@oxyhq/core 5.1.1 → 5.2.1

package/src/models/interfaces.ts

@@ -533,6 +533,30 @@ export interface ServiceAssetMetadata {
   status: 'active' | 'trash';
 }
 
+/**
+ * Reverse-lookup asset metadata returned by `POST /assets/service/by-sha256`.
+ *
+ * Resolves a content-addressed `sha256` digest back to the live Oxy asset that
+ * holds those bytes: its file `id`, MIME type, byte `size`, storage `status`,
+ * and — for active, public, CDN-reachable assets only — a public `url`
+ * (`cloud.oxy.so`). This is the inverse of {@link ServiceAssetMetadata}: it lets
+ * a `files:read`-scoped service-to-server caller (e.g. Mention's MTN materializer
+ * / node-blob sync) turn a record's `blob.sha256` into a servable asset.
+ *
+ * `url` is omitted for private/unlisted assets (and for public assets whose
+ * bytes are not yet CDN-reachable) — those must be streamed through the origin.
+ * Unknown or deleted hashes are omitted from the response (never error the whole
+ * batch), so the result may be shorter than the requested hash list.
+ */
+export interface ServiceAssetMetadataBySha {
+  sha256: string;
+  id: string;
+  mime: string;
+  size: number;
+  status: 'active' | 'trash';
+  url?: string;
+}
+
 /**
  * Account storage usage (server-side usage, not local AsyncStorage)
  */

package/src/utils/__tests__/ssoBounce.test.ts

@@ -16,9 +16,11 @@ import {
   ssoNoSessionKey,
   ssoAttemptedKey,
   ssoPriorSessionKey,
+  ssoSignedOutKey,
   buildSsoBounceUrl,
   isCentralIdPOrigin,
   guardActive,
+  silentRestoreSuppressed,
   allowSsoBounce,
 } from '../ssoBounce';
 import { CENTRAL_AUTH_URL } from '../authWebUrl';
@@ -40,11 +42,50 @@ describe('per-origin key builders', () => {
     expect(ssoNoSessionKey(origin)).toBe('oxy_sso_no_session:https://mention.earth');
     expect(ssoAttemptedKey(origin)).toBe('oxy_sso_attempted:https://mention.earth');
     expect(ssoPriorSessionKey(origin)).toBe('oxy_sso_prior_session:https://mention.earth');
+    expect(ssoSignedOutKey(origin)).toBe('oxy_signed_out:https://mention.earth');
   });
 
   it('namespaces keys per origin so two RPs never collide', () => {
     expect(ssoStateKey('https://a.test')).not.toBe(ssoStateKey('https://b.test'));
     expect(ssoPriorSessionKey('https://a.test')).not.toBe(ssoPriorSessionKey('https://b.test'));
+    expect(ssoSignedOutKey('https://a.test')).not.toBe(ssoSignedOutKey('https://b.test'));
+  });
+});
+
+describe('silentRestoreSuppressed (deliberately-signed-out gate)', () => {
+  const origin = 'https://accounts.oxy.so';
+
+  function storageWith(value: string | null): Pick<Storage, 'getItem'> {
+    return { getItem: (key: string) => (key === ssoSignedOutKey(origin) ? value : null) };
+  }
+
+  it('is SUPPRESSED when the signed-out flag is set to "1" for this origin', () => {
+    expect(silentRestoreSuppressed(storageWith('1'), origin)).toBe(true);
+  });
+
+  it('is NOT suppressed when the flag is absent (normal restore)', () => {
+    expect(silentRestoreSuppressed(storageWith(null), origin)).toBe(false);
+  });
+
+  it('is NOT suppressed for any non-"1" value (only the exact set value gates)', () => {
+    expect(silentRestoreSuppressed(storageWith('0'), origin)).toBe(false);
+    expect(silentRestoreSuppressed(storageWith(''), origin)).toBe(false);
+  });
+
+  it('is per-origin: another origin\'s flag does not suppress this one', () => {
+    const otherOriginFlag: Pick<Storage, 'getItem'> = {
+      getItem: (key: string) => (key === ssoSignedOutKey('https://other.test') ? '1' : null),
+    };
+    expect(silentRestoreSuppressed(otherOriginFlag, origin)).toBe(false);
+  });
+
+  it('fails safe (NOT suppressed, never throws) when getItem throws', () => {
+    const throwing: Pick<Storage, 'getItem'> = {
+      getItem: () => {
+        throw new Error('storage locked');
+      },
+    };
+    expect(silentRestoreSuppressed(throwing, origin)).toBe(false);
   });
 });
 

package/src/utils/cache.ts

@@ -240,6 +240,8 @@ export function registerCacheForCleanup(cache: TTLCache<any>): void {
         cache.cleanup();
       }
     }, 60000); // Every minute
+    // Never block process/worker exit on a housekeeping timer.
+    cleanupInterval.unref?.();
   }
 }
 

package/src/utils/ssoBounce.ts

@@ -69,6 +69,7 @@ const NO_SESSION_KEY_PREFIX = 'oxy_sso_no_session:';
 const ATTEMPTED_KEY_PREFIX = 'oxy_sso_attempted:';
 const CALLBACK_BOOTSTRAP_KEY_PREFIX = 'oxy_sso_callback_bootstrap:';
 const PRIOR_SESSION_KEY_PREFIX = 'oxy_sso_prior_session:';
+const SIGNED_OUT_KEY_PREFIX = 'oxy_signed_out:';
 
 /** Per-origin CSRF state key (matched on return to defeat fragment forgery). */
 export function ssoStateKey(origin: string): string {
@@ -125,6 +126,37 @@ export function ssoPriorSessionKey(origin: string): string {
   return `${PRIOR_SESSION_KEY_PREFIX}${origin}`;
 }
 
+/**
+ * Per-origin DURABLE "the user DELIBERATELY signed out on this device/origin"
+ * flag.
+ *
+ * Like {@link ssoPriorSessionKey} this lives in DURABLE storage (web
+ * `localStorage`; services uses its own `storageKeyPrefix`-scoped key), NOT the
+ * per-tab `sessionStorage` the loop-breaker keys use — it must survive a reload.
+ *
+ * It exists purely to suppress AUTOMATIC silent restore after a deliberate
+ * sign-out: a still-live IdP session (the central `fedcm_session` / the FedCM
+ * credential association) would otherwise let `fedcm-silent` / the per-apex
+ * `/auth/silent` iframe re-mint a session on the very next cold boot, so a user
+ * who pressed "Sign out" gets silently signed back in on reload. With this flag
+ * set, those silent cold-boot steps are skipped while the Gmail-style
+ * returning-account fast-path is otherwise preserved.
+ *
+ * Lifecycle (mirrors the existing gate machinery — set on a definitive event,
+ * cleared on its inverse):
+ *   - SET on EXPLICIT full sign-out (alongside clearing the prior-session hint
+ *     and the SSO bounce state).
+ *   - CLEARED on ANY deliberate sign-in (password, FedCM, account switch, device
+ *     claim) so a real sign-in fully re-enables silent restore — there is no
+ *     "stuck signed out" state.
+ *
+ * NOTE: this gates only AUTOMATIC/silent restore. An INTERACTIVE sign-in always
+ * clears it first, so the user can always sign back in.
+ */
+export function ssoSignedOutKey(origin: string): string {
+  return `${SIGNED_OUT_KEY_PREFIX}${origin}`;
+}
+
 /**
  * Per-origin marker written by the pre-hydration callback bootstrap.
  *
@@ -267,6 +299,35 @@ export function guardActive(
   return now - ts < SSO_GUARD_TTL_MS;
 }
 
+/**
+ * Whether AUTOMATIC silent restore is SUPPRESSED for this origin because the
+ * user deliberately signed out (the durable {@link ssoSignedOutKey} flag).
+ *
+ * When `true`, the silent cold-boot steps that can re-mint a session from a
+ * still-live IdP session WITHOUT user intent — `fedcm-silent` and the per-apex
+ * `/auth/silent` iframe — MUST be skipped, so a user who pressed "Sign out" is
+ * not silently signed back in on the next reload. Interactive sign-in clears the
+ * flag, so this never blocks a deliberate re-sign-in.
+ *
+ * Defensive: a `getItem` that throws (locked/disabled storage) is treated as NOT
+ * suppressed, so the gate fails toward the normal restore behaviour rather than
+ * wedging the user out.
+ *
+ * @param storage - The DURABLE storage to read (web `localStorage`; injected for
+ *   testability).
+ * @param origin - The page origin whose signed-out flag to evaluate.
+ */
+export function silentRestoreSuppressed(
+  storage: Pick<Storage, 'getItem'>,
+  origin: string,
+): boolean {
+  try {
+    return storage.getItem(ssoSignedOutKey(origin)) === '1';
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Inputs to the smart {@link allowSsoBounce} gate.
  */