@oxyhq/core 3.9.1 → 3.10.1

package/src/mixins/OxyServices.utility.ts

@@ -856,8 +856,8 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
             return next(new Error('Invalid token'));
           }
 
-          const userId = decoded.userId || decoded.id;
-          if (!userId) {
+          const claimedUserId = decoded.userId || decoded.id;
+          if (!claimedUserId) {
             return next(new Error('Invalid token payload'));
           }
 
@@ -866,24 +866,39 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
             return next(new Error('Token expired'));
           }
 
-          // Validate session if available
-          if (decoded.sessionId) {
-            try {
-              const result = await oxyInstance.validateSession(decoded.sessionId, {
-                useHeaderValidation: true,
-              });
-              if (!result || !result.valid) {
-                return next(new Error('Session invalid'));
-              }
-            } catch (validateErr) {
-              if (debug) {
-                logger.debug('[oxy.authSocket] Session validation failed', {
-                  component: 'auth',
-                  method: 'authSocket',
-                }, validateErr);
-              }
-              return next(new Error('Session validation failed'));
+          // A server-validated session is mandatory. A bare decoded JWT proves
+          // nothing — the signature is not verified here, so without a session
+          // round-trip a forged token could claim any user id.
+          if (!decoded.sessionId) {
+            return next(new Error('Session required'));
+          }
+
+          let userId = claimedUserId;
+          try {
+            const result = await oxyInstance.validateSession(decoded.sessionId, {
+              useHeaderValidation: true,
+            });
+            if (!result || !result.valid || !result.user) {
+              return next(new Error('Session invalid'));
             }
+
+            // The session is the source of truth. The client-claimed user id
+            // must match the server-validated identity, otherwise a valid
+            // session could be paired with a forged user id.
+            const validatedUserId = getUserIdentityId(result.user);
+            if (!validatedUserId || validatedUserId !== claimedUserId) {
+              return next(new Error('Session user mismatch'));
+            }
+
+            userId = validatedUserId;
+          } catch (validateErr) {
+            if (debug) {
+              logger.debug('[oxy.authSocket] Session validation failed', {
+                component: 'auth',
+                method: 'authSocket',
+              }, validateErr);
+            }
+            return next(new Error('Session validation failed'));
           }
 
           // Attach user data to socket. We expose BOTH `socket.data.userId`
@@ -953,9 +968,9 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
      * Express.js middleware that enforces a specific service-token scope.
      *
      * Mount AFTER `auth()` / `serviceAuth()` — relies on `req.serviceApp` and
-     * (when delegation is in effect) `req.serviceActingAs.scopes`. The scope
-     * is granted if EITHER list contains it, mirroring the OAuth2 model where
-     * the app's app-level scopes and the per-user delegated scopes both count.
+     * (when delegation is in effect) `req.serviceActingAs.scopes`. App-only
+     * service requests require the app scope. Delegated user requests require
+     * BOTH the app scope and the per-user delegation scope.
      *
      * Requests authenticated as a regular user (no service token) are rejected
      * with 403 — scope-protected endpoints are service-to-service by design.
@@ -988,7 +1003,13 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
           return;
         }
 
-        if (appScopes.includes(scope) || delegatedScopes.includes(scope)) {
+        const appHasScope = appScopes.includes(scope);
+        const delegationHasScope = delegatedScopes.includes(scope);
+        const hasRequiredScope = req.serviceActingAs
+          ? appHasScope && delegationHasScope
+          : appHasScope;
+
+        if (hasRequiredScope) {
           next();
           return;
         }
@@ -1051,6 +1072,19 @@ async function verifyServiceTokenSignature(token: string, secret: string): Promi
  * access token signed by the same shared secret could be replayed as a
  * service token because no claim binding existed.
  */
+/**
+ * Resolve the canonical user id from a validated session's user object.
+ *
+ * The API serializer emits `id`, but some upstream shapes carry the raw Mongo
+ * `_id` instead. We accept either, but only a non-empty string — anything else
+ * means the validated identity is unusable and the caller must reject.
+ */
+function getUserIdentityId(user: User): string | null {
+  const candidate = (user as { id?: unknown; _id?: unknown }).id
+    ?? (user as { id?: unknown; _id?: unknown })._id;
+  return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
+}
+
 function verifyServiceTokenClaims(
   decoded: JwtPayload,
   expected: { audience: string; issuer: string },

package/src/mixins/__tests__/assetUpload.test.ts

@@ -0,0 +1,191 @@
+/**
+ * `OxyServices.assetUpload()` multipart-body tests.
+ *
+ * `assetUpload` accepts three input shapes: a web `File`, a web `Blob`, or a
+ * React Native `{ uri, type?, name?, size? }` descriptor. The descriptor path
+ * is platform-sensitive:
+ *
+ *   - React Native — RN's FormData reads the file from disk via the uri during
+ *     the multipart request, so the descriptor is appended as-is.
+ *   - Web (browser/Node) — the browser's FormData CANNOT read bytes from a plain
+ *     `{ uri }` object (it would serialize `[object Object]` → the server stores
+ *     a 0-byte asset). The uri must be materialized into a real `Blob` via
+ *     `fetch` before appending. An empty fetched blob must throw instead of
+ *     silently uploading an empty asset.
+ *
+ * These tests assert exactly which value lands in the FormData `file` part for
+ * each platform, and that an empty web source is rejected.
+ */
+
+import { OxyServices } from '../../OxyServices';
+
+/**
+ * Captures every `FormData.append` call so a test can inspect the multipart body
+ * that `assetUpload` built without sending a real network request.
+ */
+function captureUpload(oxy: OxyServices) {
+  const appended: Array<{ name: string; value: unknown; fileName?: string }> = [];
+  // Capture-only: do NOT delegate to the real (undici) FormData.append. Node's
+  // undici rejects a plain { uri } object as not-a-Blob, but real React Native
+  // FormData accepts it — the test asserts on captured args, not a built body.
+  const appendSpy = jest
+    .spyOn(FormData.prototype, 'append')
+    .mockImplementation(function (this: FormData, name: string, value: unknown, fileName?: string) {
+      appended.push({ name, value, fileName });
+    });
+
+  const requestSpy = jest
+    .spyOn(oxy.getClient(), 'request')
+    .mockResolvedValue({ file: { id: 'asset123' } } as never);
+
+  return {
+    appended,
+    requestSpy,
+    restore: () => {
+      appendSpy.mockRestore();
+      requestSpy.mockRestore();
+    },
+  };
+}
+
+describe('OxyServices.assetUpload — uri descriptor', () => {
+  const originalNavigator = (globalThis as { navigator?: unknown }).navigator;
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    if (originalNavigator === undefined) {
+      delete (globalThis as { navigator?: unknown }).navigator;
+    } else {
+      (globalThis as { navigator?: unknown }).navigator = originalNavigator;
+    }
+    globalThis.fetch = originalFetch;
+  });
+
+  describe('web (NOT React Native)', () => {
+    beforeEach(() => {
+      // Node/jsdom-like: no React Native navigator → isReactNative() === false.
+      delete (globalThis as { navigator?: unknown }).navigator;
+    });
+
+    it('materializes a blob: uri into a real, non-empty Blob before appending', async () => {
+      const bytes = new Blob([new Uint8Array([1, 2, 3, 4, 5])], { type: 'image/png' });
+      const fetchMock = jest
+        .fn()
+        .mockResolvedValue({ ok: true, status: 200, blob: async () => bytes });
+      globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+      const capture = captureUpload(oxy);
+
+      try {
+        await oxy.assetUpload({ uri: 'blob:https://app.test/abc', type: 'image/png', name: 'avatar.png' });
+
+        expect(fetchMock).toHaveBeenCalledWith('blob:https://app.test/abc');
+
+        const filePart = capture.appended.find((p) => p.name === 'file');
+        expect(filePart).toBeDefined();
+        // The appended value is the fetched Blob with real bytes — NOT the { uri } object.
+        expect(filePart?.value).toBeInstanceOf(Blob);
+        expect((filePart?.value as Blob).size).toBe(5);
+        expect((filePart?.value as { uri?: string }).uri).toBeUndefined();
+        expect(filePart?.fileName).toBe('avatar.png');
+      } finally {
+        capture.restore();
+      }
+    });
+
+    it('wraps a typeless fetched blob with the descriptor MIME type', async () => {
+      const typeless = new Blob([new Uint8Array([9, 9, 9])]); // type === ''
+      const fetchMock = jest
+        .fn()
+        .mockResolvedValue({ ok: true, status: 200, blob: async () => typeless });
+      globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+      const capture = captureUpload(oxy);
+
+      try {
+        await oxy.assetUpload({ uri: 'data:application/octet-stream;base64,CQkJ', type: 'image/jpeg', name: 'x.jpg' });
+
+        const filePart = capture.appended.find((p) => p.name === 'file');
+        expect(filePart?.value).toBeInstanceOf(Blob);
+        expect((filePart?.value as Blob).size).toBe(3);
+        expect((filePart?.value as Blob).type).toBe('image/jpeg');
+      } finally {
+        capture.restore();
+      }
+    });
+
+    it('throws "Cannot upload an empty file" when the fetched blob is empty', async () => {
+      const empty = new Blob([], { type: 'image/png' });
+      const fetchMock = jest
+        .fn()
+        .mockResolvedValue({ ok: true, status: 200, blob: async () => empty });
+      globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+      const capture = captureUpload(oxy);
+
+      try {
+        await expect(
+          oxy.assetUpload({ uri: 'blob:https://app.test/empty', type: 'image/png', name: 'empty.png' }),
+        ).rejects.toThrow('Cannot upload an empty file');
+
+        // Nothing was sent — the empty source surfaces instead of creating a 0-byte asset.
+        expect(capture.requestSpy).not.toHaveBeenCalled();
+      } finally {
+        capture.restore();
+      }
+    });
+
+    it('throws when the uri cannot be fetched (non-ok response)', async () => {
+      const fetchMock = jest
+        .fn()
+        .mockResolvedValue({ ok: false, status: 404, blob: async () => new Blob([]) });
+      globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+      const capture = captureUpload(oxy);
+
+      try {
+        await expect(
+          oxy.assetUpload({ uri: 'https://cdn.test/missing.png', type: 'image/png', name: 'missing.png' }),
+        ).rejects.toThrow('Failed to read file from uri (status 404)');
+        expect(capture.requestSpy).not.toHaveBeenCalled();
+      } finally {
+        capture.restore();
+      }
+    });
+  });
+
+  describe('React Native', () => {
+    beforeEach(() => {
+      // Make isReactNative() === true: navigator.product === 'ReactNative'.
+      (globalThis as { navigator?: unknown }).navigator = { product: 'ReactNative' };
+    });
+
+    it('appends the descriptor as-is and never calls fetch', async () => {
+      const fetchMock = jest.fn();
+      globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+      const capture = captureUpload(oxy);
+
+      const descriptor = { uri: 'file:///tmp/avatar.png', type: 'image/png', name: 'avatar.png', size: 1024 };
+
+      try {
+        await oxy.assetUpload(descriptor);
+
+        // RN path: the raw descriptor object lands in the multipart body unchanged.
+        const filePart = capture.appended.find((p) => p.name === 'file');
+        expect(filePart?.value).toBe(descriptor);
+        expect(filePart?.fileName).toBe('avatar.png');
+        // No in-JS materialization on RN — FormData reads the file from the uri.
+        expect(fetchMock).not.toHaveBeenCalled();
+      } finally {
+        capture.restore();
+      }
+    });
+  });
+});

package/src/mixins/__tests__/getFileDownloadUrl.test.ts

@@ -49,6 +49,19 @@ describe('OxyServices.getFileDownloadUrl', () => {
         'https://cloud.oxy.so/a%2Fb%20c?variant=large%20size',
       );
     });
+
+    it('can omit the token for persisted public image URLs while authenticated', () => {
+      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+      oxy.setTokens('access-token-abc');
+
+      const url = oxy.getFileDownloadUrl('file123', 'thumb', undefined, {
+        omitToken: true,
+      });
+
+      expect(url).toBe('https://cloud.oxy.so/file123?variant=thumb');
+      expect(url).not.toContain('access-token-abc');
+      expect(url).not.toContain('token=');
+    });
   });
 
   describe('signed / private assets → authenticated API origin', () => {

package/src/mixins/__tests__/serviceAuth.test.ts

@@ -672,9 +672,9 @@ describe('requireScope() middleware', () => {
     expect(res.headersSent).toBe(false);
   });
 
-  it('allows requests where the delegation grant carries the required scope', () => {
+  it('allows delegated requests only when both app and delegation carry the required scope', () => {
     const req = makeReq();
-    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: [] };
+    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['user:read'] };
     req.serviceActingAs = { userId: 'u-1', scopes: ['user:read'] };
     const res = makeRes();
     const next = jest.fn();
@@ -684,6 +684,34 @@ describe('requireScope() middleware', () => {
     expect(next).toHaveBeenCalledTimes(1);
   });
 
+  it('rejects delegated requests when only the app carries the required scope', () => {
+    const req = makeReq();
+    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['files:write'] };
+    req.serviceActingAs = { userId: 'u-1', scopes: ['profile:read'] };
+    const res = makeRes();
+    const next = jest.fn();
+
+    oxy.requireScope('files:write')(req as unknown as never, res as unknown as never, next as unknown as never);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(403);
+    expect(res.body).toMatchObject({ code: 'INSUFFICIENT_SCOPE' });
+  });
+
+  it('rejects delegated requests when only the delegation carries the required scope', () => {
+    const req = makeReq();
+    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['profile:read'] };
+    req.serviceActingAs = { userId: 'u-1', scopes: ['files:write'] };
+    const res = makeRes();
+    const next = jest.fn();
+
+    oxy.requireScope('files:write')(req as unknown as never, res as unknown as never, next as unknown as never);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(403);
+    expect(res.body).toMatchObject({ code: 'INSUFFICIENT_SCOPE' });
+  });
+
   it('rejects requests missing the required scope with 403', () => {
     const req = makeReq();
     req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['user:read'] };

package/src/server/__tests__/cors.test.ts

@@ -0,0 +1,144 @@
+import type { NextFunction, Request, Response } from 'express';
+import { createOxyCors } from '../cors';
+
+interface FakeResponse extends Response {
+  __headers: Record<string, string>;
+  __statusSent: number | null;
+}
+
+function makeRequest(method: string, origin?: string, acrHeaders?: string): Request {
+  const headers: Record<string, string> = {};
+  if (origin !== undefined) headers.origin = origin;
+  if (acrHeaders !== undefined) headers['access-control-request-headers'] = acrHeaders;
+  return { method, headers } as unknown as Request;
+}
+
+function makeResponse(): FakeResponse {
+  const res = {
+    __headers: {},
+    __statusSent: null,
+  } as FakeResponse;
+  res.setHeader = jest.fn((name: string, value: string | number | readonly string[]) => {
+    res.__headers[name] = String(value);
+    return res;
+  }) as unknown as Response['setHeader'];
+  res.sendStatus = jest.fn((code: number) => {
+    res.__statusSent = code;
+    return res;
+  }) as unknown as Response['sendStatus'];
+  return res;
+}
+
+function makeNext(): NextFunction & jest.Mock {
+  return jest.fn() as unknown as NextFunction & jest.Mock;
+}
+
+describe('@oxyhq/core/server createOxyCors', () => {
+  it('allows the Oxy apex family (apex + any subdomain) and echoes the exact origin', () => {
+    const mw = createOxyCors();
+    for (const origin of [
+      'https://oxy.so',
+      'https://auth.oxy.so',
+      'https://api.oxy.so',
+      'https://accounts.oxy.so',
+      'https://console.oxy.so',
+      'https://inbox.oxy.so',
+    ]) {
+      const req = makeRequest('GET', origin);
+      const res = makeResponse();
+      const next = makeNext();
+      mw(req, res, next);
+      expect(res.__headers['Access-Control-Allow-Origin']).toBe(origin);
+      expect(res.__headers['Access-Control-Allow-Credentials']).toBe('true');
+      expect(res.__headers.Vary).toBe('Origin');
+      expect(next).toHaveBeenCalledTimes(1);
+    }
+  });
+
+  it('allows explicit appOrigins', () => {
+    const mw = createOxyCors({ appOrigins: ['https://app.example.com', 'http://localhost:3000'] });
+    for (const origin of ['https://app.example.com', 'http://localhost:3000']) {
+      const req = makeRequest('GET', origin);
+      const res = makeResponse();
+      const next = makeNext();
+      mw(req, res, next);
+      expect(res.__headers['Access-Control-Allow-Origin']).toBe(origin);
+      expect(next).toHaveBeenCalledTimes(1);
+    }
+  });
+
+  it('DENIES other origins — never reflects them, never wildcards', () => {
+    const mw = createOxyCors({ appOrigins: ['https://app.example.com'] });
+    for (const origin of [
+      'https://evil.com',
+      'https://oxy.so.evil.com', // suffix attack
+      'https://notoxy.so', // different apex
+      'https://example.com',
+    ]) {
+      const req = makeRequest('GET', origin);
+      const res = makeResponse();
+      const next = makeNext();
+      mw(req, res, next);
+      expect(res.__headers['Access-Control-Allow-Origin']).toBeUndefined();
+      expect(res.__headers['Access-Control-Allow-Origin']).not.toBe('*');
+      expect(res.__headers['Access-Control-Allow-Origin']).not.toBe(origin);
+      // request still passes to the app; the browser enforces the missing ACAO.
+      expect(next).toHaveBeenCalledTimes(1);
+    }
+  });
+
+  it('NEVER emits wildcard ACAO together with credentials', () => {
+    const mw = createOxyCors({ allowCredentials: true });
+    // Even an allowed origin gets the exact origin, never '*'.
+    const req = makeRequest('GET', 'https://auth.oxy.so');
+    const res = makeResponse();
+    mw(req, res, makeNext());
+    expect(res.__headers['Access-Control-Allow-Origin']).toBe('https://auth.oxy.so');
+    expect(res.__headers['Access-Control-Allow-Origin']).not.toBe('*');
+    expect(res.__headers['Access-Control-Allow-Credentials']).toBe('true');
+  });
+
+  it('answers preflight (OPTIONS) for an allowed origin with 204 + method/header allows', () => {
+    const mw = createOxyCors({ appOrigins: ['https://app.example.com'] });
+    const req = makeRequest('OPTIONS', 'https://app.example.com', 'content-type, authorization');
+    const res = makeResponse();
+    const next = makeNext();
+    mw(req, res, next);
+    expect(res.__headers['Access-Control-Allow-Origin']).toBe('https://app.example.com');
+    expect(res.__headers['Access-Control-Allow-Methods']).toContain('GET');
+    expect(res.__headers['Access-Control-Allow-Headers']).toBe('content-type, authorization');
+    expect(res.__headers['Access-Control-Max-Age']).toBeDefined();
+    expect(res.__statusSent).toBe(204);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('answers preflight for a DENIED origin with 204 and NO CORS headers', () => {
+    const mw = createOxyCors();
+    const req = makeRequest('OPTIONS', 'https://evil.com');
+    const res = makeResponse();
+    const next = makeNext();
+    mw(req, res, next);
+    expect(res.__headers['Access-Control-Allow-Origin']).toBeUndefined();
+    expect(res.__statusSent).toBe(204);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('passes through same-origin / non-browser requests (no Origin header) without ACAO', () => {
+    const mw = createOxyCors();
+    const req = makeRequest('GET');
+    const res = makeResponse();
+    const next = makeNext();
+    mw(req, res, next);
+    expect(res.__headers['Access-Control-Allow-Origin']).toBeUndefined();
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it('can disable credentials and still never wildcards', () => {
+    const mw = createOxyCors({ allowCredentials: false });
+    const req = makeRequest('GET', 'https://api.oxy.so');
+    const res = makeResponse();
+    mw(req, res, makeNext());
+    expect(res.__headers['Access-Control-Allow-Origin']).toBe('https://api.oxy.so');
+    expect(res.__headers['Access-Control-Allow-Credentials']).toBeUndefined();
+  });
+});