@oxyhq/core 4.0.1 → 5.0.0

package/src/mixins/OxyServices.language.ts

@@ -4,7 +4,7 @@
 import { normalizeLanguageCode, getLanguageMetadata, getLanguageName, getNativeLanguageName } from '../utils/languageUtils';
 import type { LanguageMetadata } from '../utils/languageUtils';
 import type { OxyServicesBase } from '../OxyServices.base';
-import { loadAsyncStorage } from '../utils/platformCrypto';
+import { loadAsyncStorage } from '@oxyhq/protocol';
 import { isDev } from '../shared/utils/debugUtils';
 
 export function OxyServicesLanguageMixin<T extends typeof OxyServicesBase>(Base: T) {

package/src/mixins/OxyServices.nodes.ts

@@ -40,6 +40,7 @@
  * server's `serializeNode` projection exactly. Dates cross the wire as ISO
  * strings.
  */
+import type { ChainHeadResponse } from '@oxyhq/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
 import { SignatureService } from '../crypto/signatureService';
 import { buildUserDid } from './OxyServices.identity';
@@ -157,18 +158,6 @@ export interface RemoveNodeResult {
   revoked: boolean;
 }
 
-/**
- * The current chain head as returned by `GET /identity/records/:userId/chain/head`.
- * `headRecordId` is `null` and `seq` is `-1` when the subject has no chain yet,
- * so the next record's coordinates are always `seq: head.seq + 1` (genesis = 0)
- * and `prev: head.headRecordId` (genesis = null).
- */
-interface ChainHeadResponse {
-  headRecordId: string | null;
-  seq: number;
-  recordCount: number;
-}
-
 export function OxyServicesNodesMixin<T extends typeof OxyServicesBase>(Base: T) {
   return class extends Base {
     constructor(...args: any[]) {

package/src/mixins/OxyServices.utility.ts

@@ -7,7 +7,7 @@
 import { jwtDecode } from 'jwt-decode';
 import type { ApiError, User } from '../models/interfaces';
 import type { OxyServicesBase } from '../OxyServices.base';
-import { loadNodeCrypto } from '../utils/platformCrypto';
+import { loadNodeCrypto } from '@oxyhq/protocol';
 import { logger } from '../utils/loggerUtils';
 import { CACHE_TIMES } from './mixinHelpers';
 
@@ -26,17 +26,6 @@ interface JwtPayload {
   [key: string]: unknown;
 }
 
-/**
- * Result from the account acting-as verification endpoint
- * (`GET /accounts/verify-acting-as`). Indicates whether a user is authorized to
- * act as a given account. The `account:act_as` capability is granted only to the
- * `owner`, `admin`, and `editor` account roles.
- */
-interface ActingAsVerification {
-  authorized: boolean;
-  role: 'owner' | 'admin' | 'editor';
-}
-
 /**
  * Result from the service-acting-as verification endpoint.
  * Confirms that a given service app holds an active delegation grant for
@@ -141,9 +130,6 @@ interface AuthMiddlewareOptions {
 
 export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base: T) {
   return class extends Base {
-    /** @internal In-memory cache for acting-as verification results (TTL: 5 min) */
-    _actingAsCache = new Map<string, { result: ActingAsVerification | null; expiresAt: number }>();
-
     /**
      * In-memory cache for service-acting-as verification.
      * Negative results are cached for 1min to avoid hammering the verify
@@ -161,55 +147,6 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
       super(...(args as [any]));
     }
 
-    /**
-     * Verify that a user is authorized to act as an account (direct membership
-     * or inherited via an ancestor). Backed by `GET /accounts/verify-acting-as`.
-     * Results are cached in-memory for 5 minutes to avoid repeated API calls.
-     *
-     * @internal Used by the auth() middleware — not part of the public API
-     */
-    async verifyActingAs(userId: string, accountId: string): Promise<ActingAsVerification | null> {
-      const cacheKey = `${userId}:${accountId}`;
-      const now = Date.now();
-
-      // Check cache
-      const cached = this._actingAsCache.get(cacheKey);
-      if (cached && cached.expiresAt > now) {
-        return cached.result;
-      }
-
-      // Query the API
-      try {
-        const result = await this.makeRequest<ActingAsVerification>(
-          'GET',
-          '/accounts/verify-acting-as',
-          { accountId, userId },
-          { cache: false, retry: false, timeout: 5000 }
-        );
-
-        // Cache successful result for 5 minutes
-        this._actingAsCache.set(cacheKey, {
-          result: result && result.authorized ? result : null,
-          expiresAt: now + 5 * 60 * 1000,
-        });
-
-        return result && result.authorized ? result : null;
-      } catch (error) {
-        logger.warn('[oxy.auth] verifyActingAs lookup failed — caching negative result', {
-          component: 'auth',
-          method: 'verifyActingAs',
-          userId,
-          accountId,
-        }, error);
-        // Cache negative result for 1 minute to avoid hammering on transient errors
-        this._actingAsCache.set(cacheKey, {
-          result: null,
-          expiresAt: now + 1 * 60 * 1000,
-        });
-        return null;
-      }
-    }
-
     /**
      * Verify that a service app holds an active delegation grant authorising
      * it to act on behalf of `userId`. Returns the grant (with allowed scopes)
@@ -362,50 +299,6 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
 
       // Return an async middleware function
       return async (req: AuthReq, res: AuthRes, next: AuthNext) => {
-        // Process X-Acting-As header for managed account identity delegation.
-        // Called after successful authentication, before next(). If the header
-        // is present, verifies authorization and swaps the request identity to
-        // the managed account, preserving the original user for audit trails.
-        const processActingAs = async (): Promise<boolean> => {
-          const actingAsUserId = req.headers['x-acting-as'];
-          if (!actingAsUserId || typeof actingAsUserId !== 'string') return true; // No header, proceed normally
-          const currentUserId = req.userId;
-          if (!currentUserId) return true; // No authenticated user yet — nothing to swap
-
-          const verification = await oxyInstance.verifyActingAs(currentUserId, actingAsUserId);
-          if (!verification) {
-            const error = {
-              error: 'ACTING_AS_UNAUTHORIZED',
-              message: 'Not authorized to act as this account',
-              code: 'ACTING_AS_UNAUTHORIZED',
-              status: 403,
-            };
-            if (onError) {
-              onError(error);
-            } else {
-              res.status(403).json(error);
-            }
-            return false;
-          }
-
-          // Preserve original user for audit trails
-          req.originalUser = { id: currentUserId, ...(req.user ?? {}) };
-          req.actingAs = { userId: actingAsUserId, role: verification.role };
-
-          // Swap user identity to the managed account
-          req.userId = actingAsUserId;
-          req.user = { id: actingAsUserId, _id: actingAsUserId } as unknown as User;
-
-          if (debug) {
-            logger.debug(`[oxy.auth] Acting as ${actingAsUserId} (role=${verification.role}) original=${currentUserId}`, {
-              component: 'auth',
-              method: 'auth.processActingAs',
-            });
-          }
-
-          return true;
-        };
-
         try {
           // Extract token from Authorization header.
           // Node/Express normalizes `Authorization` to a string; we guard
@@ -490,9 +383,9 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
             // Signature verification uses a manual HMAC-SHA256 compare because
             // this file ships into RN/web bundles where `jsonwebtoken` is
             // unavailable. The middleware only ever runs on Node hosts (see
-            // platformCrypto's doc-comment), and `loadNodeCrypto` is per-
-            // platform: the RN variant throws so Metro never bundles a Node
-            // built-in reference.
+            // `@oxyhq/protocol`'s `platform/crypto` doc-comment), and
+            // `loadNodeCrypto` is per-platform: the RN variant throws so Metro
+            // never bundles a Node built-in reference.
             try {
               await verifyServiceTokenSignature(token, jwtSecret);
               verifyServiceTokenClaims(decoded, {
@@ -712,9 +605,7 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
                 });
               }
 
-              // Process X-Acting-As header before proceeding
-              if (await processActingAs()) return next();
-              return;
+              return next();
             } catch (validationError) {
               if (debug) {
                 logger.debug('[oxy.auth] Session validation failed', {
@@ -781,8 +672,7 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
             });
           }
 
-          // Process X-Acting-As header before proceeding
-          if (await processActingAs()) next();
+          next();
         } catch (error) {
           const handled = oxyInstance.handleError(error) as Error & {
             code?: string;
@@ -1128,8 +1018,6 @@ interface AuthReq {
   sessionId?: string | null;
   serviceApp?: ServiceApp;
   serviceActingAs?: { userId: string; scopes: string[] };
-  actingAs?: { userId: string; role: string };
-  originalUser?: { id: string } & Partial<User>;
 }
 
 interface AuthRes {
@@ -1146,7 +1034,6 @@ interface SocketLike {
 }
 
 interface OxyAuthInstance {
-  verifyActingAs(userId: string, accountId: string): Promise<ActingAsVerification | null>;
   verifyServiceActingAs(appId: string, userId: string): Promise<ServiceActingAsVerification | null>;
   validateSession(
     sessionId: string,

package/src/mixins/__tests__/OxyServices.civic.test.ts

@@ -37,7 +37,7 @@ import type {
   VerifiableCredentialResponse,
 } from '@oxyhq/contracts';
 import { OxyServices } from '../../OxyServices';
-import { canonicalize } from '../../crypto/canonicalJson';
+import { canonicalize, signMessage } from '@oxyhq/protocol';
 import { SignatureService } from '../../crypto/signatureService';
 import { parseAttestPayload, parseIdPayload, verifyPublicCardAttestation } from '../OxyServices.civic';
 
@@ -61,7 +61,7 @@ async function signCard(card: PublicCard): Promise<{ attestation: ExportAttestat
   const keyPair = ec.genKeyPair();
   const privateKey = keyPair.getPrivate('hex');
   const publicKey = keyPair.getPublic('hex');
-  const signature = await SignatureService.signWithKey(canonicalize(card), privateKey);
+  const signature = await signMessage(canonicalize(card), privateKey);
   return {
     attestation: {
       issuer: 'did:web:api.oxy.so',

package/src/mixins/__tests__/accounts.test.ts

@@ -25,6 +25,7 @@ import type {
   ApplicationCredentialWithSecret,
   RotateApplicationCredentialResult,
   ApplicationUsageStats,
+  SwitchAccountResult,
 } from '../OxyServices.accounts';
 
 const setAccessTokenForTest = (oxy: OxyServices): void => {
@@ -174,6 +175,75 @@ describe('OxyServices.accounts', () => {
     });
   });
 
+  describe('switchToAccount', () => {
+    const switchResponse: SwitchAccountResult = {
+      sessionId: 'sess_switch',
+      deviceId: 'dev_switch',
+      expiresAt: '2026-06-30T01:00:00.000Z',
+      accessToken: 'access_switch',
+      user: { id: 'acc1', username: 'oxy-org', name: { displayName: 'Oxy Org' } },
+      authuser: 2,
+    };
+
+    it('posts to /:id/switch (no body, no cache), plants the token, sweeps the cache, and returns the session', async () => {
+      const setTokensSpy = jest.spyOn(oxy, 'setTokens');
+      const clearCacheSpy = jest.spyOn(oxy, 'clearCache');
+      makeRequestSpy.mockResolvedValue(switchResponse);
+
+      const result = await oxy.switchToAccount('acc1');
+
+      // Request shape: POST, exact path, no body, cache disabled.
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/accounts/acc1/switch',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+
+      // Session planting: the access token from the body is installed as the
+      // active token (mirrors claimSessionByToken / verifyChallenge).
+      expect(setTokensSpy).toHaveBeenCalledWith('access_switch');
+      expect(oxy.getAccessToken()).toBe('access_switch');
+      expect(oxy.hasValidToken()).toBe(true);
+
+      // Identity changed → the whole GET cache is swept so reads refetch as the
+      // new account, AND it happens AFTER the token is planted.
+      expect(clearCacheSpy).toHaveBeenCalledTimes(1);
+      expect(setTokensSpy.mock.invocationCallOrder[0]).toBeLessThan(
+        clearCacheSpy.mock.invocationCallOrder[0],
+      );
+
+      // The returned session carries the target account (id-normalised) + authuser.
+      expect(result).toEqual({ ...switchResponse, user: { id: 'acc1', username: 'oxy-org', name: { displayName: 'Oxy Org' } } });
+      expect(result.authuser).toBe(2);
+
+      setTokensSpy.mockRestore();
+      clearCacheSpy.mockRestore();
+    });
+
+    it('URL-encodes the accountId path segment', async () => {
+      makeRequestSpy.mockResolvedValue(switchResponse);
+      await oxy.switchToAccount('a b/c');
+      expect(makeRequestSpy.mock.calls[0][1]).toBe('/accounts/a%20b%2Fc/switch');
+    });
+
+    it('does NOT plant or sweep when the operator is not authorized (403 surfaces via handleError)', async () => {
+      const setTokensSpy = jest.spyOn(oxy, 'setTokens');
+      const clearCacheSpy = jest.spyOn(oxy, 'clearCache');
+      makeRequestSpy.mockRejectedValue(
+        Object.assign(new Error('forbidden'), { response: { status: 403 } }),
+      );
+
+      await expect(oxy.switchToAccount('acc1')).rejects.toThrow();
+      // A failed switch must NOT mutate session state.
+      expect(setTokensSpy).not.toHaveBeenCalled();
+      expect(clearCacheSpy).not.toHaveBeenCalled();
+
+      setTokensSpy.mockRestore();
+      clearCacheSpy.mockRestore();
+    });
+  });
+
   describe('createAccount', () => {
     it('posts the payload, unwraps `account`, and busts every list', async () => {
       makeRequestSpy.mockResolvedValue({ account: accountNodeFixture });

package/src/server/auth.ts

@@ -10,11 +10,6 @@ export interface OxyRequestUser {
   [key: string]: unknown;
 }
 
-export interface OxyActingAsContext {
-  userId: string;
-  role: 'owner' | 'admin' | 'editor';
-}
-
 export interface OxyServiceAppContext {
   appId: string;
   appName: string;
@@ -30,8 +25,6 @@ export interface OxyServiceActingAsContext {
 export interface OxyAuthRequest extends Request {
   userId?: string | null;
   user?: OxyRequestUser | null;
-  originalUser?: OxyRequestUser | null;
-  actingAs?: OxyActingAsContext;
   accessToken?: string;
   sessionId?: string | null;
   serviceApp?: OxyServiceAppContext;

package/src/server/index.ts

@@ -24,7 +24,6 @@ export {
   requireOxyAuth,
 } from './auth';
 export type {
-  OxyActingAsContext,
   OxyAuthenticatedRequest,
   OxyAuthMiddlewareOptions,
   OxyAuthRequest,

package/src/utils/cacheKey.ts

@@ -3,8 +3,8 @@
  *
  * Extracted from {@link HttpService} so the identity-tag derivation is a pure,
  * independently testable function with no dependency on instance/token state.
- * The HTTP service injects the live access token and acting-as id; everything
- * here is referentially transparent given those inputs.
+ * The HTTP service injects the live access token; everything here is
+ * referentially transparent given that input.
  */
 
 import { jwtDecode } from 'jwt-decode';
@@ -72,27 +72,22 @@ export function fnv1a32(str: string): string {
  *
  * We use the decoded user id rather than the raw JWT so the token never lands
  * in a cache key (no token leakage through any cache-key logging, no key bloat).
- * The acting-as id is folded in because managed-account responses differ per
- * acting identity — and `X-Acting-As` already changes the server response for
- * the same bearer token.
+ * Switching into a managed account mints a REAL new session whose access token
+ * carries the target account's id, so the identity tag changes naturally on a
+ * switch — there is no separate acting-as discriminator to fold in.
  *
  * @param accessToken The current bearer access token, or `null` when anonymous.
- * @param actingAsUserId The active managed-account id, or `null`.
  */
-export function computeIdentityTag(
-  accessToken: string | null,
-  actingAsUserId: string | null,
-): string {
-  let principal = ANON_IDENTITY;
-  if (accessToken) {
-    try {
-      const decoded = jwtDecode<CacheIdentityJwtPayload>(accessToken);
-      principal = decoded.userId || decoded.id || `t${fnv1a32(accessToken)}`;
-    } catch {
-      // Undecodable token — still partition it away from anon and from other
-      // tokens via a hash. Never silently fall back to ANON_IDENTITY.
-      principal = `t${fnv1a32(accessToken)}`;
-    }
+export function computeIdentityTag(accessToken: string | null): string {
+  if (!accessToken) {
+    return ANON_IDENTITY;
+  }
+  try {
+    const decoded = jwtDecode<CacheIdentityJwtPayload>(accessToken);
+    return decoded.userId || decoded.id || `t${fnv1a32(accessToken)}`;
+  } catch {
+    // Undecodable token — still partition it away from anon and from other
+    // tokens via a hash. Never silently fall back to ANON_IDENTITY.
+    return `t${fnv1a32(accessToken)}`;
   }
-  return actingAsUserId ? `${principal}~as${actingAsUserId}` : principal;
 }

package/src/utils/deviceManager.ts

@@ -1,4 +1,4 @@
-import { loadAsyncStorage } from './platformCrypto';
+import { loadAsyncStorage } from '@oxyhq/protocol';
 
 export interface DeviceFingerprint {
   userAgent: string;

package/src/utils/platform.ts

@@ -88,20 +88,6 @@ export function isAndroid(): boolean {
   return getPlatformOS() === 'android';
 }
 
-/**
- * Check if running in React Native
- */
-export function isReactNative(): boolean {
-  return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
-}
-
-/**
- * Check if running in Node.js
- */
-export function isNodeJS(): boolean {
-  return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
-}
-
 /**
  * Set the platform OS explicitly
  * Called by React Native entry point to register the platform

package/dist/cjs/crypto/canonicalJson.js

@@ -1,107 +0,0 @@
-"use strict";
-/**
- * Canonical JSON (RFC 8785 / JCS-style) serialization.
- *
- * `canonicalize(value)` produces a deterministic string for any JSON-compatible
- * value so that a client which SIGNS a record and a server which VERIFIES it
- * agree byte-for-byte on the signing input — regardless of the order in which
- * object keys happen to be written, how the value was deserialized, or which
- * runtime built it.
- *
- * This is the load-bearing primitive for the self-sovereign identity layer's
- * signed records (`SignatureService.signRecord` + the API's record-verify path):
- * both sides import THIS function from `@oxyhq/core`, so cross-implementation
- * number/string formatting differences cannot cause a verify mismatch.
- *
- * Rules (the JSON Canonicalization Scheme subset we need):
- *  - Objects: keys are sorted (ascending, by UTF-16 code unit — the default
- *    `Array.prototype.sort` order) and serialized recursively. Properties whose
- *    value is `undefined`, a function, or a symbol are OMITTED (matching
- *    `JSON.stringify` object semantics).
- *  - Arrays: element order is PRESERVED; `undefined`/function/symbol elements
- *    serialize to `null` (matching `JSON.stringify` array semantics).
- *  - `null`, booleans, strings, and finite numbers serialize via the standard
- *    JSON representation.
- *  - Values exposing a `toJSON()` method (e.g. `Date`) are replaced by its
- *    result first, then serialized — so a `Date` and its ISO-string equivalent
- *    canonicalize identically (the wire always carries the string form).
- *  - Non-finite numbers (`NaN`, `Infinity`) and `bigint` are not part of the
- *    JSON data model and throw, rather than silently producing `null`.
- *
- * Platform-agnostic — zero dependencies, no `require()`, no react/react-native/
- * expo. Safe in the dual CJS + ESM build.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.canonicalize = canonicalize;
-function hasToJSON(value) {
-    return typeof value.toJSON === 'function';
-}
-/**
- * Serialize a single value into its canonical JSON fragment. Recursive; called
- * on each nested member. Object keys are sorted at every level.
- */
-function serialize(value) {
-    if (value === null) {
-        return 'null';
-    }
-    const valueType = typeof value;
-    if (valueType === 'number') {
-        if (!Number.isFinite(value)) {
-            throw new Error('canonicalize: non-finite numbers cannot be serialized');
-        }
-        return JSON.stringify(value);
-    }
-    if (valueType === 'string' || valueType === 'boolean') {
-        return JSON.stringify(value);
-    }
-    if (valueType === 'bigint') {
-        throw new Error('canonicalize: bigint values cannot be serialized');
-    }
-    if (Array.isArray(value)) {
-        const items = value.map((item) => {
-            const itemType = typeof item;
-            // JSON array semantics: undefined / function / symbol become null so the
-            // element positions (and therefore the array length) are preserved.
-            if (item === undefined || itemType === 'function' || itemType === 'symbol') {
-                return 'null';
-            }
-            return serialize(item);
-        });
-        return `[${items.join(',')}]`;
-    }
-    if (valueType === 'object') {
-        const obj = value;
-        if (hasToJSON(obj)) {
-            return serialize(obj.toJSON());
-        }
-        const record = obj;
-        const parts = [];
-        for (const key of Object.keys(record).sort()) {
-            const member = record[key];
-            const memberType = typeof member;
-            // JSON object semantics: properties with undefined / function / symbol
-            // values are omitted entirely.
-            if (member === undefined || memberType === 'function' || memberType === 'symbol') {
-                continue;
-            }
-            parts.push(`${JSON.stringify(key)}:${serialize(member)}`);
-        }
-        return `{${parts.join(',')}}`;
-    }
-    // undefined / function / symbol at the top level have no JSON representation.
-    throw new Error(`canonicalize: cannot serialize a value of type ${valueType}`);
-}
-/**
- * Produce the canonical JSON string for `value`.
- *
- * Deterministic: two structurally-equal values yield identical strings even if
- * their object keys were written in different orders. Use this — never an
- * ad-hoc `JSON.stringify` of a hand-sorted object — as the signing input for
- * signed records, so client signing and server verification cannot drift.
- *
- * @throws if `value` (or any nested member used as the top-level/primitive)
- *   contains a non-finite number or a `bigint`, which have no JSON form.
- */
-function canonicalize(value) {
-    return serialize(value);
-}