@oxyhq/core 3.4.8 → 3.4.9

package/dist/esm/HttpService.js

@@ -204,9 +204,11 @@ export class HttpService {
                 const fullUrl = this.buildURL(url, params);
                 // Get auth token (with auto-refresh)
                 const authHeader = await this.getAuthHeader();
-                // Get CSRF token for state-changing requests
+                // CSRF protects cookie-authenticated browser writes. Bearer-authenticated
+                // SDK clients are not vulnerable to ambient-cookie CSRF, and linked app
+                // APIs should not need to implement a duplicate `/csrf-token` route.
                 const isStateChangingMethod = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method);
-                const csrfToken = isStateChangingMethod ? await this.fetchCsrfToken() : null;
+                const csrfToken = isStateChangingMethod && !authHeader ? await this.fetchCsrfToken() : null;
                 // Determine if data is FormData using robust detection
                 const isFormData = this.isFormData(data);
                 // Make fetch request
@@ -237,10 +239,8 @@ export class HttpService {
                 if (isNativeApp && isStateChangingMethod) {
                     headers['X-Native-App'] = 'true';
                 }
-                // Debug logging for CSRF issues — routed through the SimpleLogger so
-                // it only fires when consumers opt in via `enableLogging`. Previously
-                // this was a bare console.log that leaked noise into every host app's
-                // stdout in development.
+                // Debug logging for CSRF issues, routed through SimpleLogger so it only
+                // fires when consumers opt in via `enableLogging`.
                 if (isStateChangingMethod) {
                     this.logger.debug('CSRF Debug:', {
                         url,

package/dist/esm/index.js

@@ -30,6 +30,7 @@ export { AuthManager, createAuthManager } from './AuthManager.js';
 export { CrossDomainAuth, createCrossDomainAuth } from './CrossDomainAuth.js';
 export { ServiceCredentialMismatchError } from './mixins/OxyServices.auth.js';
 export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData.js';
+export { getNormalizedUserId, normalizeUserIdentity, normalizeUserIdentityOrNull } from './utils/userIdentity.js';
 // ---------------------------------------------------------------------------
 // Auth helpers (token refresh, error normalisation, retry policies)
 // ---------------------------------------------------------------------------

package/dist/esm/mixins/OxyServices.auth.js

@@ -1,6 +1,7 @@
 import { OxyAuthenticationError } from '../OxyServices.errors.js';
 import { loadNodeCrypto } from '../utils/platformCrypto.js';
 import { logger } from '../utils/loggerUtils.js';
+import { normalizeUserIdentity, normalizeUserIdentityOrNull } from '../utils/userIdentity.js';
 /**
  * Sentinel error raised when getServiceToken() is called with a known apiKey
  * but a non-matching secret. Indicates either credential drift in the caller
@@ -308,7 +309,10 @@ export function OxyServicesAuthMixin(Base) {
                 if (res?.accessToken) {
                     this.setTokens(res.accessToken);
                 }
-                return res;
+                return {
+                    ...res,
+                    user: normalizeUserIdentity(res.user),
+                };
             }
             catch (error) {
                 throw this.handleError(error);
@@ -330,7 +334,8 @@ export function OxyServicesAuthMixin(Base) {
          */
         async getUserByPublicKey(publicKey) {
             try {
-                return await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, { cache: true, cacheTTL: 2 * 60 * 1000 });
+                const user = await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, { cache: true, cacheTTL: 2 * 60 * 1000 });
+                return normalizeUserIdentity(user);
             }
             catch (error) {
                 throw this.handleError(error);
@@ -341,10 +346,11 @@ export function OxyServicesAuthMixin(Base) {
          */
         async getUserBySession(sessionId) {
             try {
-                return await this.makeRequest('GET', `/session/user/${sessionId}`, undefined, {
+                const user = await this.makeRequest('GET', `/session/user/${sessionId}`, undefined, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000,
                 });
+                return normalizeUserIdentity(user);
             }
             catch (error) {
                 throw this.handleError(error);
@@ -359,11 +365,15 @@ export function OxyServicesAuthMixin(Base) {
                     return [];
                 }
                 const uniqueSessionIds = Array.from(new Set(sessionIds)).sort();
-                return await this.makeRequest('POST', '/session/users/batch', { sessionIds: uniqueSessionIds }, {
+                const users = await this.makeRequest('POST', '/session/users/batch', { sessionIds: uniqueSessionIds }, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000,
                     deduplicate: true,
                 });
+                return users.map((entry) => ({
+                    ...entry,
+                    user: normalizeUserIdentityOrNull(entry.user),
+                }));
             }
             catch (error) {
                 throw this.handleError(error);
@@ -688,7 +698,11 @@ export function OxyServicesAuthMixin(Base) {
                     urlParams.deviceFingerprint = options.deviceFingerprint;
                 if (options.useHeaderValidation)
                     urlParams.useHeaderValidation = 'true';
-                return await this.makeRequest('GET', `/session/validate/${sessionId}`, urlParams, { cache: false });
+                const validation = await this.makeRequest('GET', `/session/validate/${sessionId}`, urlParams, { cache: false });
+                return {
+                    ...validation,
+                    user: normalizeUserIdentity(validation.user),
+                };
             }
             catch (error) {
                 // Session is invalid — clear any cached user data for this session (#196)
@@ -723,13 +737,17 @@ export function OxyServicesAuthMixin(Base) {
          */
         async signUp(username, email, password, deviceName, deviceFingerprint) {
             try {
-                return await this.makeRequest('POST', '/auth/signup', {
+                const session = await this.makeRequest('POST', '/auth/signup', {
                     username,
                     email,
                     password,
                     deviceName,
                     deviceFingerprint,
                 }, { cache: false });
+                return {
+                    ...session,
+                    user: normalizeUserIdentity(session.user),
+                };
             }
             catch (error) {
                 throw this.handleError(error);
@@ -740,12 +758,16 @@ export function OxyServicesAuthMixin(Base) {
          */
         async signIn(identifier, password, deviceName, deviceFingerprint) {
             try {
-                return await this.makeRequest('POST', '/auth/login', {
+                const session = await this.makeRequest('POST', '/auth/login', {
                     identifier,
                     password,
                     deviceName,
                     deviceFingerprint,
                 }, { cache: false });
+                return {
+                    ...session,
+                    user: normalizeUserIdentity(session.user),
+                };
             }
             catch (error) {
                 throw this.handleError(error);

package/dist/esm/mixins/OxyServices.fedcm.js

@@ -1,5 +1,6 @@
 import { OxyAuthenticationError } from '../OxyServices.errors.js';
 import { createDebugLogger } from '../shared/utils/debugUtils.js';
+import { normalizeUserIdentity } from '../utils/userIdentity.js';
 const debug = createDebugLogger('FedCM');
 // Modern (W3C spec) → legacy (Chrome 125–131) mode value mapping. Used to
 // retry a credential request when an older browser rejects the modern enum.
@@ -585,7 +586,10 @@ export function OxyServicesFedCMMixin(Base) {
                         hasSession: !!response?.sessionId,
                         hasUser: !!response?.user,
                     });
-                    return response;
+                    return {
+                        ...response,
+                        user: normalizeUserIdentity(response.user),
+                    };
                 }
                 catch (error) {
                     debug.error('Token exchange failed:', error instanceof Error ? error.message : String(error));

package/dist/esm/mixins/OxyServices.user.js

@@ -1,6 +1,7 @@
 import { buildSearchParams, buildPaginationParams } from '../utils/apiUtils.js';
 import { KeyManager } from '../crypto/keyManager.js';
 import { SignatureService } from '../crypto/signatureService.js';
+import { normalizeUserIdentity, normalizeUserIdentityOrNull } from '../utils/userIdentity.js';
 export function OxyServicesUserMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -11,10 +12,11 @@ export function OxyServicesUserMixin(Base) {
          */
         async getProfileByUsername(username) {
             try {
-                return await this.makeRequest('GET', `/profiles/username/${username}`, undefined, {
+                const user = await this.makeRequest('GET', `/profiles/username/${username}`, undefined, {
                     cache: true,
                     cacheTTL: 5 * 60 * 1000, // 5 minutes cache for profiles
                 });
+                return normalizeUserIdentity(user);
             }
             catch (error) {
                 throw this.handleError(error);
@@ -77,7 +79,7 @@ export function OxyServicesUserMixin(Base) {
                     cache: true,
                     cacheTTL: 24 * 60 * 60 * 1000, // 24h cache — matches server-side staleness window
                 });
-                return result ?? null;
+                return normalizeUserIdentityOrNull(result);
             }
             catch {
                 return null;
@@ -89,7 +91,7 @@ export function OxyServicesUserMixin(Base) {
          * method — calling services never write user data directly.
          */
         async resolveExternalUser(data) {
-            return this.makeRequest('PUT', '/users/resolve', data);
+            return normalizeUserIdentity(await this.makeRequest('PUT', '/users/resolve', data));
         }
         /**
          * Get profile recommendations, optionally filtering out specific user types.
@@ -119,20 +121,22 @@ export function OxyServicesUserMixin(Base) {
             const params = {};
             if (limit)
                 params.limit = String(limit);
-            return await this.makeRequest('GET', `/profiles/${userId}/similar`, params, {
+            const users = await this.makeRequest('GET', `/profiles/${userId}/similar`, params, {
                 cache: true,
                 cacheTTL: 5 * 60 * 1000, // 5 min cache
             });
+            return users.map((user) => normalizeUserIdentity(user));
         }
         /**
          * Get user by ID
          */
         async getUserById(userId) {
             try {
-                return await this.makeRequest('GET', `/users/${userId}`, undefined, {
+                const user = await this.makeRequest('GET', `/users/${userId}`, undefined, {
                     cache: true,
                     cacheTTL: 5 * 60 * 1000, // 5 minutes cache
                 });
+                return normalizeUserIdentity(user);
             }
             catch (error) {
                 throw this.handleError(error);
@@ -143,10 +147,11 @@ export function OxyServicesUserMixin(Base) {
          */
         async getCurrentUser() {
             return this.withAuthRetry(async () => {
-                return await this.makeRequest('GET', '/users/me', undefined, {
+                const user = await this.makeRequest('GET', '/users/me', undefined, {
                     cache: true,
                     cacheTTL: 1 * 60 * 1000, // 1 minute cache for current user
                 });
+                return normalizeUserIdentity(user);
             }, 'getCurrentUser');
         }
         /**
@@ -164,7 +169,7 @@ export function OxyServicesUserMixin(Base) {
          */
         async updateProfile(updates) {
             try {
-                const result = await this.makeRequest('PUT', '/users/me', updates, { cache: false });
+                const result = normalizeUserIdentity(await this.makeRequest('PUT', '/users/me', updates, { cache: false }));
                 // Bust every cached representation of the current user. We use a
                 // prefix sweep rather than an enumeration because the SDK never
                 // tracks the set of active session IDs centrally.

package/dist/esm/utils/userIdentity.js

@@ -0,0 +1,36 @@
+function stringifyIdentity(value) {
+    if (typeof value === 'string') {
+        const trimmed = value.trim();
+        return trimmed.length > 0 ? trimmed : null;
+    }
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        return String(value);
+    }
+    if (value && typeof value === 'object' && 'toString' in value) {
+        const toStringFn = value.toString;
+        if (typeof toStringFn === 'function' && toStringFn !== Object.prototype.toString) {
+            const rendered = toStringFn.call(value);
+            if (typeof rendered === 'string') {
+                const trimmed = rendered.trim();
+                return trimmed.length > 0 && trimmed !== '[object Object]' ? trimmed : null;
+            }
+        }
+    }
+    return null;
+}
+export function getNormalizedUserId(user) {
+    if (!user) {
+        return null;
+    }
+    return stringifyIdentity(user.id) ?? stringifyIdentity(user._id);
+}
+export function normalizeUserIdentity(user) {
+    const id = getNormalizedUserId(user);
+    if (!id) {
+        throw new Error('User response missing id');
+    }
+    return { ...user, id };
+}
+export function normalizeUserIdentityOrNull(user) {
+    return user ? normalizeUserIdentity(user) : null;
+}