@oxyhq/core 4.0.1 → 5.1.0

package/src/mixins/__tests__/accounts.test.ts

@@ -25,6 +25,7 @@ import type {
   ApplicationCredentialWithSecret,
   RotateApplicationCredentialResult,
   ApplicationUsageStats,
+  SwitchAccountResult,
 } from '../OxyServices.accounts';
 
 const setAccessTokenForTest = (oxy: OxyServices): void => {
@@ -174,6 +175,125 @@ describe('OxyServices.accounts', () => {
     });
   });
 
+  describe('switchToAccount', () => {
+    // The switch route NO LONGER returns `authuser` or sets the device cookie —
+    // it can't (it's at /accounts/*, outside the Path=/auth cookie scope). The SDK
+    // establishes the cookie + resolves the slot via a follow-up POST /auth/session.
+    const switchResponse: SwitchAccountResult = {
+      sessionId: 'sess_switch',
+      deviceId: 'dev_switch',
+      expiresAt: '2026-06-30T01:00:00.000Z',
+      accessToken: 'access_switch',
+      user: { id: 'acc1', username: 'oxy-org', name: { displayName: 'Oxy Org' } },
+    };
+    // POST /auth/session establishes the cookie in a correctly-allocated NEW slot
+    // and returns that slot + a fresh access token off the same session.
+    const sessionResponse = { accessToken: 'access_session', authuser: 1 };
+
+    // Route makeRequest by path: the switch call vs the /auth/session establishment.
+    const routeByPath = (response = switchResponse) =>
+      makeRequestSpy.mockImplementation((_method: string, path: string) =>
+        Promise.resolve(path === '/auth/session' ? sessionResponse : response),
+      );
+
+    it('posts to /:id/switch then establishes the cookie via POST /auth/session, planting both tokens and sweeping the cache', async () => {
+      const setTokensSpy = jest.spyOn(oxy, 'setTokens');
+      const clearCacheSpy = jest.spyOn(oxy, 'clearCache');
+      routeByPath();
+
+      const result = await oxy.switchToAccount('acc1');
+
+      // Switch request shape: POST, exact path, no body, cache disabled.
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/accounts/acc1/switch',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+      // Then the canonical refresh-cookie establishment under /auth (where the
+      // device's oxy_rt_* slots ARE visible, so a NEW slot is allocated).
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/session',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
+
+      // The switch token is planted first; /auth/session's fresh token re-planted.
+      expect(setTokensSpy).toHaveBeenNthCalledWith(1, 'access_switch');
+      expect(setTokensSpy).toHaveBeenNthCalledWith(2, 'access_session');
+      expect(oxy.getAccessToken()).toBe('access_session');
+      expect(oxy.hasValidToken()).toBe(true);
+
+      // Cache swept once, AFTER both tokens are planted.
+      expect(clearCacheSpy).toHaveBeenCalledTimes(1);
+      expect(setTokensSpy.mock.invocationCallOrder[1]).toBeLessThan(
+        clearCacheSpy.mock.invocationCallOrder[0],
+      );
+
+      // The returned session carries the target account (id-normalised) and the
+      // slot resolved by /auth/session — NEVER the clobbering slot 0.
+      expect(result.sessionId).toBe('sess_switch');
+      expect(result.user).toEqual({ id: 'acc1', username: 'oxy-org', name: { displayName: 'Oxy Org' } });
+      expect(result.authuser).toBe(1);
+
+      setTokensSpy.mockRestore();
+      clearCacheSpy.mockRestore();
+    });
+
+    it('URL-encodes the accountId path segment', async () => {
+      routeByPath();
+      await oxy.switchToAccount('a b/c');
+      expect(makeRequestSpy.mock.calls[0][1]).toBe('/accounts/a%20b%2Fc/switch');
+    });
+
+    it('keeps the switch active in-session when /auth/session fails (best-effort cookie)', async () => {
+      const setTokensSpy = jest.spyOn(oxy, 'setTokens');
+      const clearCacheSpy = jest.spyOn(oxy, 'clearCache');
+      makeRequestSpy.mockImplementation((_method: string, path: string) =>
+        path === '/auth/session'
+          ? Promise.reject(Object.assign(new Error('origin'), { response: { status: 403 } }))
+          : Promise.resolve(switchResponse),
+      );
+
+      const result = await oxy.switchToAccount('acc1');
+
+      // The in-session switch survives: the switch token stays planted and the
+      // cache is still swept. The switched account just won't survive a reload
+      // until the cookie is next established (no authuser resolved).
+      expect(setTokensSpy).toHaveBeenCalledWith('access_switch');
+      expect(oxy.getAccessToken()).toBe('access_switch');
+      expect(clearCacheSpy).toHaveBeenCalledTimes(1);
+      expect(result.authuser).toBeUndefined();
+
+      setTokensSpy.mockRestore();
+      clearCacheSpy.mockRestore();
+    });
+
+    it('does NOT plant or sweep when the operator is not authorized (403 surfaces via handleError)', async () => {
+      const setTokensSpy = jest.spyOn(oxy, 'setTokens');
+      const clearCacheSpy = jest.spyOn(oxy, 'clearCache');
+      makeRequestSpy.mockRejectedValue(
+        Object.assign(new Error('forbidden'), { response: { status: 403 } }),
+      );
+
+      await expect(oxy.switchToAccount('acc1')).rejects.toThrow();
+      // A failed switch must NOT mutate session state, and must NOT attempt the
+      // /auth/session establishment.
+      expect(setTokensSpy).not.toHaveBeenCalled();
+      expect(clearCacheSpy).not.toHaveBeenCalled();
+      expect(makeRequestSpy).not.toHaveBeenCalledWith(
+        'POST',
+        '/auth/session',
+        undefined,
+        expect.anything(),
+      );
+
+      setTokensSpy.mockRestore();
+      clearCacheSpy.mockRestore();
+    });
+  });
+
   describe('createAccount', () => {
     it('posts the payload, unwraps `account`, and busts every list', async () => {
       makeRequestSpy.mockResolvedValue({ account: accountNodeFixture });

package/src/models/interfaces.ts

@@ -514,6 +514,25 @@ export interface AssetUpdateVisibilityResponse {
   };
 }
 
+/**
+ * Minimal, service-token-scoped asset metadata returned by
+ * `POST /assets/service/by-ids`.
+ *
+ * Resolves an Oxy asset `id` to its content-addressed identity (`sha256`),
+ * MIME type, byte `size`, and storage `status`. Used by server-to-server
+ * callers (e.g. Mention's MTN Protocol blob-ref resolution) that hold a
+ * `files:read`-scoped service token rather than a user session. Unknown or
+ * deleted ids are omitted from the response (never error the whole batch),
+ * so the result may be shorter than the requested id list.
+ */
+export interface ServiceAssetMetadata {
+  id: string;
+  sha256: string;
+  mime: string;
+  size: number;
+  status: 'active' | 'trash';
+}
+
 /**
  * Account storage usage (server-side usage, not local AsyncStorage)
  */

package/src/server/auth.ts

@@ -10,11 +10,6 @@ export interface OxyRequestUser {
   [key: string]: unknown;
 }
 
-export interface OxyActingAsContext {
-  userId: string;
-  role: 'owner' | 'admin' | 'editor';
-}
-
 export interface OxyServiceAppContext {
   appId: string;
   appName: string;
@@ -30,8 +25,6 @@ export interface OxyServiceActingAsContext {
 export interface OxyAuthRequest extends Request {
   userId?: string | null;
   user?: OxyRequestUser | null;
-  originalUser?: OxyRequestUser | null;
-  actingAs?: OxyActingAsContext;
   accessToken?: string;
   sessionId?: string | null;
   serviceApp?: OxyServiceAppContext;

package/src/server/index.ts

@@ -24,7 +24,6 @@ export {
   requireOxyAuth,
 } from './auth';
 export type {
-  OxyActingAsContext,
   OxyAuthenticatedRequest,
   OxyAuthMiddlewareOptions,
   OxyAuthRequest,

package/src/utils/cacheKey.ts

@@ -3,8 +3,8 @@
  *
  * Extracted from {@link HttpService} so the identity-tag derivation is a pure,
  * independently testable function with no dependency on instance/token state.
- * The HTTP service injects the live access token and acting-as id; everything
- * here is referentially transparent given those inputs.
+ * The HTTP service injects the live access token; everything here is
+ * referentially transparent given that input.
  */
 
 import { jwtDecode } from 'jwt-decode';
@@ -72,27 +72,22 @@ export function fnv1a32(str: string): string {
  *
  * We use the decoded user id rather than the raw JWT so the token never lands
  * in a cache key (no token leakage through any cache-key logging, no key bloat).
- * The acting-as id is folded in because managed-account responses differ per
- * acting identity — and `X-Acting-As` already changes the server response for
- * the same bearer token.
+ * Switching into a managed account mints a REAL new session whose access token
+ * carries the target account's id, so the identity tag changes naturally on a
+ * switch — there is no separate acting-as discriminator to fold in.
  *
  * @param accessToken The current bearer access token, or `null` when anonymous.
- * @param actingAsUserId The active managed-account id, or `null`.
  */
-export function computeIdentityTag(
-  accessToken: string | null,
-  actingAsUserId: string | null,
-): string {
-  let principal = ANON_IDENTITY;
-  if (accessToken) {
-    try {
-      const decoded = jwtDecode<CacheIdentityJwtPayload>(accessToken);
-      principal = decoded.userId || decoded.id || `t${fnv1a32(accessToken)}`;
-    } catch {
-      // Undecodable token — still partition it away from anon and from other
-      // tokens via a hash. Never silently fall back to ANON_IDENTITY.
-      principal = `t${fnv1a32(accessToken)}`;
-    }
+export function computeIdentityTag(accessToken: string | null): string {
+  if (!accessToken) {
+    return ANON_IDENTITY;
+  }
+  try {
+    const decoded = jwtDecode<CacheIdentityJwtPayload>(accessToken);
+    return decoded.userId || decoded.id || `t${fnv1a32(accessToken)}`;
+  } catch {
+    // Undecodable token — still partition it away from anon and from other
+    // tokens via a hash. Never silently fall back to ANON_IDENTITY.
+    return `t${fnv1a32(accessToken)}`;
   }
-  return actingAsUserId ? `${principal}~as${actingAsUserId}` : principal;
 }

package/src/utils/deviceManager.ts

@@ -1,4 +1,4 @@
-import { loadAsyncStorage } from './platformCrypto';
+import { loadAsyncStorage } from '@oxyhq/protocol';
 
 export interface DeviceFingerprint {
   userAgent: string;

package/src/utils/platform.ts

@@ -88,20 +88,6 @@ export function isAndroid(): boolean {
   return getPlatformOS() === 'android';
 }
 
-/**
- * Check if running in React Native
- */
-export function isReactNative(): boolean {
-  return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
-}
-
-/**
- * Check if running in Node.js
- */
-export function isNodeJS(): boolean {
-  return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
-}
-
 /**
  * Set the platform OS explicitly
  * Called by React Native entry point to register the platform

package/dist/cjs/crypto/canonicalJson.js

@@ -1,107 +0,0 @@
-"use strict";
-/**
- * Canonical JSON (RFC 8785 / JCS-style) serialization.
- *
- * `canonicalize(value)` produces a deterministic string for any JSON-compatible
- * value so that a client which SIGNS a record and a server which VERIFIES it
- * agree byte-for-byte on the signing input — regardless of the order in which
- * object keys happen to be written, how the value was deserialized, or which
- * runtime built it.
- *
- * This is the load-bearing primitive for the self-sovereign identity layer's
- * signed records (`SignatureService.signRecord` + the API's record-verify path):
- * both sides import THIS function from `@oxyhq/core`, so cross-implementation
- * number/string formatting differences cannot cause a verify mismatch.
- *
- * Rules (the JSON Canonicalization Scheme subset we need):
- *  - Objects: keys are sorted (ascending, by UTF-16 code unit — the default
- *    `Array.prototype.sort` order) and serialized recursively. Properties whose
- *    value is `undefined`, a function, or a symbol are OMITTED (matching
- *    `JSON.stringify` object semantics).
- *  - Arrays: element order is PRESERVED; `undefined`/function/symbol elements
- *    serialize to `null` (matching `JSON.stringify` array semantics).
- *  - `null`, booleans, strings, and finite numbers serialize via the standard
- *    JSON representation.
- *  - Values exposing a `toJSON()` method (e.g. `Date`) are replaced by its
- *    result first, then serialized — so a `Date` and its ISO-string equivalent
- *    canonicalize identically (the wire always carries the string form).
- *  - Non-finite numbers (`NaN`, `Infinity`) and `bigint` are not part of the
- *    JSON data model and throw, rather than silently producing `null`.
- *
- * Platform-agnostic — zero dependencies, no `require()`, no react/react-native/
- * expo. Safe in the dual CJS + ESM build.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.canonicalize = canonicalize;
-function hasToJSON(value) {
-    return typeof value.toJSON === 'function';
-}
-/**
- * Serialize a single value into its canonical JSON fragment. Recursive; called
- * on each nested member. Object keys are sorted at every level.
- */
-function serialize(value) {
-    if (value === null) {
-        return 'null';
-    }
-    const valueType = typeof value;
-    if (valueType === 'number') {
-        if (!Number.isFinite(value)) {
-            throw new Error('canonicalize: non-finite numbers cannot be serialized');
-        }
-        return JSON.stringify(value);
-    }
-    if (valueType === 'string' || valueType === 'boolean') {
-        return JSON.stringify(value);
-    }
-    if (valueType === 'bigint') {
-        throw new Error('canonicalize: bigint values cannot be serialized');
-    }
-    if (Array.isArray(value)) {
-        const items = value.map((item) => {
-            const itemType = typeof item;
-            // JSON array semantics: undefined / function / symbol become null so the
-            // element positions (and therefore the array length) are preserved.
-            if (item === undefined || itemType === 'function' || itemType === 'symbol') {
-                return 'null';
-            }
-            return serialize(item);
-        });
-        return `[${items.join(',')}]`;
-    }
-    if (valueType === 'object') {
-        const obj = value;
-        if (hasToJSON(obj)) {
-            return serialize(obj.toJSON());
-        }
-        const record = obj;
-        const parts = [];
-        for (const key of Object.keys(record).sort()) {
-            const member = record[key];
-            const memberType = typeof member;
-            // JSON object semantics: properties with undefined / function / symbol
-            // values are omitted entirely.
-            if (member === undefined || memberType === 'function' || memberType === 'symbol') {
-                continue;
-            }
-            parts.push(`${JSON.stringify(key)}:${serialize(member)}`);
-        }
-        return `{${parts.join(',')}}`;
-    }
-    // undefined / function / symbol at the top level have no JSON representation.
-    throw new Error(`canonicalize: cannot serialize a value of type ${valueType}`);
-}
-/**
- * Produce the canonical JSON string for `value`.
- *
- * Deterministic: two structurally-equal values yield identical strings even if
- * their object keys were written in different orders. Use this — never an
- * ad-hoc `JSON.stringify` of a hand-sorted object — as the signing input for
- * signed records, so client signing and server verification cannot drift.
- *
- * @throws if `value` (or any nested member used as the top-level/primitive)
- *   contains a non-finite number or a `bigint`, which have no JSON form.
- */
-function canonicalize(value) {
-    return serialize(value);
-}

package/dist/cjs/utils/platformCrypto.js

@@ -1,165 +0,0 @@
-"use strict";
-/**
- * Platform Crypto / Storage — Default Variant (Node.js, Browser, generic bundlers)
- *
- * Provides lazy access to platform-specific crypto and storage modules.
- *
- * # Variants
- *
- * This module ships in two physical variants on disk, selected per consumer
- * by the bundler / runtime:
- *
- * - `platformCrypto.js`           — this file. Used by Node.js, Vite, webpack,
- *                                   Rollup, esbuild, and anything that does
- *                                   not match Metro's `*.native.js`
- *                                   source-extension preference.
- * - `platformCrypto.native.js`    — sibling file. Picked up automatically by
- *                                   Metro's resolver (which prefers
- *                                   `*.<platform>.js` and `*.native.js` over
- *                                   plain `*.js` when `preferNativePlatform`
- *                                   is true — Expo sets this for all non-web
- *                                   builds).
- *
- * The `package.json#exports` map also declares a `"react-native"` condition
- * pointing at the same `dist/esm/index.js` entry — that entry transitively
- * imports `./platformCrypto`, and Metro's per-file source-extension lookup
- * substitutes the `.native.js` sibling automatically inside `dist/`. This
- * means consumers never have to add resolver shims; Metro Just Works.
- *
- * Both variants expose the EXACT same public API; importers don't need to know
- * which one they got. The variant difference is purely about which underlying
- * native modules each one references:
- *
- *   ┌──────────────────┬───────────────────────┬───────────────────────────────┐
- *   │ Function         │ Default variant       │ React Native variant          │
- *   ├──────────────────┼───────────────────────┼───────────────────────────────┤
- *   │ loadNodeCrypto   │ `await import('crypto')` (Node built-in)              │
- *   │                  │                       │ throws — Node crypto is not   │
- *   │                  │                       │ available on Hermes/RN        │
- *   ├──────────────────┼───────────────────────┼───────────────────────────────┤
- *   │ loadExpoCrypto   │ throws — expo-crypto  │ static `import 'expo-crypto'` │
- *   │                  │ is not part of a      │                               │
- *   │                  │ Node/Vite bundle      │                               │
- *   ├──────────────────┼───────────────────────┼───────────────────────────────┤
- *   │ loadSecureStore  │ throws (web/Node have │ static `import 'expo-secure-` │
- *   │                  │ their own storage)    │ store'                        │
- *   ├──────────────────┼───────────────────────┼───────────────────────────────┤
- *   │ loadAsyncStorage │ throws (web/Node have │ static `import '@react-       │
- *   │                  │ their own storage)    │ native-async-storage/...'     │
- *   ├──────────────────┼───────────────────────┼───────────────────────────────┤
- *   │ getRandomBytesRN │ throws (RN-only)      │ direct call into expo-crypto  │
- *   └──────────────────┴───────────────────────┴───────────────────────────────┘
- *
- * Crucially, the default variant references ONLY Node's `'crypto'`. It never
- * mentions `expo-*` or `@react-native-async-storage/*` — so Vite, webpack,
- * esbuild, Rollup, and Node itself can bundle / require it without ever
- * attempting to resolve those RN-only packages.
- *
- * The React Native variant references ONLY the RN packages. It never
- * mentions `'crypto'` — so Metro and Hermes have nothing to choke on.
- *
- * # Why not a single file with dynamic import?
- *
- * A previous iteration used a "bundler-opaque" `new Function('s', 'return
- * import(s)')` trick so a single file could service every platform. It
- * bundled cleanly on Metro but Hermes refused to PARSE the resulting
- * `import()` expression inside a Function-constructor body
- * (`SyntaxError: Invalid expression encountered` at the `(` of `import(`).
- * The platform-extension split is the only approach that lets each runtime
- * see a file containing only specifiers it can understand — no tricks, no
- * runtime parsing risks.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadNodeCrypto = loadNodeCrypto;
-exports.loadExpoCrypto = loadExpoCrypto;
-exports.loadSecureStore = loadSecureStore;
-exports.loadAsyncStorage = loadAsyncStorage;
-exports.getRandomBytesRN = getRandomBytesRN;
-const platform_1 = require("./platform");
-// ---------------------------------------------------------------------------
-// Node `crypto` — Node built-in
-//
-// `await import('crypto')` here is a real, static-from-tsc's-perspective
-// dynamic import. Node ESM, Vite, webpack, and esbuild all resolve it fine.
-// Metro never sees this file because the `.react-native.js` sibling shadows
-// it, so Metro never tries to resolve `'crypto'`.
-// ---------------------------------------------------------------------------
-let cachedNodeCrypto = null;
-async function loadNodeCrypto() {
-    if (cachedNodeCrypto) {
-        return cachedNodeCrypto;
-    }
-    cachedNodeCrypto = await Promise.resolve().then(() => __importStar(require('node:crypto')));
-    return cachedNodeCrypto;
-}
-// ---------------------------------------------------------------------------
-// RN-only modules — never called from this variant.
-//
-// These throw a clear error if anything ever reaches them outside RN. In
-// practice every caller gates with `isReactNative()` before calling, so
-// these are belt-and-braces.
-// ---------------------------------------------------------------------------
-function notReactNativeError(module) {
-    return new Error(`[oxy.platformCrypto] Tried to load '${module}' outside React Native. This module is only available in a React Native runtime; bundling routed this consumer to the default (Node/web) variant. This indicates a missing platform gate (\`isReactNative()\`) in the calling code.`);
-}
-async function loadExpoCrypto() {
-    if ((0, platform_1.isReactNative)()) {
-        // Should be unreachable: when running on RN, Metro / the `react-native`
-        // exports condition serves the sibling variant. If we got here, the
-        // package-exports map is misconfigured for this host. Throw with a
-        // helpful diagnostic rather than fall back to a broken dynamic import.
-        throw new Error('[oxy.platformCrypto] React Native runtime resolved the default ' +
-            '(non-RN) variant of @oxyhq/core/utils/platformCrypto. Check the ' +
-            "consumer's bundler resolution — Metro should pick the sibling " +
-            '.react-native.js file via package exports.');
-    }
-    throw notReactNativeError('expo-crypto');
-}
-async function loadSecureStore() {
-    throw notReactNativeError('expo-secure-store');
-}
-async function loadAsyncStorage() {
-    throw notReactNativeError('@react-native-async-storage/async-storage');
-}
-/**
- * Synchronous random-bytes via `expo-crypto.getRandomBytes`. Only available
- * in the React Native variant. The default variant throws because Node and
- * browsers have their own native CSPRNGs (`crypto.randomBytes` and
- * `crypto.getRandomValues` respectively) — callers should use those.
- */
-function getRandomBytesRN(_byteCount) {
-    throw notReactNativeError('expo-crypto.getRandomBytes (sync)');
-}