@oxyhq/core 3.15.0 → 3.16.0

package/src/mixins/__tests__/commonsSignIn.test.ts

@@ -102,26 +102,27 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
   });
 
   describe('getCommonsApprovalInfo (approver)', () => {
-    it('GETs the server-resolved approval info by authorizeCode', async () => {
-      const info = {
-        application: {
-          id: 'app1',
-          name: 'Mention',
-          type: 'first_party' as const,
-          isOfficial: true,
-          isInternal: false,
-          scopes: ['profile'],
-        },
+    const baseInfo = {
+      application: {
+        id: 'app1',
+        name: 'Mention',
+        type: 'first_party' as const,
+        isOfficial: true,
+        isInternal: false,
         scopes: ['profile'],
-        boundOrigin: 'https://mention.earth',
-        expiresAt: 1700000300000,
-        status: 'pending',
-      };
-      makeRequestSpy.mockResolvedValue(info);
+      },
+      scopes: ['profile'],
+      boundOrigin: 'https://mention.earth',
+      expiresAt: 1700000300000,
+      status: 'pending',
+    };
+
+    it('GETs the server-resolved approval info by authorizeCode', async () => {
+      makeRequestSpy.mockResolvedValue({ ...baseInfo, originVerified: true });
 
       const result = await oxy.getCommonsApprovalInfo('code-1');
 
-      expect(result).toEqual(info);
+      expect(result).toEqual({ ...baseInfo, originVerified: true });
       expect(makeRequestSpy).toHaveBeenCalledWith(
         'GET',
         '/auth/session/approve-info/code-1',
@@ -129,6 +130,30 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
         expect.objectContaining({ cache: false }),
       );
     });
+
+    it('coerces a missing originVerified to false (fail-safe to "not verified")', async () => {
+      makeRequestSpy.mockResolvedValue(baseInfo);
+
+      const result = await oxy.getCommonsApprovalInfo('code-1');
+
+      expect(result.originVerified).toBe(false);
+    });
+
+    it('coerces a non-boolean originVerified to false', async () => {
+      makeRequestSpy.mockResolvedValue({ ...baseInfo, originVerified: 'yes' });
+
+      const result = await oxy.getCommonsApprovalInfo('code-1');
+
+      expect(result.originVerified).toBe(false);
+    });
+
+    it('passes through a server originVerified:false unchanged', async () => {
+      makeRequestSpy.mockResolvedValue({ ...baseInfo, originVerified: false });
+
+      const result = await oxy.getCommonsApprovalInfo('code-1');
+
+      expect(result.originVerified).toBe(false);
+    });
   });
 
   describe('approveCommonsSignIn (approver)', () => {

package/src/mixins/__tests__/getFileDownloadUrl.test.ts

@@ -7,10 +7,9 @@
  *   - PUBLIC (no access token planted, no `expiresIn`) → the clean CDN form
  *     `${cloudURL}/<id>[?variant=...]` (default `https://cloud.oxy.so/<id>`),
  *     which CloudFront resolves against the public media origin.
- *   - SIGNED / PRIVATE (an access token is present OR `expiresIn` is passed) →
- *     the authenticated API origin form
- *     `${baseURL}/assets/<id>/stream?...&token=...` — private assets are not on
- *     the public CDN.
+ *   - EXPIRING ORIGIN FALLBACK (`expiresIn` is passed) → the API origin
+ *     stream form without a bearer token in the query string. Callers that need
+ *     private access should use `getFileDownloadUrlAsync()` for a scoped URL.
  */
 
 import { OxyServices } from '../../OxyServices';
@@ -50,38 +49,24 @@ describe('OxyServices.getFileDownloadUrl', () => {
       );
     });
 
-    it('can omit the token for persisted public image URLs while authenticated', () => {
+  });
+
+  describe('token-safe URL generation', () => {
+    it('does not include the in-memory access token in synchronous image URLs', () => {
       const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
       oxy.setTokens('access-token-abc');
 
-      const url = oxy.getFileDownloadUrl('file123', 'thumb', undefined, {
-        omitToken: true,
-      });
+      const url = oxy.getFileDownloadUrl('file123', 'thumb');
 
       expect(url).toBe('https://cloud.oxy.so/file123?variant=thumb');
       expect(url).not.toContain('access-token-abc');
       expect(url).not.toContain('token=');
     });
-  });
 
-  describe('signed / private assets → authenticated API origin', () => {
-    it('returns the stream endpoint with the token when an access token is present', () => {
+    it('routes through the stream endpoint when expiresIn is requested without embedding a token', () => {
       const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
       oxy.setTokens('access-token-abc');
 
-      const url = oxy.getFileDownloadUrl('file123', 'thumb');
-
-      expect(url.startsWith('https://api.oxy.so/assets/file123/stream?')).toBe(true);
-      const params = new URLSearchParams(url.split('?')[1]);
-      expect(params.get('variant')).toBe('thumb');
-      expect(params.get('token')).toBe('access-token-abc');
-      expect(params.get('fallback')).toBe('placeholderVisible');
-      expect(url).not.toContain('cloud.oxy.so');
-    });
-
-    it('routes through the stream endpoint when expiresIn is requested even without a token', () => {
-      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-
       const url = oxy.getFileDownloadUrl('file123', 'thumb', 3600);
 
       expect(url.startsWith('https://api.oxy.so/assets/file123/stream?')).toBe(true);
@@ -90,6 +75,7 @@ describe('OxyServices.getFileDownloadUrl', () => {
       expect(params.get('variant')).toBe('thumb');
       expect(params.get('fallback')).toBe('placeholderVisible');
       expect(params.get('token')).toBeNull();
+      expect(url).not.toContain('access-token-abc');
       expect(url).not.toContain('cloud.oxy.so');
     });
   });

package/src/mixins/index.ts

@@ -32,6 +32,7 @@ import { OxyServicesContactsMixin } from './OxyServices.contacts';
 import { OxyServicesAppDataMixin } from './OxyServices.appData';
 import { OxyServicesCivicMixin } from './OxyServices.civic';
 import { OxyServicesNodesMixin } from './OxyServices.nodes';
+import { OxyServicesLinksMixin } from './OxyServices.links';
 
 /**
  * Instance shape of every mixin in the pipeline, intersected. The runtime
@@ -68,6 +69,7 @@ type AllMixinInstances =
   & InstanceType<ReturnType<typeof OxyServicesAppDataMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesCivicMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesNodesMixin<typeof OxyServicesBase>>>
+  & InstanceType<ReturnType<typeof OxyServicesLinksMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesUtilityMixin<typeof OxyServicesBase>>>;
 
 /**
@@ -139,6 +141,9 @@ const MIXIN_PIPELINE: MixinFunction[] = [
     // User nodes / decentralization (Fase 5): register/read/revoke/manage the
     // caller's personal data node + ingest hint.
     OxyServicesNodesMixin,
+    // Link previews / unfurls: SDK-owned link-metadata resolution via oxy-api,
+    // so apps stop scraping link metadata locally.
+    OxyServicesLinksMixin,
 
     // Utility (last, can use all above)
     OxyServicesUtilityMixin,