@oxyhq/core 3.4.8 → 3.4.9

package/dist/cjs/HttpService.js

@@ -207,9 +207,11 @@ class HttpService {
                 const fullUrl = this.buildURL(url, params);
                 // Get auth token (with auto-refresh)
                 const authHeader = await this.getAuthHeader();
-                // Get CSRF token for state-changing requests
+                // CSRF protects cookie-authenticated browser writes. Bearer-authenticated
+                // SDK clients are not vulnerable to ambient-cookie CSRF, and linked app
+                // APIs should not need to implement a duplicate `/csrf-token` route.
                 const isStateChangingMethod = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method);
-                const csrfToken = isStateChangingMethod ? await this.fetchCsrfToken() : null;
+                const csrfToken = isStateChangingMethod && !authHeader ? await this.fetchCsrfToken() : null;
                 // Determine if data is FormData using robust detection
                 const isFormData = this.isFormData(data);
                 // Make fetch request
@@ -240,10 +242,8 @@ class HttpService {
                 if (isNativeApp && isStateChangingMethod) {
                     headers['X-Native-App'] = 'true';
                 }
-                // Debug logging for CSRF issues — routed through the SimpleLogger so
-                // it only fires when consumers opt in via `enableLogging`. Previously
-                // this was a bare console.log that leaked noise into every host app's
-                // stdout in development.
+                // Debug logging for CSRF issues, routed through SimpleLogger so it only
+                // fires when consumers opt in via `enableLogging`.
                 if (isStateChangingMethod) {
                     this.logger.debug('CSRF Debug:', {
                         url,

package/dist/cjs/index.js

@@ -18,9 +18,10 @@
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.createCrossDomainAuth = exports.CrossDomainAuth = exports.createAuthManager = exports.AuthManager = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
-exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = void 0;
-exports.packageInfo = exports.runColdBoot = exports.guardActive = exports.isCentralIdPOrigin = exports.buildSsoBounceUrl = exports.getSsoCallbackBootstrapScript = exports.ssoNavigate = exports.ssoCallbackBootstrapKey = exports.ssoAttemptedKey = exports.ssoNoSessionKey = exports.ssoDestKey = exports.ssoGuardKey = exports.ssoStateKey = exports.SSO_GUARD_TTL_MS = exports.SSO_CALLBACK_PATH = exports.generateSsoState = exports.consumeSsoReturn = exports.parseSsoReturnFragment = exports.resolveCentralAuthUrl = exports.CENTRAL_IDP_APEX = exports.CENTRAL_AUTH_URL = exports.MULTIPART_TLDS = exports.registrableApex = exports.autoDetectAuthWebUrl = exports.getAccountColor = exports.mergeAccountsFromRefreshAll = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = void 0;
+exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.createCrossDomainAuth = exports.CrossDomainAuth = exports.createAuthManager = exports.AuthManager = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
+exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = void 0;
+exports.runColdBoot = exports.guardActive = exports.isCentralIdPOrigin = exports.buildSsoBounceUrl = exports.getSsoCallbackBootstrapScript = exports.ssoNavigate = exports.ssoCallbackBootstrapKey = exports.ssoAttemptedKey = exports.ssoNoSessionKey = exports.ssoDestKey = exports.ssoGuardKey = exports.ssoStateKey = exports.SSO_GUARD_TTL_MS = exports.SSO_CALLBACK_PATH = exports.generateSsoState = exports.consumeSsoReturn = exports.parseSsoReturnFragment = exports.resolveCentralAuthUrl = exports.CENTRAL_IDP_APEX = exports.CENTRAL_AUTH_URL = exports.MULTIPART_TLDS = exports.registrableApex = exports.autoDetectAuthWebUrl = exports.getAccountColor = exports.mergeAccountsFromRefreshAll = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = void 0;
+exports.packageInfo = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -46,6 +47,10 @@ var OxyServices_auth_1 = require("./mixins/OxyServices.auth");
 Object.defineProperty(exports, "ServiceCredentialMismatchError", { enumerable: true, get: function () { return OxyServices_auth_1.ServiceCredentialMismatchError; } });
 var OxyServices_appData_1 = require("./mixins/OxyServices.appData");
 Object.defineProperty(exports, "OxyAppDataIdentifierError", { enumerable: true, get: function () { return OxyServices_appData_1.OxyAppDataIdentifierError; } });
+var userIdentity_1 = require("./utils/userIdentity");
+Object.defineProperty(exports, "getNormalizedUserId", { enumerable: true, get: function () { return userIdentity_1.getNormalizedUserId; } });
+Object.defineProperty(exports, "normalizeUserIdentity", { enumerable: true, get: function () { return userIdentity_1.normalizeUserIdentity; } });
+Object.defineProperty(exports, "normalizeUserIdentityOrNull", { enumerable: true, get: function () { return userIdentity_1.normalizeUserIdentityOrNull; } });
 // ---------------------------------------------------------------------------
 // Auth helpers (token refresh, error normalisation, retry policies)
 // ---------------------------------------------------------------------------

package/dist/cjs/mixins/OxyServices.auth.js

@@ -5,6 +5,7 @@ exports.OxyServicesAuthMixin = OxyServicesAuthMixin;
 const OxyServices_errors_1 = require("../OxyServices.errors");
 const platformCrypto_1 = require("../utils/platformCrypto");
 const loggerUtils_1 = require("../utils/loggerUtils");
+const userIdentity_1 = require("../utils/userIdentity");
 /**
  * Sentinel error raised when getServiceToken() is called with a known apiKey
  * but a non-matching secret. Indicates either credential drift in the caller
@@ -313,7 +314,10 @@ function OxyServicesAuthMixin(Base) {
                 if (res?.accessToken) {
                     this.setTokens(res.accessToken);
                 }
-                return res;
+                return {
+                    ...res,
+                    user: (0, userIdentity_1.normalizeUserIdentity)(res.user),
+                };
             }
             catch (error) {
                 throw this.handleError(error);
@@ -335,7 +339,8 @@ function OxyServicesAuthMixin(Base) {
          */
         async getUserByPublicKey(publicKey) {
             try {
-                return await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, { cache: true, cacheTTL: 2 * 60 * 1000 });
+                const user = await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, { cache: true, cacheTTL: 2 * 60 * 1000 });
+                return (0, userIdentity_1.normalizeUserIdentity)(user);
             }
             catch (error) {
                 throw this.handleError(error);
@@ -346,10 +351,11 @@ function OxyServicesAuthMixin(Base) {
          */
         async getUserBySession(sessionId) {
             try {
-                return await this.makeRequest('GET', `/session/user/${sessionId}`, undefined, {
+                const user = await this.makeRequest('GET', `/session/user/${sessionId}`, undefined, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000,
                 });
+                return (0, userIdentity_1.normalizeUserIdentity)(user);
             }
             catch (error) {
                 throw this.handleError(error);
@@ -364,11 +370,15 @@ function OxyServicesAuthMixin(Base) {
                     return [];
                 }
                 const uniqueSessionIds = Array.from(new Set(sessionIds)).sort();
-                return await this.makeRequest('POST', '/session/users/batch', { sessionIds: uniqueSessionIds }, {
+                const users = await this.makeRequest('POST', '/session/users/batch', { sessionIds: uniqueSessionIds }, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000,
                     deduplicate: true,
                 });
+                return users.map((entry) => ({
+                    ...entry,
+                    user: (0, userIdentity_1.normalizeUserIdentityOrNull)(entry.user),
+                }));
             }
             catch (error) {
                 throw this.handleError(error);
@@ -693,7 +703,11 @@ function OxyServicesAuthMixin(Base) {
                     urlParams.deviceFingerprint = options.deviceFingerprint;
                 if (options.useHeaderValidation)
                     urlParams.useHeaderValidation = 'true';
-                return await this.makeRequest('GET', `/session/validate/${sessionId}`, urlParams, { cache: false });
+                const validation = await this.makeRequest('GET', `/session/validate/${sessionId}`, urlParams, { cache: false });
+                return {
+                    ...validation,
+                    user: (0, userIdentity_1.normalizeUserIdentity)(validation.user),
+                };
             }
             catch (error) {
                 // Session is invalid — clear any cached user data for this session (#196)
@@ -728,13 +742,17 @@ function OxyServicesAuthMixin(Base) {
          */
         async signUp(username, email, password, deviceName, deviceFingerprint) {
             try {
-                return await this.makeRequest('POST', '/auth/signup', {
+                const session = await this.makeRequest('POST', '/auth/signup', {
                     username,
                     email,
                     password,
                     deviceName,
                     deviceFingerprint,
                 }, { cache: false });
+                return {
+                    ...session,
+                    user: (0, userIdentity_1.normalizeUserIdentity)(session.user),
+                };
             }
             catch (error) {
                 throw this.handleError(error);
@@ -745,12 +763,16 @@ function OxyServicesAuthMixin(Base) {
          */
         async signIn(identifier, password, deviceName, deviceFingerprint) {
             try {
-                return await this.makeRequest('POST', '/auth/login', {
+                const session = await this.makeRequest('POST', '/auth/login', {
                     identifier,
                     password,
                     deviceName,
                     deviceFingerprint,
                 }, { cache: false });
+                return {
+                    ...session,
+                    user: (0, userIdentity_1.normalizeUserIdentity)(session.user),
+                };
             }
             catch (error) {
                 throw this.handleError(error);

package/dist/cjs/mixins/OxyServices.fedcm.js

@@ -4,6 +4,7 @@ exports.OxyServicesFedCMMixin = OxyServicesFedCMMixin;
 exports.FedCMMixin = OxyServicesFedCMMixin;
 const OxyServices_errors_1 = require("../OxyServices.errors");
 const debugUtils_1 = require("../shared/utils/debugUtils");
+const userIdentity_1 = require("../utils/userIdentity");
 const debug = (0, debugUtils_1.createDebugLogger)('FedCM');
 // Modern (W3C spec) → legacy (Chrome 125–131) mode value mapping. Used to
 // retry a credential request when an older browser rejects the modern enum.
@@ -589,7 +590,10 @@ function OxyServicesFedCMMixin(Base) {
                         hasSession: !!response?.sessionId,
                         hasUser: !!response?.user,
                     });
-                    return response;
+                    return {
+                        ...response,
+                        user: (0, userIdentity_1.normalizeUserIdentity)(response.user),
+                    };
                 }
                 catch (error) {
                     debug.error('Token exchange failed:', error instanceof Error ? error.message : String(error));

package/dist/cjs/mixins/OxyServices.user.js

@@ -4,6 +4,7 @@ exports.OxyServicesUserMixin = OxyServicesUserMixin;
 const apiUtils_1 = require("../utils/apiUtils");
 const keyManager_1 = require("../crypto/keyManager");
 const signatureService_1 = require("../crypto/signatureService");
+const userIdentity_1 = require("../utils/userIdentity");
 function OxyServicesUserMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -14,10 +15,11 @@ function OxyServicesUserMixin(Base) {
          */
         async getProfileByUsername(username) {
             try {
-                return await this.makeRequest('GET', `/profiles/username/${username}`, undefined, {
+                const user = await this.makeRequest('GET', `/profiles/username/${username}`, undefined, {
                     cache: true,
                     cacheTTL: 5 * 60 * 1000, // 5 minutes cache for profiles
                 });
+                return (0, userIdentity_1.normalizeUserIdentity)(user);
             }
             catch (error) {
                 throw this.handleError(error);
@@ -80,7 +82,7 @@ function OxyServicesUserMixin(Base) {
                     cache: true,
                     cacheTTL: 24 * 60 * 60 * 1000, // 24h cache — matches server-side staleness window
                 });
-                return result ?? null;
+                return (0, userIdentity_1.normalizeUserIdentityOrNull)(result);
             }
             catch {
                 return null;
@@ -92,7 +94,7 @@ function OxyServicesUserMixin(Base) {
          * method — calling services never write user data directly.
          */
         async resolveExternalUser(data) {
-            return this.makeRequest('PUT', '/users/resolve', data);
+            return (0, userIdentity_1.normalizeUserIdentity)(await this.makeRequest('PUT', '/users/resolve', data));
         }
         /**
          * Get profile recommendations, optionally filtering out specific user types.
@@ -122,20 +124,22 @@ function OxyServicesUserMixin(Base) {
             const params = {};
             if (limit)
                 params.limit = String(limit);
-            return await this.makeRequest('GET', `/profiles/${userId}/similar`, params, {
+            const users = await this.makeRequest('GET', `/profiles/${userId}/similar`, params, {
                 cache: true,
                 cacheTTL: 5 * 60 * 1000, // 5 min cache
             });
+            return users.map((user) => (0, userIdentity_1.normalizeUserIdentity)(user));
         }
         /**
          * Get user by ID
          */
         async getUserById(userId) {
             try {
-                return await this.makeRequest('GET', `/users/${userId}`, undefined, {
+                const user = await this.makeRequest('GET', `/users/${userId}`, undefined, {
                     cache: true,
                     cacheTTL: 5 * 60 * 1000, // 5 minutes cache
                 });
+                return (0, userIdentity_1.normalizeUserIdentity)(user);
             }
             catch (error) {
                 throw this.handleError(error);
@@ -146,10 +150,11 @@ function OxyServicesUserMixin(Base) {
          */
         async getCurrentUser() {
             return this.withAuthRetry(async () => {
-                return await this.makeRequest('GET', '/users/me', undefined, {
+                const user = await this.makeRequest('GET', '/users/me', undefined, {
                     cache: true,
                     cacheTTL: 1 * 60 * 1000, // 1 minute cache for current user
                 });
+                return (0, userIdentity_1.normalizeUserIdentity)(user);
             }, 'getCurrentUser');
         }
         /**
@@ -167,7 +172,7 @@ function OxyServicesUserMixin(Base) {
          */
         async updateProfile(updates) {
             try {
-                const result = await this.makeRequest('PUT', '/users/me', updates, { cache: false });
+                const result = (0, userIdentity_1.normalizeUserIdentity)(await this.makeRequest('PUT', '/users/me', updates, { cache: false }));
                 // Bust every cached representation of the current user. We use a
                 // prefix sweep rather than an enumeration because the SDK never
                 // tracks the set of active session IDs centrally.

package/dist/cjs/utils/userIdentity.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getNormalizedUserId = getNormalizedUserId;
+exports.normalizeUserIdentity = normalizeUserIdentity;
+exports.normalizeUserIdentityOrNull = normalizeUserIdentityOrNull;
+function stringifyIdentity(value) {
+    if (typeof value === 'string') {
+        const trimmed = value.trim();
+        return trimmed.length > 0 ? trimmed : null;
+    }
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        return String(value);
+    }
+    if (value && typeof value === 'object' && 'toString' in value) {
+        const toStringFn = value.toString;
+        if (typeof toStringFn === 'function' && toStringFn !== Object.prototype.toString) {
+            const rendered = toStringFn.call(value);
+            if (typeof rendered === 'string') {
+                const trimmed = rendered.trim();
+                return trimmed.length > 0 && trimmed !== '[object Object]' ? trimmed : null;
+            }
+        }
+    }
+    return null;
+}
+function getNormalizedUserId(user) {
+    if (!user) {
+        return null;
+    }
+    return stringifyIdentity(user.id) ?? stringifyIdentity(user._id);
+}
+function normalizeUserIdentity(user) {
+    const id = getNormalizedUserId(user);
+    if (!id) {
+        throw new Error('User response missing id');
+    }
+    return { ...user, id };
+}
+function normalizeUserIdentityOrNull(user) {
+    return user ? normalizeUserIdentity(user) : null;
+}