of the configured app origins.
  */
 function buildOriginAllowed(appOrigins: string[]): (origin: string) => boolean {
   const explicit = new Set<string>();