@oxyhq/core 4.0.1 → 5.0.0

package/dist/cjs/mixins/OxyServices.accounts.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OxyServicesAccountsMixin = OxyServicesAccountsMixin;
+const userIdentity_1 = require("../utils/userIdentity");
 const mixinHelpers_1 = require("./mixinHelpers");
 function OxyServicesAccountsMixin(Base) {
     return class extends Base {
@@ -43,6 +44,59 @@ function OxyServicesAccountsMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * Switch the active session INTO a managed account.
+         *
+         * Calls `POST /accounts/:id/switch` with the signed-in operator's bearer.
+         * The server authorises the operator (must hold `account:act_as` over the
+         * target, directly or inherited — else 403; 404 if missing/archived; 403 if
+         * the target is a personal account), then mints a REAL session for the
+         * target account and returns it in the canonical login / `claimSessionByToken`
+         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user, authuser }`).
+         *
+         * Unlike the removed `X-Acting-As` delegation header, the returned session
+         * IS the new identity: this plants `accessToken` as the active token —
+         * exactly like `claimSessionByToken` / `verifyChallenge` — so every
+         * subsequent request authenticates as the target account. The refresh token
+         * is the server-set httpOnly `oxy_rt_<authuser>` cookie (never in the body),
+         * so it joins the device multi-account set and survives reload /
+         * `refresh-all` with no extra client work.
+         *
+         * After planting, the SDK's identity-scoped GET cache is fully cleared so
+         * every cached read re-fetches as the new account. (The consuming
+         * `OxyContext` additionally invalidates its React Query cache and updates
+         * session state from the returned `user`; this clears the SDK's own HTTP
+         * cache at the source — `setTokens` deliberately preserves the warm cache for
+         * same-user silent refreshes, so the sweep here is explicit.)
+         *
+         * @param accountId - The target account's Mongo `_id`.
+         * @returns The minted session (planted) plus the device `authuser` slot.
+         */
+        async switchToAccount(accountId) {
+            try {
+                const res = await this.makeRequest('POST', `/accounts/${encodeURIComponent(accountId)}/switch`, undefined, { cache: false });
+                // Plant the freshly minted session as the ACTIVE session, mirroring
+                // `claimSessionByToken` / `verifyChallenge`: the response body carries
+                // the first access token; the refresh token is the server-set httpOnly
+                // cookie, so there is nothing else to store here.
+                if (res?.accessToken) {
+                    this.setTokens(res.accessToken);
+                }
+                // Identity changed → drop the entire GET response cache so no entry
+                // personalised for the previous identity is reused. Cache keys are
+                // identity-scoped, so a different identity could not READ the old
+                // entries anyway, but clearing guarantees a clean refetch as the new
+                // account and frees the prior identity's resident data.
+                this.clearCache();
+                return {
+                    ...res,
+                    user: (0, userIdentity_1.normalizeUserIdentity)(res.user),
+                };
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
         /**
          * Create a new (non-personal) account. The caller becomes its `owner`.
          * @param data - Account configuration: kind, optional parent, and profile.

package/dist/cjs/mixins/OxyServices.assets.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OxyServicesAssetsMixin = OxyServicesAssetsMixin;
-const platform_1 = require("../utils/platform");
+const protocol_1 = require("@oxyhq/protocol");
 function OxyServicesAssetsMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -173,7 +173,7 @@ function OxyServicesAssetsMixin(Base) {
                 }
                 else if ('uri' in file && typeof file.uri === 'string') {
                     const descriptor = file;
-                    if ((0, platform_1.isReactNative)()) {
+                    if ((0, protocol_1.isReactNative)()) {
                         // React Native file descriptor — RN's FormData handles {uri, type, name} natively.
                         // It reads the file from disk during the multipart request — no in-JS Blob
                         // conversion (which would fail on Hermes for ArrayBuffer-backed Blobs).

package/dist/cjs/mixins/OxyServices.auth.js

@@ -5,7 +5,7 @@ exports.OxyServicesAuthMixin = OxyServicesAuthMixin;
 const OxyServices_errors_1 = require("../OxyServices.errors");
 const keyManager_1 = require("../crypto/keyManager");
 const signatureService_1 = require("../crypto/signatureService");
-const platformCrypto_1 = require("../utils/platformCrypto");
+const protocol_1 = require("@oxyhq/protocol");
 const loggerUtils_1 = require("../utils/loggerUtils");
 const userIdentity_1 = require("../utils/userIdentity");
 /**
@@ -61,7 +61,7 @@ function OxyServicesAuthMixin(Base) {
          * @internal
          */
         async _hashApiKey(apiKey) {
-            const nodeCrypto = await (0, platformCrypto_1.loadNodeCrypto)();
+            const nodeCrypto = await (0, protocol_1.loadNodeCrypto)();
             return nodeCrypto.createHash('sha256').update(apiKey).digest('hex');
         }
         /**
@@ -113,7 +113,7 @@ function OxyServicesAuthMixin(Base) {
             // Verify the secret on every cache hit, regardless of token freshness.
             // Constant-time compare prevents timing oracles on the stored secret.
             if (entry) {
-                const nodeCrypto = await (0, platformCrypto_1.loadNodeCrypto)();
+                const nodeCrypto = await (0, protocol_1.loadNodeCrypto)();
                 const storedSecretBuf = entry.secretBuf;
                 const lengthMatch = storedSecretBuf.length === providedSecretBuf.length;
                 // Always run timingSafeEqual on equal-length inputs to keep timing flat.

package/dist/cjs/mixins/OxyServices.civic.js

@@ -4,7 +4,7 @@ exports.parseIdPayload = parseIdPayload;
 exports.parseAttestPayload = parseAttestPayload;
 exports.verifyPublicCardAttestation = verifyPublicCardAttestation;
 exports.OxyServicesCivicMixin = OxyServicesCivicMixin;
-const canonicalJson_1 = require("../crypto/canonicalJson");
+const protocol_1 = require("@oxyhq/protocol");
 const signatureService_1 = require("../crypto/signatureService");
 const OxyServices_identity_1 = require("./OxyServices.identity");
 const mixinHelpers_1 = require("./mixinHelpers");
@@ -156,7 +156,7 @@ function parseAttestPayload(raw) {
  * key, matching the server which omits absent keys entirely) and checks the
  * `ES256K-DER-SHA256` signature against `attestation.publicKey`.
  *
- * NEVER throws: `SignatureService.verify` already swallows malformed-input
+ * NEVER throws: `verifySignature` already swallows malformed-input
  * errors and returns `false`, and an absent attestation short-circuits to
  * `false`. A pure, reusable helper (Commons can call it on a cached card).
  *
@@ -171,7 +171,7 @@ async function verifyPublicCardAttestation(card, attestation) {
     if (!signature || !publicKey) {
         return false;
     }
-    return signatureService_1.SignatureService.verify((0, canonicalJson_1.canonicalize)(card), signature, publicKey);
+    return (0, protocol_1.verifySignature)((0, protocol_1.canonicalize)(card), signature, publicKey);
 }
 function OxyServicesCivicMixin(Base) {
     return class extends Base {

package/dist/cjs/mixins/OxyServices.language.js

@@ -5,7 +5,7 @@ exports.OxyServicesLanguageMixin = OxyServicesLanguageMixin;
  * Language Methods Mixin
  */
 const languageUtils_1 = require("../utils/languageUtils");
-const platformCrypto_1 = require("../utils/platformCrypto");
+const protocol_1 = require("@oxyhq/protocol");
 const debugUtils_1 = require("../shared/utils/debugUtils");
 function OxyServicesLanguageMixin(Base) {
     return class extends Base {
@@ -22,7 +22,7 @@ function OxyServicesLanguageMixin(Base) {
                     // `loadAsyncStorage` is per-platform: the RN variant statically imports
                     // @react-native-async-storage/async-storage, the default variant throws
                     // (never called outside RN because of the `isReactNative` gate above).
-                    const asyncStorageModule = await (0, platformCrypto_1.loadAsyncStorage)();
+                    const asyncStorageModule = await (0, protocol_1.loadAsyncStorage)();
                     const storage = asyncStorageModule.default;
                     return {
                         getItem: storage.getItem.bind(storage),

package/dist/cjs/mixins/OxyServices.utility.js

@@ -8,7 +8,7 @@ exports.OxyServicesUtilityMixin = OxyServicesUtilityMixin;
  * and Express.js authentication middleware
  */
 const jwt_decode_1 = require("jwt-decode");
-const platformCrypto_1 = require("../utils/platformCrypto");
+const protocol_1 = require("@oxyhq/protocol");
 const loggerUtils_1 = require("../utils/loggerUtils");
 const mixinHelpers_1 = require("./mixinHelpers");
 /**
@@ -50,8 +50,6 @@ function OxyServicesUtilityMixin(Base) {
         // monorepo-wide refactor of the mixin pipeline.
         constructor(...args) {
             super(...args);
-            /** @internal In-memory cache for acting-as verification results (TTL: 5 min) */
-            this._actingAsCache = new Map();
             /**
              * In-memory cache for service-acting-as verification.
              * Negative results are cached for 1min to avoid hammering the verify
@@ -61,46 +59,6 @@ function OxyServicesUtilityMixin(Base) {
              */
             this._serviceActingAsCache = new Map();
         }
-        /**
-         * Verify that a user is authorized to act as an account (direct membership
-         * or inherited via an ancestor). Backed by `GET /accounts/verify-acting-as`.
-         * Results are cached in-memory for 5 minutes to avoid repeated API calls.
-         *
-         * @internal Used by the auth() middleware — not part of the public API
-         */
-        async verifyActingAs(userId, accountId) {
-            const cacheKey = `${userId}:${accountId}`;
-            const now = Date.now();
-            // Check cache
-            const cached = this._actingAsCache.get(cacheKey);
-            if (cached && cached.expiresAt > now) {
-                return cached.result;
-            }
-            // Query the API
-            try {
-                const result = await this.makeRequest('GET', '/accounts/verify-acting-as', { accountId, userId }, { cache: false, retry: false, timeout: 5000 });
-                // Cache successful result for 5 minutes
-                this._actingAsCache.set(cacheKey, {
-                    result: result && result.authorized ? result : null,
-                    expiresAt: now + 5 * 60 * 1000,
-                });
-                return result && result.authorized ? result : null;
-            }
-            catch (error) {
-                loggerUtils_1.logger.warn('[oxy.auth] verifyActingAs lookup failed — caching negative result', {
-                    component: 'auth',
-                    method: 'verifyActingAs',
-                    userId,
-                    accountId,
-                }, error);
-                // Cache negative result for 1 minute to avoid hammering on transient errors
-                this._actingAsCache.set(cacheKey, {
-                    result: null,
-                    expiresAt: now + 1 * 60 * 1000,
-                });
-                return null;
-            }
-        }
         /**
          * Verify that a service app holds an active delegation grant authorising
          * it to act on behalf of `userId`. Returns the grant (with allowed scopes)
@@ -221,47 +179,6 @@ function OxyServicesUtilityMixin(Base) {
             const oxyInstance = this;
             // Return an async middleware function
             return async (req, res, next) => {
-                // Process X-Acting-As header for managed account identity delegation.
-                // Called after successful authentication, before next(). If the header
-                // is present, verifies authorization and swaps the request identity to
-                // the managed account, preserving the original user for audit trails.
-                const processActingAs = async () => {
-                    const actingAsUserId = req.headers['x-acting-as'];
-                    if (!actingAsUserId || typeof actingAsUserId !== 'string')
-                        return true; // No header, proceed normally
-                    const currentUserId = req.userId;
-                    if (!currentUserId)
-                        return true; // No authenticated user yet — nothing to swap
-                    const verification = await oxyInstance.verifyActingAs(currentUserId, actingAsUserId);
-                    if (!verification) {
-                        const error = {
-                            error: 'ACTING_AS_UNAUTHORIZED',
-                            message: 'Not authorized to act as this account',
-                            code: 'ACTING_AS_UNAUTHORIZED',
-                            status: 403,
-                        };
-                        if (onError) {
-                            onError(error);
-                        }
-                        else {
-                            res.status(403).json(error);
-                        }
-                        return false;
-                    }
-                    // Preserve original user for audit trails
-                    req.originalUser = { id: currentUserId, ...(req.user ?? {}) };
-                    req.actingAs = { userId: actingAsUserId, role: verification.role };
-                    // Swap user identity to the managed account
-                    req.userId = actingAsUserId;
-                    req.user = { id: actingAsUserId, _id: actingAsUserId };
-                    if (debug) {
-                        loggerUtils_1.logger.debug(`[oxy.auth] Acting as ${actingAsUserId} (role=${verification.role}) original=${currentUserId}`, {
-                            component: 'auth',
-                            method: 'auth.processActingAs',
-                        });
-                    }
-                    return true;
-                };
                 try {
                     // Extract token from Authorization header.
                     // Node/Express normalizes `Authorization` to a string; we guard
@@ -343,9 +260,9 @@ function OxyServicesUtilityMixin(Base) {
                         // Signature verification uses a manual HMAC-SHA256 compare because
                         // this file ships into RN/web bundles where `jsonwebtoken` is
                         // unavailable. The middleware only ever runs on Node hosts (see
-                        // platformCrypto's doc-comment), and `loadNodeCrypto` is per-
-                        // platform: the RN variant throws so Metro never bundles a Node
-                        // built-in reference.
+                        // `@oxyhq/protocol`'s `platform/crypto` doc-comment), and
+                        // `loadNodeCrypto` is per-platform: the RN variant throws so Metro
+                        // never bundles a Node built-in reference.
                         try {
                             await verifyServiceTokenSignature(token, jwtSecret);
                             verifyServiceTokenClaims(decoded, {
@@ -554,10 +471,7 @@ function OxyServicesUtilityMixin(Base) {
                                     method: 'auth',
                                 });
                             }
-                            // Process X-Acting-As header before proceeding
-                            if (await processActingAs())
-                                return next();
-                            return;
+                            return next();
                         }
                         catch (validationError) {
                             if (debug) {
@@ -621,9 +535,7 @@ function OxyServicesUtilityMixin(Base) {
                             method: 'auth',
                         });
                     }
-                    // Process X-Acting-As header before proceeding
-                    if (await processActingAs())
-                        next();
+                    next();
                 }
                 catch (error) {
                     const handled = oxyInstance.handleError(error);
@@ -861,7 +773,7 @@ function OxyServicesUtilityMixin(Base) {
  * `ServiceTokenSignatureError` on signature mismatch — both map to 401.
  */
 async function verifyServiceTokenSignature(token, secret) {
-    const nodeCrypto = await (0, platformCrypto_1.loadNodeCrypto)();
+    const nodeCrypto = await (0, protocol_1.loadNodeCrypto)();
     const { createHmac, timingSafeEqual } = nodeCrypto;
     const parts = token.split('.');
     if (parts.length !== 3) {

package/dist/cjs/utils/cacheKey.js

@@ -4,8 +4,8 @@
  *
  * Extracted from {@link HttpService} so the identity-tag derivation is a pure,
  * independently testable function with no dependency on instance/token state.
- * The HTTP service injects the live access token and acting-as id; everything
- * here is referentially transparent given those inputs.
+ * The HTTP service injects the live access token; everything here is
+ * referentially transparent given that input.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ANON_IDENTITY = void 0;
@@ -63,25 +63,23 @@ function fnv1a32(str) {
  *
  * We use the decoded user id rather than the raw JWT so the token never lands
  * in a cache key (no token leakage through any cache-key logging, no key bloat).
- * The acting-as id is folded in because managed-account responses differ per
- * acting identity — and `X-Acting-As` already changes the server response for
- * the same bearer token.
+ * Switching into a managed account mints a REAL new session whose access token
+ * carries the target account's id, so the identity tag changes naturally on a
+ * switch — there is no separate acting-as discriminator to fold in.
  *
  * @param accessToken The current bearer access token, or `null` when anonymous.
- * @param actingAsUserId The active managed-account id, or `null`.
  */
-function computeIdentityTag(accessToken, actingAsUserId) {
-    let principal = exports.ANON_IDENTITY;
-    if (accessToken) {
-        try {
-            const decoded = (0, jwt_decode_1.jwtDecode)(accessToken);
-            principal = decoded.userId || decoded.id || `t${fnv1a32(accessToken)}`;
-        }
-        catch {
-            // Undecodable token — still partition it away from anon and from other
-            // tokens via a hash. Never silently fall back to ANON_IDENTITY.
-            principal = `t${fnv1a32(accessToken)}`;
-        }
+function computeIdentityTag(accessToken) {
+    if (!accessToken) {
+        return exports.ANON_IDENTITY;
+    }
+    try {
+        const decoded = (0, jwt_decode_1.jwtDecode)(accessToken);
+        return decoded.userId || decoded.id || `t${fnv1a32(accessToken)}`;
+    }
+    catch {
+        // Undecodable token — still partition it away from anon and from other
+        // tokens via a hash. Never silently fall back to ANON_IDENTITY.
+        return `t${fnv1a32(accessToken)}`;
     }
-    return actingAsUserId ? `${principal}~as${actingAsUserId}` : principal;
 }

package/dist/cjs/utils/deviceManager.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeviceManager = void 0;
-const platformCrypto_1 = require("./platformCrypto");
+const protocol_1 = require("@oxyhq/protocol");
 /**
  * Client-side device management utility
  * Handles persistent device identification across app sessions
@@ -22,7 +22,7 @@ class DeviceManager {
                 // `loadAsyncStorage` is per-platform: the RN variant statically imports
                 // @react-native-async-storage/async-storage, the default variant throws
                 // (never called outside RN because of the `isReactNative()` gate above).
-                const asyncStorageModule = await (0, platformCrypto_1.loadAsyncStorage)();
+                const asyncStorageModule = await (0, protocol_1.loadAsyncStorage)();
                 const storage = asyncStorageModule.default;
                 return {
                     getItem: storage.getItem.bind(storage),

package/dist/cjs/utils/platform.js

@@ -12,8 +12,6 @@ exports.isWeb = isWeb;
 exports.isNative = isNative;
 exports.isIOS = isIOS;
 exports.isAndroid = isAndroid;
-exports.isReactNative = isReactNative;
-exports.isNodeJS = isNodeJS;
 exports.setPlatformOS = setPlatformOS;
 /**
  * Detect the current platform without importing react-native
@@ -84,18 +82,6 @@ function isIOS() {
 function isAndroid() {
     return getPlatformOS() === 'android';
 }
-/**
- * Check if running in React Native
- */
-function isReactNative() {
-    return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
-}
-/**
- * Check if running in Node.js
- */
-function isNodeJS() {
-    return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
-}
 /**
  * Set the platform OS explicitly
  * Called by React Native entry point to register the platform