@oxyhq/core 5.0.0 → 5.1.1

package/dist/esm/mixins/OxyServices.accounts.js

@@ -1,4 +1,6 @@
 import { normalizeUserIdentity } from '../utils/userIdentity.js';
+import { isWeb } from '../utils/platform.js';
+import { logger } from '../utils/loggerUtils.js';
 import { CACHE_TIMES } from './mixinHelpers.js';
 export function OxyServicesAccountsMixin(Base) {
     return class extends Base {
@@ -54,10 +56,19 @@ export function OxyServicesAccountsMixin(Base) {
          * Unlike the removed `X-Acting-As` delegation header, the returned session
          * IS the new identity: this plants `accessToken` as the active token —
          * exactly like `claimSessionByToken` / `verifyChallenge` — so every
-         * subsequent request authenticates as the target account. The refresh token
-         * is the server-set httpOnly `oxy_rt_<authuser>` cookie (never in the body),
-         * so it joins the device multi-account set and survives reload /
-         * `refresh-all` with no extra client work.
+         * subsequent request authenticates as the target account.
+         *
+         * Joining the device multi-account set (so the switch survives a reload and
+         * propagates cross-domain via `/auth/refresh-all`) requires a SECOND call, to
+         * `POST /auth/session`, made here after the token is planted. The switch route
+         * lives at `/accounts/*`, OUTSIDE the `oxy_rt_<authuser>` cookie's `Path=/auth`
+         * scope, so the server never sees the device's existing slots from it and
+         * would clobber slot 0 (destroying the operator's own session). `/auth/session`
+         * runs where those cookies ARE visible, so the server allocates a NEW slot that
+         * coexists with the operator's and returns its `authuser`. This step is
+         * web-only (native multi-account uses stored sessions, not cookies) and
+         * best-effort — a failure leaves the in-session switch intact; the switched
+         * account simply won't survive a reload until the cookie is next established.
          *
          * After planting, the SDK's identity-scoped GET cache is fully cleared so
          * every cached read re-fetches as the new account. (The consuming
@@ -74,11 +85,35 @@ export function OxyServicesAccountsMixin(Base) {
                 const res = await this.makeRequest('POST', `/accounts/${encodeURIComponent(accountId)}/switch`, undefined, { cache: false });
                 // Plant the freshly minted session as the ACTIVE session, mirroring
                 // `claimSessionByToken` / `verifyChallenge`: the response body carries
-                // the first access token; the refresh token is the server-set httpOnly
-                // cookie, so there is nothing else to store here.
+                // the first access token. The device refresh cookie is established below.
                 if (res?.accessToken) {
                     this.setTokens(res.accessToken);
                 }
+                // Register the switched session in the device's multi-account set by
+                // establishing its first-party refresh cookie. This MUST be a separate
+                // call to `POST /auth/session`: the switch route is at `/accounts/*`,
+                // outside the `oxy_rt_<authuser>` cookie's `Path=/auth` scope, so it can
+                // never read the device's existing slots and would overwrite slot 0
+                // (destroying the operator's own session). `/auth/session` runs where the
+                // cookies ARE visible, so the server allocates a NEW slot that coexists
+                // with the operator's and returns its `authuser`. Web-only; best-effort.
+                let authuser = res.authuser;
+                if (isWeb()) {
+                    try {
+                        const established = await this.makeRequest('POST', '/auth/session', undefined, { cache: false });
+                        if (typeof established?.authuser === 'number') {
+                            authuser = established.authuser;
+                        }
+                        // /auth/session mints a fresh access token off the same session;
+                        // re-plant it so the active token matches the rotated cookie.
+                        if (established?.accessToken) {
+                            this.setTokens(established.accessToken);
+                        }
+                    }
+                    catch (error) {
+                        logger.warn('[OxyServices] Failed to establish device refresh cookie after account switch; the switch is active in-session but may not survive a reload', { component: 'OxyServices', method: 'switchToAccount' }, error);
+                    }
+                }
                 // Identity changed → drop the entire GET response cache so no entry
                 // personalised for the previous identity is reused. Cache keys are
                 // identity-scoped, so a different identity could not READ the old
@@ -87,6 +122,7 @@ export function OxyServicesAccountsMixin(Base) {
                 this.clearCache();
                 return {
                     ...res,
+                    ...(typeof authuser === 'number' ? { authuser } : {}),
                     user: normalizeUserIdentity(res.user),
                 };
             }

package/dist/esm/mixins/OxyServices.assets.js

@@ -1,4 +1,13 @@
 import { isReactNative } from '@oxyhq/protocol';
+import { logger } from '../utils/loggerUtils.js';
+import { extractErrorStatus } from '../utils/errorUtils.js';
+/**
+ * Maximum number of ids sent per `POST /assets/service/by-ids` request. Matches
+ * the server-side batch cap (the route rejects empty or > 100 id arrays with a
+ * 400); larger inputs are split into multiple chunked calls and merged. Mirrors
+ * `getUsersByIds`'s `USERS_BY_IDS_CHUNK_SIZE`.
+ */
+const SERVICE_ASSET_METADATA_CHUNK_SIZE = 100;
 export function OxyServicesAssetsMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -144,6 +153,63 @@ export function OxyServicesAssetsMixin(Base) {
             }
             return urls;
         }
+        /**
+         * Resolve many Oxy asset ids to their content-addressed metadata in one
+         * round-trip per chunk via `POST /assets/service/by-ids` (body `{ ids }`).
+         *
+         * Returns each asset's `sha256`, `mime`, byte `size`, and `status` — built
+         * for server-to-server callers (e.g. Mention's MTN Protocol blob-ref
+         * resolution) that need the content hash for an asset id. Ids are
+         * deduplicated and validated (empty/blank ids dropped) before being split
+         * into chunks of {@link SERVICE_ASSET_METADATA_CHUNK_SIZE} (the server-side
+         * cap). The server omits unknown/deleted ids from each chunk's `data`, so
+         * the merged result may be shorter than the requested id list and the caller
+         * is expected to map by `id`.
+         *
+         * **Service-token auth (required).** `/assets/service/by-ids` is guarded by
+         * `serviceAuthMiddleware` + the `files:read` scope and is called via
+         * `makeServiceRequest`, which attaches `Authorization: Bearer <serviceToken>`
+         * (the same client that calls `POST /assets/service/cache`). The calling
+         * client MUST be service-configured (`configureServiceAuth(apiKey,
+         * apiSecret)`) before invoking this method; otherwise `getServiceToken()`
+         * throws because no credentials are available. A plain user-session request
+         * is rejected by the route's service-auth guard.
+         *
+         * Resilience: chunks are independent. A failed chunk is logged and skipped —
+         * the method returns every entry that resolved successfully rather than
+         * discarding the whole call on one chunk's failure. An empty/whitespace-only
+         * input resolves immediately with `[]` and performs no network call.
+         *
+         * Not cached at the SDK layer: it's a POST keyed on a multi-id body (low hit
+         * rate), mirroring the sibling service/POST methods which never cache.
+         */
+        async getServiceAssetMetadataByIds(ids) {
+            const uniqueIds = Array.from(new Set(ids.filter((id) => typeof id === 'string' && id.trim().length > 0)));
+            if (uniqueIds.length === 0) {
+                return [];
+            }
+            const chunks = [];
+            for (let i = 0; i < uniqueIds.length; i += SERVICE_ASSET_METADATA_CHUNK_SIZE) {
+                chunks.push(uniqueIds.slice(i, i + SERVICE_ASSET_METADATA_CHUNK_SIZE));
+            }
+            // Run chunks concurrently; a single chunk failure must not sink the rest.
+            const settled = await Promise.all(chunks.map(async (chunk) => {
+                try {
+                    const entries = await this.makeServiceRequest('POST', '/assets/service/by-ids', { ids: chunk });
+                    return Array.isArray(entries) ? entries : [];
+                }
+                catch (error) {
+                    logger.warn('getServiceAssetMetadataByIds: chunk failed, continuing with remaining chunks', {
+                        method: 'getServiceAssetMetadataByIds',
+                        chunkSize: chunk.length,
+                        status: extractErrorStatus(error),
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    return [];
+                }
+            }));
+            return settled.flat();
+        }
         /**
          * Upload raw file data
          */

package/dist/esm/mixins/OxyServices.user.js

@@ -230,16 +230,28 @@ export function OxyServicesUserMixin(Base) {
          * by `id`); each is run through `normalizeUserIdentity`, matching
          * `getUserById`.
          *
-         * **Service-token auth (required).** `/users/by-ids` is a server-to-server
-         * bulk fetch of PUBLIC user data and is called via `makeServiceRequest`,
-         * which attaches `Authorization: Bearer <serviceToken>`. oxy-api's CSRF
-         * middleware skips bearer-authenticated requests, so the calling client
-         * MUST be service-configured (`configureServiceAuth(apiKey, apiSecret)`)
-         * before invoking this method; otherwise `getServiceToken()` throws because
-         * no credentials are available. (A plain user-session request fails here:
-         * server-to-server there is no cookie jar, so the auto-attached
-         * `X-CSRF-Token` has no matching cookie and oxy-api rejects the POST with
-         * 403 "CSRF token missing".)
+         * **Dual-mode auth.** `/users/by-ids` is `optionalUserOrServiceAuth` on
+         * oxy-api: it accepts a service token, a user session, or an anonymous
+         * caller, and returns the SAME public `{ data: PublicUserProfile[] }`
+         * payload (canonical `name.displayName` + `_count`) in every case — no
+         * viewer-specific fields. This method picks the path automatically:
+         * - **Service-configured host (backend):** when `configureServiceAuth(apiKey,
+         *   apiSecret)` has been called, the chunk is fetched via `makeServiceRequest`
+         *   (attaches `Authorization: Bearer <serviceToken>`). This is the
+         *   server-to-server feed/notification hydration path (e.g. Mention's
+         *   `PostHydrationService`) and is unchanged.
+         * - **Plain client (browser / React Native with a user session):** when no
+         *   service credentials are configured, the chunk is fetched via
+         *   `makeRequest`, which attaches the configured user bearer. oxy-api's CSRF
+         *   middleware skips bearer-authenticated writes, and `makeRequest` only
+         *   fetches a CSRF token for cookie-only (no-bearer) state-changing requests,
+         *   so the user-bearer POST is sent without CSRF and succeeds. Previously
+         *   this method always used the service path, so every client-side caller
+         *   silently received `[]` because `getServiceToken()` had no credentials.
+         *
+         * Both paths run results through `normalizeUserIdentity` and unwrap the
+         * API's `{ data }` envelope identically (`makeServiceRequest` is literally
+         * `makeRequest` plus a bearer service header).
          *
          * Resilience: chunks are independent. A failed chunk is logged and skipped
          * — the method returns every user that resolved successfully rather than
@@ -258,15 +270,22 @@ export function OxyServicesUserMixin(Base) {
             for (let i = 0; i < uniqueIds.length; i += USERS_BY_IDS_CHUNK_SIZE) {
                 chunks.push(uniqueIds.slice(i, i + USERS_BY_IDS_CHUNK_SIZE));
             }
+            // A backend that called configureServiceAuth() uses the bearer-service
+            // path; any other caller (browser / RN with a user session) uses the
+            // user-bearer path. See the method doc for why the user path is CSRF-safe.
+            const useServiceAuth = Boolean(this._serviceApiKey && this._serviceApiSecret);
             // Run chunks concurrently; a single chunk failure must not sink the rest.
             const settled = await Promise.all(chunks.map(async (chunk) => {
                 try {
-                    const users = await this.makeServiceRequest('POST', '/users/by-ids', { ids: chunk });
+                    const users = useServiceAuth
+                        ? await this.makeServiceRequest('POST', '/users/by-ids', { ids: chunk })
+                        : await this.makeRequest('POST', '/users/by-ids', { ids: chunk }, { cache: false });
                     return Array.isArray(users) ? users.map((user) => normalizeUserIdentity(user)) : [];
                 }
                 catch (error) {
                     logger.warn('getUsersByIds: chunk failed, continuing with remaining chunks', {
                         method: 'getUsersByIds',
+                        mode: useServiceAuth ? 'service' : 'user',
                         chunkSize: chunk.length,
                         status: extractErrorStatus(error),
                         error: error instanceof Error ? error.message : String(error),