@oxyhq/core 4.0.0 → 5.0.0

package/src/mixins/OxyServices.assets.ts

@@ -1,6 +1,6 @@
 import type { AccountStorageUsageResponse, AssetUploadInput, AssetUrlResponse, AssetVariant, RNFileDescriptor } from '../models/interfaces';
 import type { OxyServicesBase } from '../OxyServices.base';
-import { isReactNative } from '../utils/platform';
+import { isReactNative } from '@oxyhq/protocol';
 
 export function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>(Base: T) {
   return class extends Base {

package/src/mixins/OxyServices.auth.ts

@@ -16,7 +16,7 @@ import type { PublicApplication } from './OxyServices.connectedApps';
 import { OxyAuthenticationError } from '../OxyServices.errors';
 import { KeyManager } from '../crypto/keyManager';
 import { SignatureService } from '../crypto/signatureService';
-import { loadNodeCrypto } from '../utils/platformCrypto';
+import { loadNodeCrypto } from '@oxyhq/protocol';
 import { logger } from '../utils/loggerUtils';
 import { normalizeUserIdentity, normalizeUserIdentityOrNull } from '../utils/userIdentity';
 

package/src/mixins/OxyServices.civic.ts

@@ -49,17 +49,18 @@
  * session.
  */
 import type {
+  ChainHeadResponse,
   CredentialIssueResult,
   CredentialListResult,
   CredentialStatus,
   CredentialVerifyResult,
   ExportAttestation,
+  OxySignedRecordType,
   PersonhoodStatusResult,
   PublicCard,
   RealLifeAttestationResult,
   SignedPublicCard,
   SignedRecordEnvelope,
-  SignedRecordType,
   ValidationRequestSummary,
   ValidationVerdict,
   ValidationVoteResult,
@@ -67,7 +68,7 @@ import type {
   VouchResult,
 } from '@oxyhq/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
-import { canonicalize } from '../crypto/canonicalJson';
+import { canonicalize, verifySignature } from '@oxyhq/protocol';
 import { SignatureService } from '../crypto/signatureService';
 import { buildUserDid } from './OxyServices.identity';
 import { CACHE_TIMES } from './mixinHelpers';
@@ -290,7 +291,7 @@ export function parseAttestPayload(raw: string): ParsedAttestPayload | null {
  * key, matching the server which omits absent keys entirely) and checks the
  * `ES256K-DER-SHA256` signature against `attestation.publicKey`.
  *
- * NEVER throws: `SignatureService.verify` already swallows malformed-input
+ * NEVER throws: `verifySignature` already swallows malformed-input
  * errors and returns `false`, and an absent attestation short-circuits to
  * `false`. A pure, reusable helper (Commons can call it on a cached card).
  *
@@ -308,7 +309,7 @@ export async function verifyPublicCardAttestation(
   if (!signature || !publicKey) {
     return false;
   }
-  return SignatureService.verify(canonicalize(card), signature, publicKey);
+  return verifySignature(canonicalize(card), signature, publicKey);
 }
 
 /**
@@ -390,18 +391,6 @@ export interface RevokeCredentialResult {
   credential: VerifiableCredentialResponse;
 }
 
-/**
- * The current chain head as returned by `GET /identity/records/:userId/chain/head`.
- * `headRecordId` is `null` and `seq` is `-1` when the subject has no chain yet,
- * so the next record's coordinates are always `seq: head.seq + 1` (genesis = 0)
- * and `prev: head.headRecordId` (genesis = null).
- */
-interface ChainHeadResponse {
-  headRecordId: string | null;
-  seq: number;
-  recordCount: number;
-}
-
 export function OxyServicesCivicMixin<T extends typeof OxyServicesBase>(Base: T) {
   return class extends Base {
     constructor(...args: any[]) {
@@ -929,7 +918,7 @@ export function OxyServicesCivicMixin<T extends typeof OxyServicesBase>(Base: T)
      * @param rkey - The AtProto-style record key within the collection.
      */
     async _signMyCivicRecordV2(
-      type: SignedRecordType,
+      type: OxySignedRecordType,
       record: Record<string, unknown>,
       collection: string,
       rkey: string,

package/src/mixins/OxyServices.identity.ts

@@ -28,6 +28,7 @@ import type {
   DidDocument,
   DomainVerificationInstructions,
   ExportBundle,
+  OxySignedRecordType,
   SignedRecordEnvelope,
   VerifiedDomain,
 } from '@oxyhq/contracts';
@@ -43,8 +44,13 @@ import { CACHE_TIMES } from './mixinHelpers';
  */
 const OXY_IDENTITY_APEX = 'oxy.so';
 
-/** Record categories a client may sign and publish. */
-export type IdentityRecordType = SignedRecordEnvelope['type'];
+/**
+ * Record categories a client may sign and publish to the Oxy store. The base
+ * envelope `type` is now an open string (any app may define its own records on
+ * the shared grammar); the Oxy identity store re-narrows it to the closed Oxy
+ * record set.
+ */
+export type IdentityRecordType = OxySignedRecordType;
 
 /** Auth-method types that can be unlinked via {@link OxyServicesIdentityMixin}. */
 export type UnlinkableAuthMethodType = 'identity' | 'password' | 'google' | 'apple' | 'github';

package/src/mixins/OxyServices.language.ts

@@ -4,7 +4,7 @@
 import { normalizeLanguageCode, getLanguageMetadata, getLanguageName, getNativeLanguageName } from '../utils/languageUtils';
 import type { LanguageMetadata } from '../utils/languageUtils';
 import type { OxyServicesBase } from '../OxyServices.base';
-import { loadAsyncStorage } from '../utils/platformCrypto';
+import { loadAsyncStorage } from '@oxyhq/protocol';
 import { isDev } from '../shared/utils/debugUtils';
 
 export function OxyServicesLanguageMixin<T extends typeof OxyServicesBase>(Base: T) {

package/src/mixins/OxyServices.nodes.ts

@@ -40,6 +40,7 @@
  * server's `serializeNode` projection exactly. Dates cross the wire as ISO
  * strings.
  */
+import type { ChainHeadResponse } from '@oxyhq/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
 import { SignatureService } from '../crypto/signatureService';
 import { buildUserDid } from './OxyServices.identity';
@@ -157,18 +158,6 @@ export interface RemoveNodeResult {
   revoked: boolean;
 }
 
-/**
- * The current chain head as returned by `GET /identity/records/:userId/chain/head`.
- * `headRecordId` is `null` and `seq` is `-1` when the subject has no chain yet,
- * so the next record's coordinates are always `seq: head.seq + 1` (genesis = 0)
- * and `prev: head.headRecordId` (genesis = null).
- */
-interface ChainHeadResponse {
-  headRecordId: string | null;
-  seq: number;
-  recordCount: number;
-}
-
 export function OxyServicesNodesMixin<T extends typeof OxyServicesBase>(Base: T) {
   return class extends Base {
     constructor(...args: any[]) {

package/src/mixins/OxyServices.utility.ts

@@ -7,7 +7,7 @@
 import { jwtDecode } from 'jwt-decode';
 import type { ApiError, User } from '../models/interfaces';
 import type { OxyServicesBase } from '../OxyServices.base';
-import { loadNodeCrypto } from '../utils/platformCrypto';
+import { loadNodeCrypto } from '@oxyhq/protocol';
 import { logger } from '../utils/loggerUtils';
 import { CACHE_TIMES } from './mixinHelpers';
 
@@ -26,17 +26,6 @@ interface JwtPayload {
   [key: string]: unknown;
 }
 
-/**
- * Result from the account acting-as verification endpoint
- * (`GET /accounts/verify-acting-as`). Indicates whether a user is authorized to
- * act as a given account. The `account:act_as` capability is granted only to the
- * `owner`, `admin`, and `editor` account roles.
- */
-interface ActingAsVerification {
-  authorized: boolean;
-  role: 'owner' | 'admin' | 'editor';
-}
-
 /**
  * Result from the service-acting-as verification endpoint.
  * Confirms that a given service app holds an active delegation grant for
@@ -141,9 +130,6 @@ interface AuthMiddlewareOptions {
 
 export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base: T) {
   return class extends Base {
-    /** @internal In-memory cache for acting-as verification results (TTL: 5 min) */
-    _actingAsCache = new Map<string, { result: ActingAsVerification | null; expiresAt: number }>();
-
     /**
      * In-memory cache for service-acting-as verification.
      * Negative results are cached for 1min to avoid hammering the verify
@@ -161,55 +147,6 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
       super(...(args as [any]));
     }
 
-    /**
-     * Verify that a user is authorized to act as an account (direct membership
-     * or inherited via an ancestor). Backed by `GET /accounts/verify-acting-as`.
-     * Results are cached in-memory for 5 minutes to avoid repeated API calls.
-     *
-     * @internal Used by the auth() middleware — not part of the public API
-     */
-    async verifyActingAs(userId: string, accountId: string): Promise<ActingAsVerification | null> {
-      const cacheKey = `${userId}:${accountId}`;
-      const now = Date.now();
-
-      // Check cache
-      const cached = this._actingAsCache.get(cacheKey);
-      if (cached && cached.expiresAt > now) {
-        return cached.result;
-      }
-
-      // Query the API
-      try {
-        const result = await this.makeRequest<ActingAsVerification>(
-          'GET',
-          '/accounts/verify-acting-as',
-          { accountId, userId },
-          { cache: false, retry: false, timeout: 5000 }
-        );
-
-        // Cache successful result for 5 minutes
-        this._actingAsCache.set(cacheKey, {
-          result: result && result.authorized ? result : null,
-          expiresAt: now + 5 * 60 * 1000,
-        });
-
-        return result && result.authorized ? result : null;
-      } catch (error) {
-        logger.warn('[oxy.auth] verifyActingAs lookup failed — caching negative result', {
-          component: 'auth',
-          method: 'verifyActingAs',
-          userId,
-          accountId,
-        }, error);
-        // Cache negative result for 1 minute to avoid hammering on transient errors
-        this._actingAsCache.set(cacheKey, {
-          result: null,
-          expiresAt: now + 1 * 60 * 1000,
-        });
-        return null;
-      }
-    }
-
     /**
      * Verify that a service app holds an active delegation grant authorising
      * it to act on behalf of `userId`. Returns the grant (with allowed scopes)
@@ -362,50 +299,6 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
 
       // Return an async middleware function
       return async (req: AuthReq, res: AuthRes, next: AuthNext) => {
-        // Process X-Acting-As header for managed account identity delegation.
-        // Called after successful authentication, before next(). If the header
-        // is present, verifies authorization and swaps the request identity to
-        // the managed account, preserving the original user for audit trails.
-        const processActingAs = async (): Promise<boolean> => {
-          const actingAsUserId = req.headers['x-acting-as'];
-          if (!actingAsUserId || typeof actingAsUserId !== 'string') return true; // No header, proceed normally
-          const currentUserId = req.userId;
-          if (!currentUserId) return true; // No authenticated user yet — nothing to swap
-
-          const verification = await oxyInstance.verifyActingAs(currentUserId, actingAsUserId);
-          if (!verification) {
-            const error = {
-              error: 'ACTING_AS_UNAUTHORIZED',
-              message: 'Not authorized to act as this account',
-              code: 'ACTING_AS_UNAUTHORIZED',
-              status: 403,
-            };
-            if (onError) {
-              onError(error);
-            } else {
-              res.status(403).json(error);
-            }
-            return false;
-          }
-
-          // Preserve original user for audit trails
-          req.originalUser = { id: currentUserId, ...(req.user ?? {}) };
-          req.actingAs = { userId: actingAsUserId, role: verification.role };
-
-          // Swap user identity to the managed account
-          req.userId = actingAsUserId;
-          req.user = { id: actingAsUserId, _id: actingAsUserId } as unknown as User;
-
-          if (debug) {
-            logger.debug(`[oxy.auth] Acting as ${actingAsUserId} (role=${verification.role}) original=${currentUserId}`, {
-              component: 'auth',
-              method: 'auth.processActingAs',
-            });
-          }
-
-          return true;
-        };
-
         try {
           // Extract token from Authorization header.
           // Node/Express normalizes `Authorization` to a string; we guard
@@ -490,9 +383,9 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
             // Signature verification uses a manual HMAC-SHA256 compare because
             // this file ships into RN/web bundles where `jsonwebtoken` is
             // unavailable. The middleware only ever runs on Node hosts (see
-            // platformCrypto's doc-comment), and `loadNodeCrypto` is per-
-            // platform: the RN variant throws so Metro never bundles a Node
-            // built-in reference.
+            // `@oxyhq/protocol`'s `platform/crypto` doc-comment), and
+            // `loadNodeCrypto` is per-platform: the RN variant throws so Metro
+            // never bundles a Node built-in reference.
             try {
               await verifyServiceTokenSignature(token, jwtSecret);
               verifyServiceTokenClaims(decoded, {
@@ -712,9 +605,7 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
                 });
               }
 
-              // Process X-Acting-As header before proceeding
-              if (await processActingAs()) return next();
-              return;
+              return next();
             } catch (validationError) {
               if (debug) {
                 logger.debug('[oxy.auth] Session validation failed', {
@@ -781,8 +672,7 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
             });
           }
 
-          // Process X-Acting-As header before proceeding
-          if (await processActingAs()) next();
+          next();
         } catch (error) {
           const handled = oxyInstance.handleError(error) as Error & {
             code?: string;
@@ -1128,8 +1018,6 @@ interface AuthReq {
   sessionId?: string | null;
   serviceApp?: ServiceApp;
   serviceActingAs?: { userId: string; scopes: string[] };
-  actingAs?: { userId: string; role: string };
-  originalUser?: { id: string } & Partial<User>;
 }
 
 interface AuthRes {
@@ -1146,7 +1034,6 @@ interface SocketLike {
 }
 
 interface OxyAuthInstance {
-  verifyActingAs(userId: string, accountId: string): Promise<ActingAsVerification | null>;
   verifyServiceActingAs(appId: string, userId: string): Promise<ServiceActingAsVerification | null>;
   validateSession(
     sessionId: string,

package/src/mixins/__tests__/OxyServices.civic.test.ts

@@ -37,7 +37,7 @@ import type {
   VerifiableCredentialResponse,
 } from '@oxyhq/contracts';
 import { OxyServices } from '../../OxyServices';
-import { canonicalize } from '../../crypto/canonicalJson';
+import { canonicalize, signMessage } from '@oxyhq/protocol';
 import { SignatureService } from '../../crypto/signatureService';
 import { parseAttestPayload, parseIdPayload, verifyPublicCardAttestation } from '../OxyServices.civic';
 
@@ -61,7 +61,7 @@ async function signCard(card: PublicCard): Promise<{ attestation: ExportAttestat
   const keyPair = ec.genKeyPair();
   const privateKey = keyPair.getPrivate('hex');
   const publicKey = keyPair.getPublic('hex');
-  const signature = await SignatureService.signWithKey(canonicalize(card), privateKey);
+  const signature = await signMessage(canonicalize(card), privateKey);
   return {
     attestation: {
       issuer: 'did:web:api.oxy.so',

package/src/mixins/__tests__/accounts.test.ts

@@ -25,6 +25,7 @@ import type {
   ApplicationCredentialWithSecret,
   RotateApplicationCredentialResult,
   ApplicationUsageStats,
+  SwitchAccountResult,
 } from '../OxyServices.accounts';
 
 const setAccessTokenForTest = (oxy: OxyServices): void => {
@@ -174,6 +175,75 @@ describe('OxyServices.accounts', () => {
     });
   });
 
+  describe('switchToAccount', () => {
+    const switchResponse: SwitchAccountResult = {
+      sessionId: 'sess_switch',
+      deviceId: 'dev_switch',
+      expiresAt: '2026-06-30T01:00:00.000Z',
+      accessToken: 'access_switch',
+      user: { id: 'acc1', username: 'oxy-org', name: { displayName: 'Oxy Org' } },
+      authuser: 2,
+    };
+
+    it('posts to /:id/switch (no body, no cache), plants the token, sweeps the cache, and returns the session', async () => {
+      const setTokensSpy = jest.spyOn(oxy, 'setTokens');
+      const clearCacheSpy = jest.spyOn(oxy, 'clearCache');
+      makeRequestSpy.mockResolvedValue(switchResponse);
+
+      const result = await oxy.switchToAccount('acc1');
+
+      // Request shape: POST, exact path, no body, cache disabled.
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/accounts/acc1/switch',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+
+      // Session planting: the access token from the body is installed as the
+      // active token (mirrors claimSessionByToken / verifyChallenge).
+      expect(setTokensSpy).toHaveBeenCalledWith('access_switch');
+      expect(oxy.getAccessToken()).toBe('access_switch');
+      expect(oxy.hasValidToken()).toBe(true);
+
+      // Identity changed → the whole GET cache is swept so reads refetch as the
+      // new account, AND it happens AFTER the token is planted.
+      expect(clearCacheSpy).toHaveBeenCalledTimes(1);
+      expect(setTokensSpy.mock.invocationCallOrder[0]).toBeLessThan(
+        clearCacheSpy.mock.invocationCallOrder[0],
+      );
+
+      // The returned session carries the target account (id-normalised) + authuser.
+      expect(result).toEqual({ ...switchResponse, user: { id: 'acc1', username: 'oxy-org', name: { displayName: 'Oxy Org' } } });
+      expect(result.authuser).toBe(2);
+
+      setTokensSpy.mockRestore();
+      clearCacheSpy.mockRestore();
+    });
+
+    it('URL-encodes the accountId path segment', async () => {
+      makeRequestSpy.mockResolvedValue(switchResponse);
+      await oxy.switchToAccount('a b/c');
+      expect(makeRequestSpy.mock.calls[0][1]).toBe('/accounts/a%20b%2Fc/switch');
+    });
+
+    it('does NOT plant or sweep when the operator is not authorized (403 surfaces via handleError)', async () => {
+      const setTokensSpy = jest.spyOn(oxy, 'setTokens');
+      const clearCacheSpy = jest.spyOn(oxy, 'clearCache');
+      makeRequestSpy.mockRejectedValue(
+        Object.assign(new Error('forbidden'), { response: { status: 403 } }),
+      );
+
+      await expect(oxy.switchToAccount('acc1')).rejects.toThrow();
+      // A failed switch must NOT mutate session state.
+      expect(setTokensSpy).not.toHaveBeenCalled();
+      expect(clearCacheSpy).not.toHaveBeenCalled();
+
+      setTokensSpy.mockRestore();
+      clearCacheSpy.mockRestore();
+    });
+  });
+
   describe('createAccount', () => {
     it('posts the payload, unwraps `account`, and busts every list', async () => {
       makeRequestSpy.mockResolvedValue({ account: accountNodeFixture });

package/src/server/auth.ts

@@ -10,11 +10,6 @@ export interface OxyRequestUser {
   [key: string]: unknown;
 }
 
-export interface OxyActingAsContext {
-  userId: string;
-  role: 'owner' | 'admin' | 'editor';
-}
-
 export interface OxyServiceAppContext {
   appId: string;
   appName: string;
@@ -30,8 +25,6 @@ export interface OxyServiceActingAsContext {
 export interface OxyAuthRequest extends Request {
   userId?: string | null;
   user?: OxyRequestUser | null;
-  originalUser?: OxyRequestUser | null;
-  actingAs?: OxyActingAsContext;
   accessToken?: string;
   sessionId?: string | null;
   serviceApp?: OxyServiceAppContext;

package/src/server/index.ts

@@ -24,7 +24,6 @@ export {
   requireOxyAuth,
 } from './auth';
 export type {
-  OxyActingAsContext,
   OxyAuthenticatedRequest,
   OxyAuthMiddlewareOptions,
   OxyAuthRequest,

package/src/utils/cacheKey.ts

@@ -3,8 +3,8 @@
  *
  * Extracted from {@link HttpService} so the identity-tag derivation is a pure,
  * independently testable function with no dependency on instance/token state.
- * The HTTP service injects the live access token and acting-as id; everything
- * here is referentially transparent given those inputs.
+ * The HTTP service injects the live access token; everything here is
+ * referentially transparent given that input.
  */
 
 import { jwtDecode } from 'jwt-decode';
@@ -72,27 +72,22 @@ export function fnv1a32(str: string): string {
  *
  * We use the decoded user id rather than the raw JWT so the token never lands
  * in a cache key (no token leakage through any cache-key logging, no key bloat).
- * The acting-as id is folded in because managed-account responses differ per
- * acting identity — and `X-Acting-As` already changes the server response for
- * the same bearer token.
+ * Switching into a managed account mints a REAL new session whose access token
+ * carries the target account's id, so the identity tag changes naturally on a
+ * switch — there is no separate acting-as discriminator to fold in.
  *
  * @param accessToken The current bearer access token, or `null` when anonymous.
- * @param actingAsUserId The active managed-account id, or `null`.
  */
-export function computeIdentityTag(
-  accessToken: string | null,
-  actingAsUserId: string | null,
-): string {
-  let principal = ANON_IDENTITY;
-  if (accessToken) {
-    try {
-      const decoded = jwtDecode<CacheIdentityJwtPayload>(accessToken);
-      principal = decoded.userId || decoded.id || `t${fnv1a32(accessToken)}`;
-    } catch {
-      // Undecodable token — still partition it away from anon and from other
-      // tokens via a hash. Never silently fall back to ANON_IDENTITY.
-      principal = `t${fnv1a32(accessToken)}`;
-    }
+export function computeIdentityTag(accessToken: string | null): string {
+  if (!accessToken) {
+    return ANON_IDENTITY;
+  }
+  try {
+    const decoded = jwtDecode<CacheIdentityJwtPayload>(accessToken);
+    return decoded.userId || decoded.id || `t${fnv1a32(accessToken)}`;
+  } catch {
+    // Undecodable token — still partition it away from anon and from other
+    // tokens via a hash. Never silently fall back to ANON_IDENTITY.
+    return `t${fnv1a32(accessToken)}`;
   }
-  return actingAsUserId ? `${principal}~as${actingAsUserId}` : principal;
 }

package/src/utils/deviceManager.ts

@@ -1,4 +1,4 @@
-import { loadAsyncStorage } from './platformCrypto';
+import { loadAsyncStorage } from '@oxyhq/protocol';
 
 export interface DeviceFingerprint {
   userAgent: string;

package/src/utils/platform.ts

@@ -88,20 +88,6 @@ export function isAndroid(): boolean {
   return getPlatformOS() === 'android';
 }
 
-/**
- * Check if running in React Native
- */
-export function isReactNative(): boolean {
-  return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
-}
-
-/**
- * Check if running in Node.js
- */
-export function isNodeJS(): boolean {
-  return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
-}
-
 /**
  * Set the platform OS explicitly
  * Called by React Native entry point to register the platform