@oxyhq/core 3.10.1 → 3.12.0

package/src/mixins/__tests__/OxyServices.identity.test.ts

@@ -0,0 +1,364 @@
+/**
+ * Identity Mixin tests.
+ *
+ * Stubs `makeRequest` so the tests run with no network. We assert request shape
+ * (method, URL, body, cache options), response unwrapping, the DID derivation,
+ * the EXACT signed payload `linkIdentityKey` produces (it must match the
+ * server's `JSON.stringify({ action, userId, timestamp })` reconstruction
+ * byte-for-byte), and the cache sweep on every mutation.
+ */
+
+import type { AuthMethodsResponse, DidDocument, SignedRecordEnvelope, VerifiedDomain } from '@oxyhq/contracts';
+import { OxyServices } from '../../OxyServices';
+import { KeyManager } from '../../crypto/keyManager';
+import { SignatureService } from '../../crypto/signatureService';
+
+const didDocFixture: DidDocument = {
+  '@context': ['https://www.w3.org/ns/did/v1'],
+  id: 'did:web:oxy.so:u:user-123',
+  controller: ['did:web:oxy.so:u:user-123', 'did:web:oxy.so'],
+  verificationMethod: [],
+  authentication: [],
+  assertionMethod: [],
+  alsoKnownAs: ['acct:nate@oxy.so'],
+  service: [],
+};
+
+const authMethodsFixture: AuthMethodsResponse = {
+  did: 'did:web:oxy.so:u:user-123',
+  methods: [{ type: 'identity', linkedAt: '2026-06-26T00:00:00.000Z', verificationMethodId: '#key-1' }],
+};
+
+const recordFixture: SignedRecordEnvelope = {
+  version: 1,
+  type: 'profile',
+  subject: 'did:web:oxy.so:u:user-123',
+  issuer: 'did:web:oxy.so:u:user-123',
+  record: { displayName: 'Nate' },
+  issuedAt: 1700000000000,
+  publicKey: 'pub-hex',
+  alg: 'ES256K-DER-SHA256',
+  signature: 'sig-hex',
+};
+
+const domainFixture: VerifiedDomain = {
+  domain: 'nate.com',
+  verifiedAt: '2026-06-26T00:00:00.000Z',
+  method: 'dns-txt',
+};
+
+describe('OxyServices.identity', () => {
+  let oxy: OxyServices;
+  let makeRequestSpy: jest.SpyInstance;
+  let clearPrefixSpy: jest.SpyInstance;
+  let clearEntrySpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    makeRequestSpy = jest.spyOn(oxy, 'makeRequest');
+    clearPrefixSpy = jest.spyOn(oxy, 'clearCacheByPrefix').mockReturnValue(0);
+    clearEntrySpy = jest.spyOn(oxy, 'clearCacheEntry').mockReturnValue(undefined);
+    jest.spyOn(oxy, 'getCurrentUserId').mockReturnValue('user-123');
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe('resolveDid', () => {
+    it('GETs the DID document and caches the read', async () => {
+      makeRequestSpy.mockResolvedValue(didDocFixture);
+
+      const result = await oxy.resolveDid('user-123');
+
+      expect(result).toEqual(didDocFixture);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/u/user-123/did.json',
+        undefined,
+        expect.objectContaining({ cache: true }),
+      );
+    });
+
+    it('URL-encodes the userId path segment', async () => {
+      makeRequestSpy.mockResolvedValue(didDocFixture);
+      await oxy.resolveDid('a/b');
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/u/a%2Fb/did.json',
+        undefined,
+        expect.anything(),
+      );
+    });
+  });
+
+  describe('getMyDid / getMyDidDocument', () => {
+    it('derives the current user DID', () => {
+      expect(oxy.getMyDid()).toBe('did:web:oxy.so:u:user-123');
+    });
+
+    it('throws when no user is authenticated', () => {
+      jest.spyOn(oxy, 'getCurrentUserId').mockReturnValue(null);
+      expect(() => oxy.getMyDid()).toThrow(/No authenticated user/);
+    });
+
+    it('resolves the current user DID document', async () => {
+      makeRequestSpy.mockResolvedValue(didDocFixture);
+      const result = await oxy.getMyDidDocument();
+      expect(result).toEqual(didDocFixture);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/u/user-123/did.json',
+        undefined,
+        expect.objectContaining({ cache: true }),
+      );
+    });
+  });
+
+  describe('listAuthMethods', () => {
+    it('GETs /auth/methods', async () => {
+      makeRequestSpy.mockResolvedValue(authMethodsFixture);
+      const result = await oxy.listAuthMethods();
+      expect(result).toEqual(authMethodsFixture);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/auth/methods',
+        undefined,
+        expect.objectContaining({ cache: true }),
+      );
+    });
+  });
+
+  describe('linkIdentityKey', () => {
+    it('signs the exact server-expected payload and POSTs /auth/link', async () => {
+      jest.spyOn(Date, 'now').mockReturnValue(1700000000000);
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue('pub-hex');
+      const signSpy = jest.spyOn(SignatureService, 'sign').mockResolvedValue('sig-hex');
+      makeRequestSpy.mockResolvedValue({ success: true, message: 'Identity linked successfully' });
+
+      const result = await oxy.linkIdentityKey();
+
+      // The signed message MUST match the server's reconstruction byte-for-byte:
+      // JSON.stringify({ action, userId, timestamp }) in that key order.
+      const expectedMessage = JSON.stringify({
+        action: 'link_identity',
+        userId: 'user-123',
+        timestamp: 1700000000000,
+      });
+      expect(signSpy).toHaveBeenCalledWith(expectedMessage);
+      expect(expectedMessage).toBe(
+        '{"action":"link_identity","userId":"user-123","timestamp":1700000000000}',
+      );
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/link',
+        { type: 'identity', publicKey: 'pub-hex', signature: 'sig-hex', timestamp: 1700000000000 },
+        expect.objectContaining({ cache: false }),
+      );
+      expect(result).toEqual({ success: true, message: 'Identity linked successfully' });
+    });
+
+    it('sweeps /users/me, auth methods, domains and the DID cache after linking', async () => {
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue('pub-hex');
+      jest.spyOn(SignatureService, 'sign').mockResolvedValue('sig-hex');
+      makeRequestSpy.mockResolvedValue({ success: true, message: 'ok' });
+
+      await oxy.linkIdentityKey();
+
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/auth/methods');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/identity/domains');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
+    });
+
+    it('throws (no network) when the device has no identity', async () => {
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue(null);
+      await expect(oxy.linkIdentityKey()).rejects.toThrow(/No identity found/);
+      expect(makeRequestSpy).not.toHaveBeenCalled();
+    });
+
+    it('throws when no user is authenticated', async () => {
+      jest.spyOn(oxy, 'getCurrentUserId').mockReturnValue(null);
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue('pub-hex');
+      await expect(oxy.linkIdentityKey()).rejects.toThrow(/No authenticated user/);
+      expect(makeRequestSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('linkPassword', () => {
+    it('POSTs /auth/link with the password method and sweeps cache', async () => {
+      makeRequestSpy.mockResolvedValue({ success: true, message: 'Password auth linked successfully' });
+
+      await oxy.linkPassword('nate@oxy.so', 'sup3r-secret');
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/link',
+        { type: 'password', email: 'nate@oxy.so', password: 'sup3r-secret' },
+        expect.objectContaining({ cache: false }),
+      );
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/auth/methods');
+    });
+  });
+
+  describe('unlinkAuthMethod', () => {
+    it('DELETEs /auth/link/:type and sweeps cache', async () => {
+      makeRequestSpy.mockResolvedValue({ success: true, message: 'identity auth unlinked successfully' });
+
+      await oxy.unlinkAuthMethod('identity');
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'DELETE',
+        '/auth/link/identity',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
+    });
+  });
+
+  describe('signRecord (client-only)', () => {
+    it('signs with the current user DID as subject and does not hit the network', async () => {
+      const signRecordSpy = jest
+        .spyOn(SignatureService, 'signRecord')
+        .mockResolvedValue(recordFixture);
+
+      const result = await oxy.signRecord('profile', { displayName: 'Nate' });
+
+      expect(signRecordSpy).toHaveBeenCalledWith('profile', 'did:web:oxy.so:u:user-123', {
+        displayName: 'Nate',
+      });
+      expect(result).toEqual(recordFixture);
+      expect(makeRequestSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('publishRecord', () => {
+    it('signs then POSTs the envelope to /identity/records', async () => {
+      jest.spyOn(SignatureService, 'signRecord').mockResolvedValue(recordFixture);
+      makeRequestSpy.mockResolvedValue({ envelope: recordFixture, verified: true });
+
+      const result = await oxy.publishRecord('profile', { displayName: 'Nate' });
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/identity/records',
+        recordFixture,
+        expect.objectContaining({ cache: false }),
+      );
+      expect(result).toEqual({ envelope: recordFixture, verified: true });
+    });
+  });
+
+  describe('getRecord / verifyRecord', () => {
+    it('GETs and unwraps the record', async () => {
+      makeRequestSpy.mockResolvedValue({ record: recordFixture });
+      const result = await oxy.getRecord('user-123', 'profile');
+      expect(result).toEqual(recordFixture);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/identity/records/user-123/profile',
+        undefined,
+        expect.objectContaining({ cache: true }),
+      );
+    });
+
+    it('GETs the verify verdict', async () => {
+      makeRequestSpy.mockResolvedValue({ verified: true });
+      const result = await oxy.verifyRecord('user-123', 'identity');
+      expect(result).toEqual({ verified: true });
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/identity/records/user-123/identity/verify',
+        undefined,
+        expect.objectContaining({ cache: true }),
+      );
+    });
+  });
+
+  describe('exportMyData', () => {
+    it('GETs /users/me/export without caching', async () => {
+      const bundle = { $schema: 'x', did: 'did:web:oxy.so:u:user-123' };
+      makeRequestSpy.mockResolvedValue(bundle);
+      const result = await oxy.exportMyData();
+      expect(result).toEqual(bundle);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/users/me/export',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+    });
+  });
+
+  describe('domains', () => {
+    it('requestDomainVerification POSTs the domain', async () => {
+      const instructions = {
+        domain: 'nate.com',
+        token: 'tok',
+        dns: { name: '_oxy-identity.nate.com', value: 'oxy-domain-verification=tok' },
+        wellKnown: { url: 'https://nate.com/.well-known/oxy-domain', body: 'tok' },
+      };
+      makeRequestSpy.mockResolvedValue(instructions);
+
+      const result = await oxy.requestDomainVerification('nate.com');
+
+      expect(result).toEqual(instructions);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/identity/domains',
+        { domain: 'nate.com' },
+        expect.objectContaining({ cache: false }),
+      );
+    });
+
+    it('verifyDomain POSTs to the verify path and sweeps cache', async () => {
+      makeRequestSpy.mockResolvedValue({ verified: true, domain: domainFixture });
+
+      await oxy.verifyDomain('nate.com');
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/identity/domains/nate.com/verify',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
+    });
+
+    it('listDomains GETs and unwraps domains', async () => {
+      makeRequestSpy.mockResolvedValue({ domains: [domainFixture] });
+      const result = await oxy.listDomains();
+      expect(result).toEqual([domainFixture]);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/identity/domains',
+        undefined,
+        expect.objectContaining({ cache: true }),
+      );
+    });
+
+    it('listDomains defaults to an empty array when domains is absent', async () => {
+      makeRequestSpy.mockResolvedValue({});
+      await expect(oxy.listDomains()).resolves.toEqual([]);
+    });
+
+    it('removeDomain DELETEs and sweeps cache', async () => {
+      makeRequestSpy.mockResolvedValue({ success: true });
+
+      await oxy.removeDomain('nate.com');
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'DELETE',
+        '/identity/domains/nate.com',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me');
+      expect(clearEntrySpy).toHaveBeenCalledWith('GET:/u/user-123/did.json');
+    });
+  });
+});

package/src/mixins/__tests__/assetCredentials.test.ts

@@ -0,0 +1,47 @@
+import { OxyServices } from '../../OxyServices';
+
+interface FetchCall {
+  url: string;
+  init: RequestInit | undefined;
+}
+
+describe('asset fetch credentials', () => {
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    jest.restoreAllMocks();
+  });
+
+  it('omits credentials for arbitrary asset content URLs', async () => {
+    const calls: FetchCall[] = [];
+    globalThis.fetch = async (input, init) => {
+      calls.push({ url: String(input), init });
+      return new Response('asset-body', { status: 200 });
+    };
+
+    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+
+    await oxy.fetchAssetContent('https://attacker.oxy.so/cdn/object.txt', 'text');
+
+    expect(calls).toHaveLength(1);
+    expect(calls[0].url).toBe('https://attacker.oxy.so/cdn/object.txt');
+    expect(calls[0].init?.credentials).toBe('omit');
+  });
+
+  it('includes credentials for asset content fetched from the configured API origin', async () => {
+    const calls: FetchCall[] = [];
+    globalThis.fetch = async (input, init) => {
+      calls.push({ url: String(input), init });
+      return new Response('asset-body', { status: 200 });
+    };
+
+    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+
+    await oxy.fetchAssetContent('https://api.oxy.so/assets/private-file/stream', 'text');
+
+    expect(calls).toHaveLength(1);
+    expect(calls[0].url).toBe('https://api.oxy.so/assets/private-file/stream');
+    expect(calls[0].init?.credentials).toBe('include');
+  });
+});

package/src/mixins/__tests__/commonsSignIn.test.ts

@@ -0,0 +1,277 @@
+/**
+ * "Sign in with Oxy" handoff tests (Workstream C).
+ *
+ * Stubs `makeRequest` (and the shared challenge/sign primitives) so the tests
+ * run with no network. We assert the exact request bodies the RP and the
+ * approver send — these are the load-bearing coordination points with the C2
+ * server endpoints — plus the native-vs-web behaviour of the shared-key SSO.
+ */
+
+import type { SessionLoginResponse } from '../../models/session';
+import type { ChallengeResponse } from '../OxyServices.auth';
+import { OxyServices } from '../../OxyServices';
+import { KeyManager } from '../../crypto/keyManager';
+import { SignatureService } from '../../crypto/signatureService';
+
+const challengeFixture: ChallengeResponse = {
+  challenge: 'chal-xyz',
+  expiresAt: '2026-06-26T00:05:00.000Z',
+};
+
+const sessionFixture: SessionLoginResponse = {
+  sessionId: 's1',
+  deviceId: 'd1',
+  expiresAt: '2026-06-26T00:05:00.000Z',
+  accessToken: 'at-1',
+  user: { id: 'u1', username: 'nate', name: { displayName: 'Nate' } },
+};
+
+describe('OxyServices — "Sign in with Oxy" handoff', () => {
+  let oxy: OxyServices;
+  let makeRequestSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    makeRequestSpy = jest.spyOn(oxy, 'makeRequest');
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe('startCommonsSignIn (relying party)', () => {
+    it('generates a client-side sessionToken and POSTs /auth/session/create', async () => {
+      jest.spyOn(Date, 'now').mockReturnValue(1700000000000);
+      jest.spyOn(SignatureService, 'generateChallenge').mockResolvedValue('secret-session-token');
+      makeRequestSpy.mockResolvedValue({
+        authorizeCode: 'code-1',
+        qrPayload: 'oxycommons://approve?v=1&code=code-1',
+        status: 'pending',
+        expiresAt: 1700000300000,
+      });
+
+      const handle = await oxy.startCommonsSignIn({ clientId: 'oxy_dk_test' });
+
+      // expiry is client-proposed (now + 5 min) on the request...
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/session/create',
+        { sessionToken: 'secret-session-token', expiresAt: 1700000300000, clientId: 'oxy_dk_test' },
+        expect.objectContaining({ cache: false }),
+      );
+      // ...and the handle carries the SECRET token + the server's public code/payload.
+      expect(handle).toEqual({
+        sessionToken: 'secret-session-token',
+        authorizeCode: 'code-1',
+        qrPayload: 'oxycommons://approve?v=1&code=code-1',
+        expiresAt: 1700000300000,
+        status: 'pending',
+      });
+      // The secret token must never leak into the QR payload.
+      expect(handle.qrPayload).not.toContain('secret-session-token');
+    });
+
+    it('falls back to the client-proposed expiry when the server omits it', async () => {
+      jest.spyOn(Date, 'now').mockReturnValue(1700000000000);
+      jest.spyOn(SignatureService, 'generateChallenge').mockResolvedValue('tok');
+      makeRequestSpy.mockResolvedValue({
+        authorizeCode: 'code-2',
+        qrPayload: 'oxycommons://approve?v=1&code=code-2',
+        status: 'pending',
+      });
+
+      const handle = await oxy.startCommonsSignIn({ clientId: 'oxy_dk_test' });
+      expect(handle.expiresAt).toBe(1700000000000 + 5 * 60 * 1000);
+    });
+  });
+
+  describe('pollCommonsSignIn (relying party)', () => {
+    it('GETs the session status without cache/retry', async () => {
+      makeRequestSpy.mockResolvedValue({ authorized: true, sessionId: 's1' });
+
+      const result = await oxy.pollCommonsSignIn('secret-session-token');
+
+      expect(result).toEqual({ authorized: true, sessionId: 's1' });
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/auth/session/status/secret-session-token',
+        undefined,
+        expect.objectContaining({ cache: false, retry: false }),
+      );
+    });
+  });
+
+  describe('getCommonsApprovalInfo (approver)', () => {
+    it('GETs the server-resolved approval info by authorizeCode', async () => {
+      const info = {
+        application: {
+          id: 'app1',
+          name: 'Mention',
+          type: 'first_party' as const,
+          isOfficial: true,
+          isInternal: false,
+          scopes: ['profile'],
+        },
+        scopes: ['profile'],
+        boundOrigin: 'https://mention.earth',
+        expiresAt: 1700000300000,
+        status: 'pending',
+      };
+      makeRequestSpy.mockResolvedValue(info);
+
+      const result = await oxy.getCommonsApprovalInfo('code-1');
+
+      expect(result).toEqual(info);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'GET',
+        '/auth/session/approve-info/code-1',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+    });
+  });
+
+  describe('approveCommonsSignIn (approver)', () => {
+    it('requests a challenge, signs with the PRIMARY key, and POSTs authorize-signed', async () => {
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue('pub-primary');
+      const requestChallengeSpy = jest
+        .spyOn(oxy, 'requestChallenge')
+        .mockResolvedValue(challengeFixture);
+      const signChallengeSpy = jest.spyOn(SignatureService, 'signChallenge').mockResolvedValue({
+        challenge: 'sig-primary',
+        publicKey: 'pub-primary',
+        timestamp: 1700000000123,
+      });
+      // authorize-signed is the only network call (challenge is mocked above).
+      makeRequestSpy.mockResolvedValue({ success: true });
+
+      const result = await oxy.approveCommonsSignIn({
+        authorizeCode: 'code-1',
+        deviceName: 'iPhone',
+      });
+
+      expect(requestChallengeSpy).toHaveBeenCalledWith('pub-primary');
+      expect(signChallengeSpy).toHaveBeenCalledWith('chal-xyz');
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/session/authorize-signed/code-1',
+        {
+          publicKey: 'pub-primary',
+          challenge: 'chal-xyz',
+          signature: 'sig-primary',
+          timestamp: 1700000000123,
+          deviceName: 'iPhone',
+        },
+        expect.objectContaining({ cache: false }),
+      );
+      expect(result).toEqual({ success: true });
+    });
+
+    it('omits deviceName/deviceFingerprint when not provided', async () => {
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue('pub-primary');
+      jest.spyOn(oxy, 'requestChallenge').mockResolvedValue(challengeFixture);
+      jest.spyOn(SignatureService, 'signChallenge').mockResolvedValue({
+        challenge: 'sig-primary',
+        publicKey: 'pub-primary',
+        timestamp: 1700000000123,
+      });
+      makeRequestSpy.mockResolvedValue({ success: true });
+
+      await oxy.approveCommonsSignIn({ authorizeCode: 'code-1' });
+
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/session/authorize-signed/code-1',
+        {
+          publicKey: 'pub-primary',
+          challenge: 'chal-xyz',
+          signature: 'sig-primary',
+          timestamp: 1700000000123,
+        },
+        expect.objectContaining({ cache: false }),
+      );
+    });
+
+    it('throws (no network) when the device has no primary identity', async () => {
+      jest.spyOn(KeyManager, 'getPublicKey').mockResolvedValue(null);
+      await expect(oxy.approveCommonsSignIn({ authorizeCode: 'code-1' })).rejects.toThrow(
+        /No identity found/,
+      );
+      expect(makeRequestSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('denyCommonsSignIn (approver)', () => {
+    it('POSTs /auth/session/deny/:authorizeCode', async () => {
+      makeRequestSpy.mockResolvedValue({ success: true });
+
+      const result = await oxy.denyCommonsSignIn('code-1');
+
+      expect(result).toEqual({ success: true });
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/session/deny/code-1',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+    });
+  });
+
+  describe('signInWithSharedIdentity (Mechanism A — same-device SSO)', () => {
+    it('mints a session from the shared key when one exists (native)', async () => {
+      jest.spyOn(KeyManager, 'hasSharedIdentity').mockResolvedValue(true);
+      jest.spyOn(KeyManager, 'getSharedPublicKey').mockResolvedValue('shared-pub');
+      const requestChallengeSpy = jest
+        .spyOn(oxy, 'requestChallenge')
+        .mockResolvedValue({ challenge: 'chal-shared', expiresAt: '2026-06-26T00:05:00.000Z' });
+      jest.spyOn(SignatureService, 'signChallengeWithSharedKey').mockResolvedValue({
+        challenge: 'sig-shared',
+        publicKey: 'shared-pub',
+        timestamp: 1700000000456,
+      });
+      const verifyChallengeSpy = jest
+        .spyOn(oxy, 'verifyChallenge')
+        .mockResolvedValue(sessionFixture);
+
+      const result = await oxy.signInWithSharedIdentity({
+        deviceName: 'iPad',
+        deviceFingerprint: 'fp-1',
+      });
+
+      expect(requestChallengeSpy).toHaveBeenCalledWith('shared-pub');
+      expect(verifyChallengeSpy).toHaveBeenCalledWith(
+        'shared-pub',
+        'chal-shared',
+        'sig-shared',
+        1700000000456,
+        'iPad',
+        'fp-1',
+      );
+      expect(result).toEqual(sessionFixture);
+    });
+
+    it('returns null (no network) when no shared identity exists — the web case', async () => {
+      // hasSharedIdentity() is already false on web; emulate that verdict.
+      jest.spyOn(KeyManager, 'hasSharedIdentity').mockResolvedValue(false);
+      const requestChallengeSpy = jest.spyOn(oxy, 'requestChallenge');
+      const verifyChallengeSpy = jest.spyOn(oxy, 'verifyChallenge');
+
+      const result = await oxy.signInWithSharedIdentity();
+
+      expect(result).toBeNull();
+      expect(requestChallengeSpy).not.toHaveBeenCalled();
+      expect(verifyChallengeSpy).not.toHaveBeenCalled();
+    });
+
+    it('returns null when the shared public key is unexpectedly absent', async () => {
+      jest.spyOn(KeyManager, 'hasSharedIdentity').mockResolvedValue(true);
+      jest.spyOn(KeyManager, 'getSharedPublicKey').mockResolvedValue(null);
+      const verifyChallengeSpy = jest.spyOn(oxy, 'verifyChallenge');
+
+      const result = await oxy.signInWithSharedIdentity();
+
+      expect(result).toBeNull();
+      expect(verifyChallengeSpy).not.toHaveBeenCalled();
+    });
+  });
+});