@oxyhq/core 5.0.0 → 5.1.1

package/src/mixins/__tests__/accounts.test.ts

@@ -176,57 +176,100 @@ describe('OxyServices.accounts', () => {
   });
 
   describe('switchToAccount', () => {
+    // The switch route NO LONGER returns `authuser` or sets the device cookie —
+    // it can't (it's at /accounts/*, outside the Path=/auth cookie scope). The SDK
+    // establishes the cookie + resolves the slot via a follow-up POST /auth/session.
     const switchResponse: SwitchAccountResult = {
       sessionId: 'sess_switch',
       deviceId: 'dev_switch',
       expiresAt: '2026-06-30T01:00:00.000Z',
       accessToken: 'access_switch',
       user: { id: 'acc1', username: 'oxy-org', name: { displayName: 'Oxy Org' } },
-      authuser: 2,
     };
+    // POST /auth/session establishes the cookie in a correctly-allocated NEW slot
+    // and returns that slot + a fresh access token off the same session.
+    const sessionResponse = { accessToken: 'access_session', authuser: 1 };
+
+    // Route makeRequest by path: the switch call vs the /auth/session establishment.
+    const routeByPath = (response = switchResponse) =>
+      makeRequestSpy.mockImplementation((_method: string, path: string) =>
+        Promise.resolve(path === '/auth/session' ? sessionResponse : response),
+      );
 
-    it('posts to /:id/switch (no body, no cache), plants the token, sweeps the cache, and returns the session', async () => {
+    it('posts to /:id/switch then establishes the cookie via POST /auth/session, planting both tokens and sweeping the cache', async () => {
       const setTokensSpy = jest.spyOn(oxy, 'setTokens');
       const clearCacheSpy = jest.spyOn(oxy, 'clearCache');
-      makeRequestSpy.mockResolvedValue(switchResponse);
+      routeByPath();
 
       const result = await oxy.switchToAccount('acc1');
 
-      // Request shape: POST, exact path, no body, cache disabled.
+      // Switch request shape: POST, exact path, no body, cache disabled.
       expect(makeRequestSpy).toHaveBeenCalledWith(
         'POST',
         '/accounts/acc1/switch',
         undefined,
         expect.objectContaining({ cache: false }),
       );
+      // Then the canonical refresh-cookie establishment under /auth (where the
+      // device's oxy_rt_* slots ARE visible, so a NEW slot is allocated).
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/auth/session',
+        undefined,
+        expect.objectContaining({ cache: false }),
+      );
 
-      // Session planting: the access token from the body is installed as the
-      // active token (mirrors claimSessionByToken / verifyChallenge).
-      expect(setTokensSpy).toHaveBeenCalledWith('access_switch');
-      expect(oxy.getAccessToken()).toBe('access_switch');
+      // The switch token is planted first; /auth/session's fresh token re-planted.
+      expect(setTokensSpy).toHaveBeenNthCalledWith(1, 'access_switch');
+      expect(setTokensSpy).toHaveBeenNthCalledWith(2, 'access_session');
+      expect(oxy.getAccessToken()).toBe('access_session');
       expect(oxy.hasValidToken()).toBe(true);
 
-      // Identity changed → the whole GET cache is swept so reads refetch as the
-      // new account, AND it happens AFTER the token is planted.
+      // Cache swept once, AFTER both tokens are planted.
       expect(clearCacheSpy).toHaveBeenCalledTimes(1);
-      expect(setTokensSpy.mock.invocationCallOrder[0]).toBeLessThan(
+      expect(setTokensSpy.mock.invocationCallOrder[1]).toBeLessThan(
         clearCacheSpy.mock.invocationCallOrder[0],
       );
 
-      // The returned session carries the target account (id-normalised) + authuser.
-      expect(result).toEqual({ ...switchResponse, user: { id: 'acc1', username: 'oxy-org', name: { displayName: 'Oxy Org' } } });
-      expect(result.authuser).toBe(2);
+      // The returned session carries the target account (id-normalised) and the
+      // slot resolved by /auth/session — NEVER the clobbering slot 0.
+      expect(result.sessionId).toBe('sess_switch');
+      expect(result.user).toEqual({ id: 'acc1', username: 'oxy-org', name: { displayName: 'Oxy Org' } });
+      expect(result.authuser).toBe(1);
 
       setTokensSpy.mockRestore();
       clearCacheSpy.mockRestore();
     });
 
     it('URL-encodes the accountId path segment', async () => {
-      makeRequestSpy.mockResolvedValue(switchResponse);
+      routeByPath();
       await oxy.switchToAccount('a b/c');
       expect(makeRequestSpy.mock.calls[0][1]).toBe('/accounts/a%20b%2Fc/switch');
     });
 
+    it('keeps the switch active in-session when /auth/session fails (best-effort cookie)', async () => {
+      const setTokensSpy = jest.spyOn(oxy, 'setTokens');
+      const clearCacheSpy = jest.spyOn(oxy, 'clearCache');
+      makeRequestSpy.mockImplementation((_method: string, path: string) =>
+        path === '/auth/session'
+          ? Promise.reject(Object.assign(new Error('origin'), { response: { status: 403 } }))
+          : Promise.resolve(switchResponse),
+      );
+
+      const result = await oxy.switchToAccount('acc1');
+
+      // The in-session switch survives: the switch token stays planted and the
+      // cache is still swept. The switched account just won't survive a reload
+      // until the cookie is next established (no authuser resolved).
+      expect(setTokensSpy).toHaveBeenCalledWith('access_switch');
+      expect(oxy.getAccessToken()).toBe('access_switch');
+      expect(clearCacheSpy).toHaveBeenCalledTimes(1);
+      expect(result.authuser).toBeUndefined();
+
+      setTokensSpy.mockRestore();
+      clearCacheSpy.mockRestore();
+    });
+
     it('does NOT plant or sweep when the operator is not authorized (403 surfaces via handleError)', async () => {
       const setTokensSpy = jest.spyOn(oxy, 'setTokens');
       const clearCacheSpy = jest.spyOn(oxy, 'clearCache');
@@ -235,9 +278,16 @@ describe('OxyServices.accounts', () => {
       );
 
       await expect(oxy.switchToAccount('acc1')).rejects.toThrow();
-      // A failed switch must NOT mutate session state.
+      // A failed switch must NOT mutate session state, and must NOT attempt the
+      // /auth/session establishment.
       expect(setTokensSpy).not.toHaveBeenCalled();
       expect(clearCacheSpy).not.toHaveBeenCalled();
+      expect(makeRequestSpy).not.toHaveBeenCalledWith(
+        'POST',
+        '/auth/session',
+        undefined,
+        expect.anything(),
+      );
 
       setTokensSpy.mockRestore();
       clearCacheSpy.mockRestore();

package/src/mixins/__tests__/getUsersByIds.test.ts

@@ -0,0 +1,149 @@
+/**
+ * `getUsersByIds` dual-mode auth tests.
+ *
+ * `POST /users/by-ids` is `optionalUserOrServiceAuth` on oxy-api and returns
+ * the identical public `{ data: PublicUserProfile[] }` shape for both a service
+ * token and a user session. The SDK method must therefore:
+ *  - use the bearer-SERVICE path (`makeServiceRequest`) when the instance was
+ *    configured via `configureServiceAuth()` (the backend / hydration case), and
+ *  - use the USER path (`makeRequest('POST', ..., { cache: false })`) otherwise
+ *    (a browser / RN client with only a user session). Before the dual-mode fix
+ *    the method always took the service path, so every client-side caller got
+ *    `[]` because `getServiceToken()` had no credentials.
+ *
+ * Both paths must dedup + chunk, map every result through `normalizeUserIdentity`
+ * (so `name.displayName` is present), and tolerate a per-chunk failure without
+ * sinking the rest. `makeRequest` / `makeServiceRequest` are stubbed so the
+ * tests run with no network.
+ */
+
+import { OxyServices } from '../../OxyServices';
+import type { User } from '../../models/interfaces';
+
+const makeRawUser = (id: string): User =>
+  // The wire payload is a PublicUserProfile with server-owned name.displayName.
+  // Cast through the User shape the API returns post-unwrap.
+  ({
+    id,
+    username: `user_${id}`,
+    name: { displayName: `Display ${id}` },
+    _count: { followers: 1, following: 2 },
+  }) as unknown as User;
+
+describe('OxyServices.getUsersByIds — dual-mode auth', () => {
+  let oxy: OxyServices;
+  let makeRequestSpy: jest.SpyInstance;
+  let makeServiceRequestSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    makeRequestSpy = jest.spyOn(oxy, 'makeRequest');
+    makeServiceRequestSpy = jest.spyOn(
+      oxy as unknown as { makeServiceRequest: jest.Mock },
+      'makeServiceRequest',
+    );
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('returns [] and performs no network call for empty / whitespace input', async () => {
+    await expect(oxy.getUsersByIds([])).resolves.toEqual([]);
+    await expect(oxy.getUsersByIds(['', '   '])).resolves.toEqual([]);
+    expect(makeRequestSpy).not.toHaveBeenCalled();
+    expect(makeServiceRequestSpy).not.toHaveBeenCalled();
+  });
+
+  describe('without service credentials (client / user-session path)', () => {
+    it('uses makeRequest with the user bearer and cache:false', async () => {
+      makeRequestSpy.mockResolvedValueOnce([makeRawUser('a'), makeRawUser('b')]);
+
+      const result = await oxy.getUsersByIds(['a', 'b']);
+
+      expect(makeServiceRequestSpy).not.toHaveBeenCalled();
+      expect(makeRequestSpy).toHaveBeenCalledTimes(1);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/users/by-ids',
+        { ids: ['a', 'b'] },
+        { cache: false },
+      );
+      // normalizeUserIdentity ran on every entry (display name preserved).
+      expect(result).toHaveLength(2);
+      expect(result[0].name.displayName).toBe('Display a');
+      expect(result[1].id).toBe('b');
+    });
+
+    it('de-duplicates ids and drops blanks before the request', async () => {
+      makeRequestSpy.mockResolvedValueOnce([makeRawUser('a')]);
+
+      await oxy.getUsersByIds(['a', 'a', '   ', 'a']);
+
+      expect(makeRequestSpy).toHaveBeenCalledTimes(1);
+      expect(makeRequestSpy).toHaveBeenCalledWith(
+        'POST',
+        '/users/by-ids',
+        { ids: ['a'] },
+        { cache: false },
+      );
+    });
+  });
+
+  describe('with service credentials (backend / hydration path)', () => {
+    beforeEach(() => {
+      oxy.configureServiceAuth('oxy_dk_key', 'secret');
+    });
+
+    it('uses makeServiceRequest and never the user path — unchanged behavior', async () => {
+      makeServiceRequestSpy.mockResolvedValueOnce([makeRawUser('a'), makeRawUser('b')]);
+
+      const result = await oxy.getUsersByIds(['a', 'b']);
+
+      expect(makeRequestSpy).not.toHaveBeenCalled();
+      expect(makeServiceRequestSpy).toHaveBeenCalledTimes(1);
+      expect(makeServiceRequestSpy).toHaveBeenCalledWith('POST', '/users/by-ids', {
+        ids: ['a', 'b'],
+      });
+      expect(result).toHaveLength(2);
+      expect(result[0].name.displayName).toBe('Display a');
+    });
+  });
+
+  describe('chunking + resilience (applies to both modes)', () => {
+    it('chunks at 100 ids per request on the user path and flattens results', async () => {
+      const ids = Array.from({ length: 250 }, (_, i) => `id-${i}`);
+      makeRequestSpy.mockImplementation(
+        async (
+          _method: string,
+          _url: string,
+          data?: { ids: string[] },
+        ): Promise<User[]> => (data?.ids ?? []).map((id) => makeRawUser(id)),
+      );
+
+      const result = await oxy.getUsersByIds(ids);
+
+      // 250 unique ids => 100 + 100 + 50 across three POSTs.
+      expect(makeRequestSpy).toHaveBeenCalledTimes(3);
+      const chunkSizes = makeRequestSpy.mock.calls.map(
+        (call) => (call[2] as { ids: string[] }).ids.length,
+      );
+      expect(chunkSizes).toEqual([100, 100, 50]);
+      expect(result).toHaveLength(250);
+    });
+
+    it('skips a failed chunk and returns the users that resolved (user path)', async () => {
+      const ids = Array.from({ length: 150 }, (_, i) => `id-${i}`);
+      makeRequestSpy
+        .mockResolvedValueOnce([makeRawUser('id-0')])
+        .mockRejectedValueOnce(new Error('chunk boom'));
+
+      const result = await oxy.getUsersByIds(ids);
+
+      expect(makeRequestSpy).toHaveBeenCalledTimes(2);
+      // The failed second chunk contributes nothing; the first survives.
+      expect(result).toHaveLength(1);
+      expect(result[0].id).toBe('id-0');
+    });
+  });
+});

package/src/models/interfaces.ts

@@ -514,6 +514,25 @@ export interface AssetUpdateVisibilityResponse {
   };
 }
 
+/**
+ * Minimal, service-token-scoped asset metadata returned by
+ * `POST /assets/service/by-ids`.
+ *
+ * Resolves an Oxy asset `id` to its content-addressed identity (`sha256`),
+ * MIME type, byte `size`, and storage `status`. Used by server-to-server
+ * callers (e.g. Mention's MTN Protocol blob-ref resolution) that hold a
+ * `files:read`-scoped service token rather than a user session. Unknown or
+ * deleted ids are omitted from the response (never error the whole batch),
+ * so the result may be shorter than the requested id list.
+ */
+export interface ServiceAssetMetadata {
+  id: string;
+  sha256: string;
+  mime: string;
+  size: number;
+  status: 'active' | 'trash';
+}
+
 /**
  * Account storage usage (server-side usage, not local AsyncStorage)
  */