@oxyhq/core 4.0.1 → 5.1.0

package/dist/esm/mixins/OxyServices.assets.js

@@ -1,4 +1,13 @@
-import { isReactNative } from '../utils/platform.js';
+import { isReactNative } from '@oxyhq/protocol';
+import { logger } from '../utils/loggerUtils.js';
+import { extractErrorStatus } from '../utils/errorUtils.js';
+/**
+ * Maximum number of ids sent per `POST /assets/service/by-ids` request. Matches
+ * the server-side batch cap (the route rejects empty or > 100 id arrays with a
+ * 400); larger inputs are split into multiple chunked calls and merged. Mirrors
+ * `getUsersByIds`'s `USERS_BY_IDS_CHUNK_SIZE`.
+ */
+const SERVICE_ASSET_METADATA_CHUNK_SIZE = 100;
 export function OxyServicesAssetsMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -144,6 +153,63 @@ export function OxyServicesAssetsMixin(Base) {
             }
             return urls;
         }
+        /**
+         * Resolve many Oxy asset ids to their content-addressed metadata in one
+         * round-trip per chunk via `POST /assets/service/by-ids` (body `{ ids }`).
+         *
+         * Returns each asset's `sha256`, `mime`, byte `size`, and `status` — built
+         * for server-to-server callers (e.g. Mention's MTN Protocol blob-ref
+         * resolution) that need the content hash for an asset id. Ids are
+         * deduplicated and validated (empty/blank ids dropped) before being split
+         * into chunks of {@link SERVICE_ASSET_METADATA_CHUNK_SIZE} (the server-side
+         * cap). The server omits unknown/deleted ids from each chunk's `data`, so
+         * the merged result may be shorter than the requested id list and the caller
+         * is expected to map by `id`.
+         *
+         * **Service-token auth (required).** `/assets/service/by-ids` is guarded by
+         * `serviceAuthMiddleware` + the `files:read` scope and is called via
+         * `makeServiceRequest`, which attaches `Authorization: Bearer <serviceToken>`
+         * (the same client that calls `POST /assets/service/cache`). The calling
+         * client MUST be service-configured (`configureServiceAuth(apiKey,
+         * apiSecret)`) before invoking this method; otherwise `getServiceToken()`
+         * throws because no credentials are available. A plain user-session request
+         * is rejected by the route's service-auth guard.
+         *
+         * Resilience: chunks are independent. A failed chunk is logged and skipped —
+         * the method returns every entry that resolved successfully rather than
+         * discarding the whole call on one chunk's failure. An empty/whitespace-only
+         * input resolves immediately with `[]` and performs no network call.
+         *
+         * Not cached at the SDK layer: it's a POST keyed on a multi-id body (low hit
+         * rate), mirroring the sibling service/POST methods which never cache.
+         */
+        async getServiceAssetMetadataByIds(ids) {
+            const uniqueIds = Array.from(new Set(ids.filter((id) => typeof id === 'string' && id.trim().length > 0)));
+            if (uniqueIds.length === 0) {
+                return [];
+            }
+            const chunks = [];
+            for (let i = 0; i < uniqueIds.length; i += SERVICE_ASSET_METADATA_CHUNK_SIZE) {
+                chunks.push(uniqueIds.slice(i, i + SERVICE_ASSET_METADATA_CHUNK_SIZE));
+            }
+            // Run chunks concurrently; a single chunk failure must not sink the rest.
+            const settled = await Promise.all(chunks.map(async (chunk) => {
+                try {
+                    const entries = await this.makeServiceRequest('POST', '/assets/service/by-ids', { ids: chunk });
+                    return Array.isArray(entries) ? entries : [];
+                }
+                catch (error) {
+                    logger.warn('getServiceAssetMetadataByIds: chunk failed, continuing with remaining chunks', {
+                        method: 'getServiceAssetMetadataByIds',
+                        chunkSize: chunk.length,
+                        status: extractErrorStatus(error),
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    return [];
+                }
+            }));
+            return settled.flat();
+        }
         /**
          * Upload raw file data
          */

package/dist/esm/mixins/OxyServices.auth.js

@@ -1,7 +1,7 @@
 import { OxyAuthenticationError } from '../OxyServices.errors.js';
 import { KeyManager } from '../crypto/keyManager.js';
 import { SignatureService } from '../crypto/signatureService.js';
-import { loadNodeCrypto } from '../utils/platformCrypto.js';
+import { loadNodeCrypto } from '@oxyhq/protocol';
 import { logger } from '../utils/loggerUtils.js';
 import { normalizeUserIdentity, normalizeUserIdentityOrNull } from '../utils/userIdentity.js';
 /**

package/dist/esm/mixins/OxyServices.civic.js

@@ -1,4 +1,4 @@
-import { canonicalize } from '../crypto/canonicalJson.js';
+import { canonicalize, verifySignature } from '@oxyhq/protocol';
 import { SignatureService } from '../crypto/signatureService.js';
 import { buildUserDid } from './OxyServices.identity.js';
 import { CACHE_TIMES } from './mixinHelpers.js';
@@ -150,7 +150,7 @@ export function parseAttestPayload(raw) {
  * key, matching the server which omits absent keys entirely) and checks the
  * `ES256K-DER-SHA256` signature against `attestation.publicKey`.
  *
- * NEVER throws: `SignatureService.verify` already swallows malformed-input
+ * NEVER throws: `verifySignature` already swallows malformed-input
  * errors and returns `false`, and an absent attestation short-circuits to
  * `false`. A pure, reusable helper (Commons can call it on a cached card).
  *
@@ -165,7 +165,7 @@ export async function verifyPublicCardAttestation(card, attestation) {
     if (!signature || !publicKey) {
         return false;
     }
-    return SignatureService.verify(canonicalize(card), signature, publicKey);
+    return verifySignature(canonicalize(card), signature, publicKey);
 }
 export function OxyServicesCivicMixin(Base) {
     return class extends Base {

package/dist/esm/mixins/OxyServices.language.js

@@ -2,7 +2,7 @@
  * Language Methods Mixin
  */
 import { normalizeLanguageCode, getLanguageMetadata, getLanguageName, getNativeLanguageName } from '../utils/languageUtils.js';
-import { loadAsyncStorage } from '../utils/platformCrypto.js';
+import { loadAsyncStorage } from '@oxyhq/protocol';
 import { isDev } from '../shared/utils/debugUtils.js';
 export function OxyServicesLanguageMixin(Base) {
     return class extends Base {

package/dist/esm/mixins/OxyServices.utility.js

@@ -5,7 +5,7 @@
  * and Express.js authentication middleware
  */
 import { jwtDecode } from 'jwt-decode';
-import { loadNodeCrypto } from '../utils/platformCrypto.js';
+import { loadNodeCrypto } from '@oxyhq/protocol';
 import { logger } from '../utils/loggerUtils.js';
 import { CACHE_TIMES } from './mixinHelpers.js';
 /**
@@ -47,8 +47,6 @@ export function OxyServicesUtilityMixin(Base) {
         // monorepo-wide refactor of the mixin pipeline.
         constructor(...args) {
             super(...args);
-            /** @internal In-memory cache for acting-as verification results (TTL: 5 min) */
-            this._actingAsCache = new Map();
             /**
              * In-memory cache for service-acting-as verification.
              * Negative results are cached for 1min to avoid hammering the verify
@@ -58,46 +56,6 @@ export function OxyServicesUtilityMixin(Base) {
              */
             this._serviceActingAsCache = new Map();
         }
-        /**
-         * Verify that a user is authorized to act as an account (direct membership
-         * or inherited via an ancestor). Backed by `GET /accounts/verify-acting-as`.
-         * Results are cached in-memory for 5 minutes to avoid repeated API calls.
-         *
-         * @internal Used by the auth() middleware — not part of the public API
-         */
-        async verifyActingAs(userId, accountId) {
-            const cacheKey = `${userId}:${accountId}`;
-            const now = Date.now();
-            // Check cache
-            const cached = this._actingAsCache.get(cacheKey);
-            if (cached && cached.expiresAt > now) {
-                return cached.result;
-            }
-            // Query the API
-            try {
-                const result = await this.makeRequest('GET', '/accounts/verify-acting-as', { accountId, userId }, { cache: false, retry: false, timeout: 5000 });
-                // Cache successful result for 5 minutes
-                this._actingAsCache.set(cacheKey, {
-                    result: result && result.authorized ? result : null,
-                    expiresAt: now + 5 * 60 * 1000,
-                });
-                return result && result.authorized ? result : null;
-            }
-            catch (error) {
-                logger.warn('[oxy.auth] verifyActingAs lookup failed — caching negative result', {
-                    component: 'auth',
-                    method: 'verifyActingAs',
-                    userId,
-                    accountId,
-                }, error);
-                // Cache negative result for 1 minute to avoid hammering on transient errors
-                this._actingAsCache.set(cacheKey, {
-                    result: null,
-                    expiresAt: now + 1 * 60 * 1000,
-                });
-                return null;
-            }
-        }
         /**
          * Verify that a service app holds an active delegation grant authorising
          * it to act on behalf of `userId`. Returns the grant (with allowed scopes)
@@ -218,47 +176,6 @@ export function OxyServicesUtilityMixin(Base) {
             const oxyInstance = this;
             // Return an async middleware function
             return async (req, res, next) => {
-                // Process X-Acting-As header for managed account identity delegation.
-                // Called after successful authentication, before next(). If the header
-                // is present, verifies authorization and swaps the request identity to
-                // the managed account, preserving the original user for audit trails.
-                const processActingAs = async () => {
-                    const actingAsUserId = req.headers['x-acting-as'];
-                    if (!actingAsUserId || typeof actingAsUserId !== 'string')
-                        return true; // No header, proceed normally
-                    const currentUserId = req.userId;
-                    if (!currentUserId)
-                        return true; // No authenticated user yet — nothing to swap
-                    const verification = await oxyInstance.verifyActingAs(currentUserId, actingAsUserId);
-                    if (!verification) {
-                        const error = {
-                            error: 'ACTING_AS_UNAUTHORIZED',
-                            message: 'Not authorized to act as this account',
-                            code: 'ACTING_AS_UNAUTHORIZED',
-                            status: 403,
-                        };
-                        if (onError) {
-                            onError(error);
-                        }
-                        else {
-                            res.status(403).json(error);
-                        }
-                        return false;
-                    }
-                    // Preserve original user for audit trails
-                    req.originalUser = { id: currentUserId, ...(req.user ?? {}) };
-                    req.actingAs = { userId: actingAsUserId, role: verification.role };
-                    // Swap user identity to the managed account
-                    req.userId = actingAsUserId;
-                    req.user = { id: actingAsUserId, _id: actingAsUserId };
-                    if (debug) {
-                        logger.debug(`[oxy.auth] Acting as ${actingAsUserId} (role=${verification.role}) original=${currentUserId}`, {
-                            component: 'auth',
-                            method: 'auth.processActingAs',
-                        });
-                    }
-                    return true;
-                };
                 try {
                     // Extract token from Authorization header.
                     // Node/Express normalizes `Authorization` to a string; we guard
@@ -340,9 +257,9 @@ export function OxyServicesUtilityMixin(Base) {
                         // Signature verification uses a manual HMAC-SHA256 compare because
                         // this file ships into RN/web bundles where `jsonwebtoken` is
                         // unavailable. The middleware only ever runs on Node hosts (see
-                        // platformCrypto's doc-comment), and `loadNodeCrypto` is per-
-                        // platform: the RN variant throws so Metro never bundles a Node
-                        // built-in reference.
+                        // `@oxyhq/protocol`'s `platform/crypto` doc-comment), and
+                        // `loadNodeCrypto` is per-platform: the RN variant throws so Metro
+                        // never bundles a Node built-in reference.
                         try {
                             await verifyServiceTokenSignature(token, jwtSecret);
                             verifyServiceTokenClaims(decoded, {
@@ -551,10 +468,7 @@ export function OxyServicesUtilityMixin(Base) {
                                     method: 'auth',
                                 });
                             }
-                            // Process X-Acting-As header before proceeding
-                            if (await processActingAs())
-                                return next();
-                            return;
+                            return next();
                         }
                         catch (validationError) {
                             if (debug) {
@@ -618,9 +532,7 @@ export function OxyServicesUtilityMixin(Base) {
                             method: 'auth',
                         });
                     }
-                    // Process X-Acting-As header before proceeding
-                    if (await processActingAs())
-                        next();
+                    next();
                 }
                 catch (error) {
                     const handled = oxyInstance.handleError(error);

package/dist/esm/utils/cacheKey.js

@@ -3,8 +3,8 @@
  *
  * Extracted from {@link HttpService} so the identity-tag derivation is a pure,
  * independently testable function with no dependency on instance/token state.
- * The HTTP service injects the live access token and acting-as id; everything
- * here is referentially transparent given those inputs.
+ * The HTTP service injects the live access token; everything here is
+ * referentially transparent given that input.
  */
 import { jwtDecode } from 'jwt-decode';
 /**
@@ -58,25 +58,23 @@ export function fnv1a32(str) {
  *
  * We use the decoded user id rather than the raw JWT so the token never lands
  * in a cache key (no token leakage through any cache-key logging, no key bloat).
- * The acting-as id is folded in because managed-account responses differ per
- * acting identity — and `X-Acting-As` already changes the server response for
- * the same bearer token.
+ * Switching into a managed account mints a REAL new session whose access token
+ * carries the target account's id, so the identity tag changes naturally on a
+ * switch — there is no separate acting-as discriminator to fold in.
  *
  * @param accessToken The current bearer access token, or `null` when anonymous.
- * @param actingAsUserId The active managed-account id, or `null`.
  */
-export function computeIdentityTag(accessToken, actingAsUserId) {
-    let principal = ANON_IDENTITY;
-    if (accessToken) {
-        try {
-            const decoded = jwtDecode(accessToken);
-            principal = decoded.userId || decoded.id || `t${fnv1a32(accessToken)}`;
-        }
-        catch {
-            // Undecodable token — still partition it away from anon and from other
-            // tokens via a hash. Never silently fall back to ANON_IDENTITY.
-            principal = `t${fnv1a32(accessToken)}`;
-        }
+export function computeIdentityTag(accessToken) {
+    if (!accessToken) {
+        return ANON_IDENTITY;
+    }
+    try {
+        const decoded = jwtDecode(accessToken);
+        return decoded.userId || decoded.id || `t${fnv1a32(accessToken)}`;
+    }
+    catch {
+        // Undecodable token — still partition it away from anon and from other
+        // tokens via a hash. Never silently fall back to ANON_IDENTITY.
+        return `t${fnv1a32(accessToken)}`;
     }
-    return actingAsUserId ? `${principal}~as${actingAsUserId}` : principal;
 }

package/dist/esm/utils/deviceManager.js

@@ -1,4 +1,4 @@
-import { loadAsyncStorage } from './platformCrypto.js';
+import { loadAsyncStorage } from '@oxyhq/protocol';
 /**
  * Client-side device management utility
  * Handles persistent device identification across app sessions

package/dist/esm/utils/platform.js

@@ -74,18 +74,6 @@ export function isIOS() {
 export function isAndroid() {
     return getPlatformOS() === 'android';
 }
-/**
- * Check if running in React Native
- */
-export function isReactNative() {
-    return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
-}
-/**
- * Check if running in Node.js
- */
-export function isNodeJS() {
-    return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
-}
 /**
  * Set the platform OS explicitly
  * Called by React Native entry point to register the platform